Fit for purpose? The GDPR and the governance of European digital health

Abstract

The introduction of the General Data Protection Regulation (GDPR) in 2018 served as the cornerstone of the new data governance regime of the European Union. Informed by principles and values such as privacy, accountability, transparency, and fairness, the GDPR is premised on the objective to balance the protection of individual privacy and the promotion of a thriving European data economy. Still, shortcomings of this regulatory effort have been noted by recent ethical, socio-political, legal, and policy scholarship. Focusing on the deployment of digital health technologies and big data practices within the European digital health ecosystem, this article draws upon these bodies of literature to chart the main lines of tension emerging between the current GDPR-based data governance regime and the broader societal shifts coming along with the expansion of digital health. Central aspects of the GDPR-i.e. key underlying data protection principles and regulatory categories, the reliance on the "notice-and-consent" model, the (narrow) remit of the Regulation vis-a-vis possible harms and discriminations-are misaligned with the surge in digital health. This throws into doubt whether the Regulation is fully fit for the purpose of governing current developments in this field, while also calling for swift and adequate policy responses.

The problem of innovation in technoscientific capitalism: data rentiership and the policy implications of turning personal digital data into a private asset

“…This Canadian example is not an isolated incident by any means. It reflects previous attempts by the European Union (EU), for example, to strengthen their data privacy and protection regulations with the 2018 General Data Protection Regulation (GDPR) (Edwards 2018;Marelli, Lievevrouw, and van Hoyweghen 2020). Other actors like the World Economic Forum (Schwab 2017), the Centre for International Governance Innovation (Ciuriak 2018), the Information Technology and Innovation Foundation (ITIF 2019), and Organisation for Economic Co-operation and Development (OECD 2019) have also waded into these policy debates about data governance, presenting their various takes on the policies and regulations needed to support an emerging "data-driven" economy.…”

“…Retention and use beyond this specified and time-limited period would be made illegal, while applications developed on the back of personal data would have a time-limited property right. Marelli, Lievevrouw, and van Hoyweghen (2020) point out this key tension in data protection regulationslike the EU's GDPRwith regards to how data are used after they are collected and who controls new data created through its processing (e.g. inferences about individual behaviour).…”

Tracking lives, forging markets

“…It might not be clear to customers that their data is circulated through the data analytics companies and the companies that manufacture and produce the wearable devices and the wellbeing servicesand, perhaps, used for these companies' own purposes. This exemplifies the inadequacies of the GDPR in regulating emerging big data practices and the shortcomings of the notice-and-consent model (see Marelli et al 2020). ORCID Maiju Tanninen http://orcid.org/0000-0003-3274-6360 Turo-Kimmo Lehtonen http://orcid.org/0000-0002-6063-2056 Minna Ruckenstein http://orcid.org/0000-0002-7600-1419…”

Thinking “ethical” when designing an international, cross‐disciplinary biomedical research consortium

“…Artificial intelligence (AI) has great potential for improving healthcare decision‐making. Besides potential tensions with data protection principles and mechanisms deriving from the implementation of AI technologies (Marelli et al , ), important points of consideration here are the actual input data used to train AI applications and the labelling and the algorithms used to analyse the data. One of the major potential risks with applying AI in a medical context concerns potential bias and discrimination.…”