Public Interest, Health Research and Data Protection Law: Establishing a Legitimate Trade-Off between Individual Control and Research Access to Health Data

Abstract

The United Kingdom's Data Protection Act 2018 introduces a new public interest test applicable to the research processing of personal health data. The need for interpretation and application of this new safeguard creates a further opportunity to craft a health data governance landscape deserving of public trust and confidence. At the minimum, to constitute a positive contribution, the new test must be capable of distinguishing between instances of health research that are in the public interest, from those that are not, in a meaningful, predictable and reproducible manner. In this article, we derive from the literature on theories of public interest a concept of public interest capable of supporting such a test. Its application can defend the position under data protection law that allows a legal route through to processing personal health data for research purposes that does not require individual consent. However, its adoption would also entail that the public interest test in the 2018 Act could only be met if all practicable steps are taken to maximise preservation of individual control over the use of personal health data for research purposes. This would require that consent is sought where practicable and objection respected in almost all circumstances. Importantly, we suggest that an advantage of relying upon this concept of the public interest, to ground the test introduced by the 2018 Act, is that it may work to promote the social legitimacy of data protection legislation and the research processing that it authorises without individual consent (and occasionally in the face of explicit objection).

Health Data, Public Interest, and Surveillance for Non-health-Related Purposes

“…Ultimately, what drives shifts and re-designs to a decision-making process is the need to maintain qualities 'that provide arguments for the acceptability of its decisions' (Mashaw, 1983, p. 24; see also Taylor & Whitton, 2020). This may be a political decision but it is not just the backdrop to the Health Service (Control of Patient Information) Regulations 2002 that suggests that the social legitimacy of the public use of health data should not be taken for granted.…”

A Survey of Context-Aware Access Control Mechanisms for Cloud and Fog Networks: Taxonomy and Open Research Issues

“…On the one hand, like different health problems in ancient times, millions of Australians are currently despairing at this data breach war and they are worried about their privacy and health information, which might be sold and used by unauthorized third-parties, while on the other hand, it is necessary to disclose and give permission of their medical information to different health-related professionals towards a better treatment. There is still no clear guidance of the secondary use of health data where that is "in the public interest" [126].…”

Recruiting general practitioners and patients with dementia into a cluster randomised controlled trial: strategies, barriers and facilitators

“…For example, in a qualitative study investigating perceived barriers among GPs towards recruiting patients into RCTs lack of confidence in introducing research participation requests to their patients was found as one main reason [19]. Data protection regulations also make it particularly difficult to contact patients directly [33]. Particularly in studies with a limited funding period, extending periods of recruitment represent a major problem [34].…”