In earlier posts, we discussed the challenges in relying on anonymisation and consent as bases for processing genetic data in compliance with GDPR. An alternative ground for processing genetic data, relevant in this area, is the scientific research exemption. Under the GDPR, member states and the EU can further legislate to provide derogations from data subjects' rights to access or rectify the data, or to restrict or object to processing of the data when processing for the purpose of scientific research (Article 89).

The recitals in the GDPR add colour to how "scientific research" should be interpreted. The GDPR suggests that processing for scientific research purposes should be interpreted in a broad manner, and should include privately funded research (Recital 159). A difficulty with this is that it is not clear whether "privately funded research" necessarily includes research carried out for purpose of developing a commercial product.

Relevantly to diagnostics providers, one of the recitals suggests that when datasets are coupled together, they become particularly valuable and can strongly enhance research results, and specifically mentions that this kind of data can be of great value to medical conditions such as cancer and cardiovascular disease.

Though processing for the purposes of scientific research does not require consent, it does require transparency. This means that data subjects need to be:

  • told what the purpose of the processing is;
  • told who the controllers are; and
  • given clear means of exercising their rights, such as of rectification or erasure of personal data, unless a particular Member State has derogated from the relevant part of the GDPR. For example, British data subjects do not enjoy a right to rectification when their data is processed for scientific research, to the extent that the right to rectification would prevent or seriously impair achieving the research.

The first of the above requirements could be addressed by a clearly-worded patient consent form advising a patient that their data will be processed for the purposes of generating a diagnosis, as well as being pseudonymised and used to develop products and/or conduct research.

The second and third requirements might present more difficulties. As flagged earlier, if a dataset is shared with a partner pharmaceutical company, subjects will need to be advised of the existence of a new controller and will also need to be advised as to how they can have their information removed from the dataset. This could be a fairly taxing practical hurdle. The GDPR contemplates that sometimes this would involve disproportionate effort, or would even prove impossible. However, the former Article 29 Working Party has emphasised that there are very few situations in which "a data controller can demonstrate that it is actually impossible to provide the information to data subjects." 1 As highlighted by the European Data Protection Board in its Guidelines on processing data in the context of the COVID-19 outbreak, when processing health data for scientific purposes, appropriate technical measures must be implemented to ensure a sufficient level of security. These should include encryption, strict access limitations, and pseudonymisation. 2

As flagged in our first post, the EDPB guidelines on processing on the basis of scientific research to be released in the coming months will seek to shed some light on this complicated exemption.

In the next article in our series, we will explore the use of synthetic data in the diagnostics space.

Footnotes

1. Guidelines on transparency under Regulation 2016/679 of the former Article-29 Working-Party from 11.4.2018, WP260 rev.01, 17/EN, page 29 (endorsed by the EDPB). Available at https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227.

2. Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak. Available at https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_en.pdf

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.