1. Introduction - the journey to the General Data Protection Regulation 2016/679

In the late 1970s, there was an international realisation that computers had, and would continue to develop, extraordinary power to store and process large amounts of data, and that this revolution had the potential to produce the potential for harm as well as benefit to people to whom the data related. Therefore, under the auspices of OECD an international agreement was reached about privacy in processing personal data in 1980.[1] In Europe, the Council of Europe agreed a translation of that international expectation for its Member States in 1981.[2] These two developments introduced into many national jurisdictions a detailed (and to some extent harmonised) expression of privacy in relation to the electronic processing of personal data held about their citizens.

By the 1990s it was clear in the European Union (as it is now), that the processing of personal data was at the heart of a lot of modern commerce, and that if citizens were to have confidence to participate in a single European market they had to have confidence that their data would be processed in at least as good a way as it would be processed within their home jurisdictions. It was also realised that the protection envisaged in the early 1980s, relating to only electronic processing of personal data, was inadequate, and that the regulation if the processing of personal data had to start from a presumption that data protection covered all forms of processing of personal data. This could be relaxed in certain areas (for example, purely domestic processing of personal data for private use by citizens), but it was necessary to widen the scope of the concept of "processing" of personal data so that the protections were more widely available than simply relating to the rather arbitrary 'electronic processing' coverage of the first iteration of data protection. The response was Directive 95/46/EC on the processing of personal data. Today, nearly 20 years on from that Directive, the EU has completed a further reform of the data protection regime, again, taking into consideration further developments in technology - particularly the processing of personal data via the internet and world-wide web. The opportunity was taken to seek a further and more effective harmonisation of data protection law, with a move from a Directive[3] to a Regulation.[4] The process of reform, publicly, started on 25th January 2012 with the publication by the European Commission of its draft Regulation on processing personal data. The legislative process to agree the Regulation was extremely difficult. Whereas the initial response of the Council was favourable, it was not expressed in a ‘first reading’ of the Bill in Council.

The Parliament, with the work of the LIBE select committee, tabled a record number of amendments to the BIll. A first reading in both institutions took years to achieve. Thereafter, faced with an almost intractable impasse, the Bill moved into Trilogue - a process whereby representatives from the Council, the Parliament, and the Commission directly negotiate to (seek to) achieve a workable compromise that is then presented for approval in the Council and in the Parliament. The General Data Protection Regulation 2016/679 (GDPR) was adopted on 27th April 2016 into EU law on 27th April 2016. It comes into force in the Member States on 25th May 2018.

2. The shape of European Union data protection

The GDPR is very familiar to those who know both Directive 95/46/EC and the earlier Council of Europe Convention. The same basic structure is in place. A small table of the mapping between the Directive and the Regulation is given after the ‘Reading’ at the end of this part.

• Data protection concerns the processing of (sensitive) personal data, relating to data subjects by data controllers (perhaps through data processors), still under a high degree of control from the national control of Supervisory Authorities. The addition to the dramatic personae in the GDPR is the inclusion of Data Protection Officers who will be appointed at an institutional level and play an important role in relation particularly to high impact processing.
• Data controllers owe duties to data subjects, particularly to process the data fairly and lawfully (Articles 5, 6, and 9), and to inform the data subject about the processing (Articles 13 and 14).
• Data subjects have rights, essentially to ensure their own protection, particularly to gain access to the data that is processed about them, to have that data corrected where it is incorrect, to block its processing, and to have the data erased (Article 15–22). In relation to research, the much discussed “right to be forgotten” does not apply.
• Member States each have the duty to create a Supervisory Authority that must operate the registration of date processing, engage where appropriate in responding to ‘high impact’ processing, investigate and prosecute complaints of breaches in data protection law, ensure the operation of the Regulation in their jurisdiction, with some discretionary powers within the Regulation still falling to them (as in the Directive).
• Member States must also ensure that there is a com pensation and punishment regime in place in its jurisdiction in line with the requirements of the Regulation. The sanctions available under the Regulation are much higher than those under the Directive.
• The EU supervisory authorities are strengthened under the Regulation. There is a EU Data Protection Supervisor, and the Article 29 Working Group becomes the EU Data Protection Board.

“‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (Article 4.1, GDPR)

Article 4 provides the definitions that operate in the interpretation of the GDPR. Whilst it might be too obvious to mention this, it must be done: definitions and understandings of terms in other disciplines or contexts have no bearing on the interpretation of words that are defined in the GDPR. In particular, the concepts of 'anonymisation' and 'pseudonymisation' that operate in many of our disciplines have to be put aside when thinking about the GDPR. In the GDPR the concept in operation is identifiability (although the GDPR does define pseudonymisation);  can the (potential) data subject be identified either from the data in the possession of an individual or that data in combination with other data that are reasonably foreseeable to come into the possession of that individual (not just the data controller). If the answer yes, then the person to whom that data relates is a data subject and GDPR applies to them (through the domestic law of the jurisdiction in which s/he is situated). If the answer is no, then the GDPR does not apply. If the answer is that the data subject is no longer identifiable, following a process of removing sufficient identifiers from the data to make re-identification impossible, then the GDPR does not apply to future processing, but it is perhaps arguable that there are some continuing duties towards the data subject that arose when the data subject identifiable in the data (or in the data and reasonably foreseeable connections with other data). Thus, rendering data 'anonymous' or 'pseudonymising' data and the rules relating to that in particular disciplines is not relevant to the GDPR: the question is only about whether the data subject can be identified, within the definitions contained in the GDPR.

We should now turn to the basic structure of the GDPR. There are essentially four key elements: the data protection principles, the routes to lawful processing, the information provisions and the rights of data subjects. Those familiar with the Directive will see the similarities immediately.

A. The Data Protection Principles

Whilst not formally titled as such, there are a number of principles that underpin the GDPR. These are contained in Article 5. Data should be processed fairly, lawfully and transparently (Art. 5.1.a). Transparently is a new addition and must refer to the processing techniques rather than the content - as confidentiality and privacy of information must be maintained.[5] (Routes to) Lawful processing are found in Article 6 (for general personal data) and 9 (for sensitive personal data). The processing must be limited (Art. 5.1.b) to those necessary and compatible with the declared purpose(s). Further processing must not be incompatible. The data collected must be only that which is necessary for the purpose of the processing (Art. 5.1.c), and must be accurate as far as possible and “where necessary” (Art. 5.1.d). There is a presumption that data should be de-identified as soon as possible (relating to the purposes of the processing)(Art. 5.1.e), and data must be stored securely (Art. 5.1.f). In addition to these principles, there is now a presumption in Article 25 of “data protection by design” - that where data will be processed, the controller must build into the enterprise systems that ensure data protection. This is a new concept that will have an impact in research - a protocol must show that data protection has been designed into the research as a ‘bottom-up’ principle.

Most importantly, whereas under the Directive a Data Controller was under an obligation to notify the Supervisory Authority of any processing of personal data, and the Supervisory Authority was under a duty to undertake, where necessary prior checking to ensure compliance, there are major changes. Prior checking, given the amount of work involved compared to the general funding of Supervisory Authorities was not particularly successful under the Directive. The GDPR requires all Controllers undertaking processing that is likely to be of high risk to the data subject’s (data protection) interests must make an ‘impact assessment’ (Article 35) before any processing is undertaken. The Supervisory Authority must make a list of processing that is to be considered as high risk. Article 35 outlines an extensive, systematic evaluation that must be undertaken where an impact assessment is required. Prior consultation with the Supervisory Authority must be undertaken where the controller is not able to provide mitigation for high risk processing. There is a potential weakness here as Article 36.1 does not require an external evaluation of whether mitigation is achieved. Of course, the prudent Controller will ensure that there is either mitigation of risk, or consultation - and the evaluation of a Data Protection Officer may assist in this where such a person is appointed. However, the imprudent Controller may only be found out in the event of a breach, and whether a high sanction will be sufficient to compensate the loss is not always clear.

It will be noted that there are considerable opportunities for Supervisory Authorities to produce local interpretations of the requirements of the GDPR. There are some measures that suggest that the Board will have a role in attempting to achieve the harmonisation desired for the GDPR, but the fact that the Regulation still contains many of the Directive’s discretions rather indicates that there is not harmony between Member States in this area, and differences will persist. Likewise, the GDPR is a ‘general’ Regulation, attempting to cover all processing of personal data. This is, of course, a Herculean, almost fantastical task, because there is such variation between processing sectors as to what constitutes acceptable limits and interpretations of the Regulation. Therefore, it is to be hoped that the opportunity offered for European Commission and EU Data Protection Board approval (under Art. 40), will be taken to create sectoral Codes of Conduct - sectoral interpretations of how to interpret the GDPR in particular circumstances, for example, in life science and genomic research. RECs should be aware that there may well be sectoral Codes that apply to research presented to them.

B. Fair and Lawful Processing.

Under Article 5.1.a, data controllers are given the duty to process data fairly, lawfully and transparently. Lawful processing is to some extent dealt with under Articles 6 and 9 (to some extent, in that if there are other legal conditions acting in relation to the data, then they must also be followed to achieve lawful processing).

Article 6 sets out the conditions for lawful processing of personal data. The first conditions relate to informed consent, either directly given or given through a contract. The second condition is where the processing is in the vital interests of the data subject. The third conditions relate to duties imposed by Law. The fourth route to lawful processing is where the processing is in the interests of data controller and would not be in contrast with the fundamental rights and freedoms of the data subject. The final route is through an appeal to the public interest.

Article 9 prohibits the processing of sensitive personal data (i.e. “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation” - Article 9.1). Thus, medical research often concerns sensitive personal data under this definition. The prohibition can be lifted in certain conditions, found in Article 9. First, where the data subject has consented to the processing (“except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject” – Article 9.2 – which might be considered a highly paternalistic approach to the data subject when compared to other uses of consent in, for example, medical research). Second, the data controller is acting under a legal obligation or right under national employment Law. Third, the vital interests of the data subject require the processing. Fourth, and with “appropriate guarantees”, the processing is necessary for activities of bodies such as political parties or trades unions, etc. Fifth, that the data are already published by the data subject, or are necessary in legal proceedings. Sixth, that the processing is necessary for preventive medicine or occupational medicine. Seventh, the prohibition can be lifted for various medical purposes – diagnosis, treatment, prevention, and the management of health care. Most interestingly is the inclusion of the eighth condition, Article 9.1.j:

“processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.” 

Equally, Member States may create new legislation to allow processing of sensitive personal data in the “substantial public interest”.

Article 9.1.j is a substantial change from the position of research under the Directive. Article 89 reuses that essentially research is undertaken on data that has been pseudonymised, unless that compromises the purpose of the processing. However, this is not the lawful processing for research, as satisfying Article 9 is not sufficient; there must also be a route to lawful processing available under Article 6, and Article 9.1.j is not mirrored in Article 6. In one of the earlier draft Bills, there was, under a then Proposed Article 6.2 a route to lawful processing for general processing simply for research. However, this was removed in the negotiations. Thus, whilst the prohibition on processing sensitive personal data may be lifted for scientific research with an appeal to Article 9.1.j, there must still be a route to lawful processing under Article 6. What a REC must bear in mind is that there are a number of routes to lawful processing and not only informed consent. For example, an appeal could be made to processing the data in the public interest, or for the legitimate interests of the controller without damaging the interests of the data subject. This would require a case to be made, but in principle it must be an available route. We will return to informed consent after the basic shape of the GDPR is outlined.

C. Information Provisions.

In order for the Data Subject to act on his or her rights under the GDOR, he or she must know about the processing. Whereas there is a limited amount of protection afforded to the data subject through the Supervisory Authority, and perhaps through other bodies such as RECs in relation to medical research, in the vast majority of cases, the regime is arguably a 'self-help' regime. Data controllers must observe their duties towards data subjects, but the rights of the data subject (perhaps particularly those relating to his or her specific sensitivities) are very largely left to be enforced by the data subject. Therefore, the data subject must be informed about processing that is to be undertaken on their data, and who is responsible for that processing. This is addressed in Articles 13 and 14 of the GDPR.

There are, essentially, two scenarios addressed in relation to informing the data subject about processing: either the data controller is collecting the data directly from the data subject for foreseeable processing (direct gathering), or the data controller receives the data from a third party (most probably another data controller)(indirect gathering).

There is, of course, a further scenario: a data controller, having gathered or received data for a particular purpose (or set of foreseeable purposes), then sees another unforeseen purpose for which the data could be processed. 'Processing for further purposes' is, unfortunately, not dealt with simply under the Directive, so we will leave it to one side for the time being and return to it for separate consideration (in Discussion Point 2).

The information that must be given to a data subject before his or her data are processed are the contact details of the data controller and a description of the purpose of the processing to be undertaken. When the data are gathered directly from the data subject, the information must be given to the data subject. Where the data are to be processed by a third party, then again, the presumption is that the information must be given to the data subject unless s/he is already in possession of that information, or that it is impossible or would require a disproportionate effort (Article 14.5.b). In cases of impossibility or disproportionate effort the Member State must provide alternative safeguards. 

What is clear is that the data protection regime requires those who gather data directly from data subjects to provide information so that the data subject can protect their own rights. There is no Article 14.5.b equivalent in Article 13 – no ‘impossible or disproportionate effort’ – and this is understandable. If the data subject is there for a direct gathering of data, then the information can be given.

D. Data Subject Rights

The rights of a data subject are largely the same, in respect of research, as those available under the Directive 95/46/EC. As indicated above, the ‘right to be forgotten’, which is largely driven by concerns about the internet, is not available to data subjects where the processing is for research (Article 17.3.d). It is worth noting that research, under the GDPR includes applied research (Recital 159). One question that remains is how the right to withdraw operates in relation to research. It has long been a standard of research that a participant is included in a voluntary way and can withdraw from the research at will. However, there could be another argument, given the potential impact of withdrawal from a study on the scientific impact of the study, and given the difficulty of withdrawing from processing once results of a study have been published.

The GDPR addresses this to some extent. Article 21 - the “right to object” - under the general provision indicates that data subjects have a right to object to processing “unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject” (Article 21.1) However, under Article 21.6 the provision for research is slightly different: 

“Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.” 

It remains to be seen how “on grounds relating to his or her particular situation” will be interpreted and whether there will be a harmonised interpretation in the Member States to this.

A right that may produce difficulties for researchers is Article 20 - “the right to at a portability”. Under this Article,

“The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.”

Two conditions attach - that the route to lawful processing is informed consent, and that the processing of the data is automated. This does not have the administrative cost clause of the Article 15 “right of access”, and much will hang, for research, on the interpretation of  “which he or she has provided to a controller”. There is an on-going question relating to data ownership about how far personal data simply relate to the data subject, being generated through the labour of the data controller. But if one, for example, took the example of genetic information derived from a blood sample, how far does that constitute data ‘provided to a controller’, or is it only the blood sample that is provided? At the other end of the spectrum, when a data subject participates in the highly structured information gathering of, say, a biobank, how far must the biobank provide all that data “in a structured, commonly used and machine-readable format”. At that point, the interests of third parties (protected under Article 20.4) may restrict the amount of data that is available to the data subject through the participation in a biobank. The reasoning for this is considered in the first question below.

3. Questions still unresolved by the GDPR

A. Who is the Data Subject? Dealing with genetic relatives.

There is often a problem in medical research, particularly research using genetic data or biobanks, about individuals who are the genetic relatives of the participant. There has, arguably, been something of a difficulty in knowing how to deal with this 'penumbra' of relatives. The temptation is to think that only the direct research participant is a data subject. And, indeed, it is convenient to think in that way.

At first thought, of we were to treat all the genetic relatives of the potential participant as data subjects, then research would immediately collapse under the weight of informed consent negotiations. However, this pragmatic solution does leave an uncomfortable feeling. Let us consider, for example, the situation of a genetic relatives in a single purpose research project. Arthur presents himself for enrolment having being identified as a potential participant for the study. He gives blood, urine and saliva samples, and a medical history as requested. Arthur has three brothers, his parents are still alive, as is one of his father's brothers who has two daughters. He indicates that his mother had a great-aunt who they know to have emigrated many years ago to Australia, who they know had a son through an affair, but because that branch of the family was quite religious, contact was lost with the great-aunt, and Arthur believes that given her age she must have died some years ago. 

Making Arthur's extended family - the ones that he has named so far - all data subjects has the feel of a crazy, unreasonable suggestion. And yet, each of them has grey similar things to lose - harms to suffer - from a participation in research that Arthur has. Arthur is not a special case because he has been invited to participate in the research; the rights to privacy and data protection that Arthur must be able to enjoy must, arguably, must also be enjoyed by those who are identifiable in the data disclosed by Arthur. We know a great deal about the relatives that Arthur's samples (and history) disclose to the research data controller.

This is, however, not catastrophic when we allow the structure of the GDPR to dictate the answer. Arthur is the data subject from whom an Article 13, Direct gathering operates. All Arthur's relatives are data subjects from whom the data are gathered indirectly.  Therefore, those genetic relatives are within the conditions of Article 14, and must be informed of the data controller's contact details and the purpose of the processing where informing them is reasonable - where it is not impossible or requiring a disproportionate effort. The question becomes one of fact and balance - what are the potential risks to one's fundamental rights and freedoms arising through participation in balance with how much effort would it take to notify the data subject? 'But s/he might not want to participate' cannot be a reason not to notify him or her (but remember that notification is not to gain informed consent under the GDPR.[6]

B. Informed Consent

There was considerable concern in the research community during the passage of the Bill. After an initial draft from the Commission that indicated that there would not be a need form researchers to rely on a narrow, highly specified consent for, for example, biobanking or data intensive research, the provision that allowed research as a route to lawful processing in Article 6 was lost. The approved GDPR text has a compromise, but it is not one that is without difficulties. 

As in the Directive 95/46/EC, informed consent is the first of the routes to lawful processing for general personal data (Article 6.1.a) and for lifting the restriction on processing sensitive personal data (Article 9.2.a). These are not, of themselves problematic texts: 

“the data subject has given consent to the processing of his or her personal data for one or more specific purposes.” (Art. 6.1.a)

“the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject.” (Art. 9.2.a)

Further, the GDPR includes two specific Articles on consent: Article 7 on general issues about consent, and Article 8 on gaining consent from minors. These are more concerned with the procedures for gaining and evidencing consent. The problem arises in the definition of consent contained in Article 4.11 - the definitions Article - where:

“‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;”

This appears to create a requirement that informed consent is “specific”. It may well amount to an attempt at clever legal footwork to suggest that “freely given, specific, informed and unambiguous” are qualifiers to “indication”, and not the substance of the consent itself - that the data subject must be specific in the indication , not specific in the consent itself. These could well be taken to amount to the same thing: to indicate specifically is to specify the parameters of the consent envisaged.

Likewise, it may well be insufficient to argue that specifying “research” in a broad consent way would satisfy the requirements of Article 4.11 on its own. However, a last minute inclusion in the GDPR was Recital 33, which it is worth reproducing in full: 

“It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”

This, it is widely accepted is designed to allow research the opportunity for ‘broad’ informed consent. However, as a Recital, it does not have the same immediate weight as an Article, and must therefore be accepted into the common interpretation of the GDPR, perhaps ideally through a Code of Conduct. What would be disappointing is if this was left to individual Member State Supervisory Authorities to take a view on the relationship between Article 4.11 and Recital 33. Further, RECs must be aware of the interplay between the two elements of the GDPR.

C. Processing for further purposes.

The Data Controller must inform the data subject of all the purposes for which s/he wishes to process the data if he or she collects the data directly from the data subject or, where he or she indirectly collects the data, where it is possible and not requiring a disproportionate effort. Imagine the situation of Anna, professor of oncology at a large university hospital. She gathered data from 150 data subjects about a particular cancer she was studying. The research was completed, and she published papers on her findings. Some time later, two developments happened: Anna herself made a new, and rather surprising connection to a different cancer, and realised that a further processing of her original data set could lead to interesting results; Anna’s funding body require her, as a condition of the grant, to make her data available to other researchers (unidentified) through a ‘data hub’ - which requires a standardisation of the metadata and the linkage of data with other data sets, and therefore (pseudonymised) identifiability of data subjects (to prevent duplication of subjects in the dataset).

There are a number of routes to explore here. The first is, of course, are the two developments covered by the original route to lawful processing and information provisions? There is a chance that the informed consent has been broad enough to cover both developments, and the information about the processing was similarly broad to cover the possibility. However, this may well not be the case. Let us consider the two elements of routes to lawful processing and information provisions separately.

Under the Directive, the route to lawful processing element was very difficult for this sort of secondary processing. The Directive, under its Article 6.1.b was very ambiguous about secondary processing for a compatible purpose, because the drafting could be interpreted as either meaning that compatible processing for the same purpose was acceptable, or processing for compatible purposes was acceptable. The first draft of the GDPR from the Commission sought to clarify this immediately.

Under the Proposed Article 5, it provided that data should be gathered for a specific purpose and not further processing in an incompatible way - the first element; and then under the Proposed Article 6 it made it clear that processing for further purposes was acceptable where the purposes were compatible with the original purpose for the processing, and special provision was made for presuming that research was a compatible purpose. The political negotiations have slightly muddied that initial clarity. The ambiguous wording of the Directive is imported into the GDPR in Article 5.1.b: 

“personal data shall be (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);”

However, Article 6.4 is retained concerning processing for a compatible purpose: 

“Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account” a number of conditions.

This is perhaps not elegant, but it does spell out that the possibility for processing for a purpose compatible with the original purpose is envisaged under the GDPR. It is further underlined in the first paragraph of Recital 50: 

“The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a case, no legal basis separate from that which allowed the collection of the personal data is required. If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations.”

D. Identification, De-identification, and Re-identificationThere is a significant problem in the personal data sharing and data-intensive health, medicine and life science research community. Large data sets, in order to be useful, need to be up-dated regularly, so that the life-experience of the individual data subject can be followed; medical histories and genomic data as a snap-shot are useful, but as an on-going narrative they are so much righter. Therefore, it is necessary to keep the dataset (be it centrally located, or federated[7]) in an identifiable form. This will be in a pseudonymised (coded) form for security, but it will be possible to identify individuals within the set. 

The first problem therefore arises when data is passed from the dataset to researchers. It is highly likely that this will be passed in a de-identified way; the identifiers in the dataset that is passed to the researchers will have been stripped from the data, and individuals will not be identifiable from the aggregated data or the data that is passed. However, because there is a technical possibility that the data could be re-identified by connecting the data back to the original, identifiable dataset, many jurisdictions take this to mean that the data remains personal data (identifiable) throughout its life, and that the researcher with the de-identified set is bound by the conditions of the GDPR. The GDPR is concerned with the reasonableness of the potential for identification. There is a first set of questions to be asked here: is this possibility of re-identification one that should be reasonably considered as a threat to the interests of the data subject such that the GDPR should bind the researcher in this scenario, and what conditions might be sufficient - for example, in the data sharing agreement - that might mitigate that threat (are there, for example, technical safeguards to prevent re-identification that would be sufficient; is an undertaking, with sanctions, against re-identification sufficient)?

The second problem moves from the internal difficulty of imagining the dataset and its key, and the likelihood of re-connecting the key and the de-identified data to the external question of the likelihood of connecting the de-identified data in the hands of the researcher (either deliberately or accidentally) to an external dataset (perhaps already held by the researcher, or falling into her hands from a third party) that then re-identifies the data subject. Indeed, this possibility begins to question whether, in an internet culture with so many different datasets being connected internationally with increased computing power, it is still possible to speak of unbreakable de-idetification; is it impossible to be truly ‘anonymous’ in any circumstances anymore (remembering that identification is not a matter of names and addresses, but any data that, when connected together, identify an individual). So, the second question is, regardless of the possibility of connecting the de-identified dataset to the original identifiable source, what is the likelihood that the de-identified dataset will be connected to sufficient other data to re-identify the data subject? How remote does this possibility have to be to disengage the GDPR?

Of course, at another level both of these questions presume that disengaging the GDPR is a good and desirable thing. In most cases this is not necessarily the case, but there is a case to suggest that there is a difficulty in maintaining the GDPR for data sharing and data-intensive research. If the GDPR is engaged in anonymous data sets, only the information provisions have a ‘disproportionate effort’ or ‘impossibility’ limitation. There must be a route to lawful processing, and the reluctance to ‘change horses’ between routes to lawful processing for processing for secondary purposes is already noted.

So, if the original route to lawful processing was informed consent, and the informed consent was not broad enough to capture the secondary processing, and the wording of that original consent precluded an appeal to compatible processing (which is not uncommon), then is re-consenting the data subject to be able to connect the privacy-protected data the only way forward? This would seem to be at odds with the spirit of Article 89, and Recitals 33 and 50, for example, which seek to enable data sharing and data-intensive research for health, medicine and life science research.

REC members may well take a view that this is not a matter for RECs and that they should depend on the EU Data Protection Supervisor and Board for guidance. To some extent, of course, this is correct; those bodies, and the Court of Justice of the European Union, have the authority to pronounce definitively on the interpretation of the GDPR. However, RECs see the practical setting of these dilemmas for research, and so they can voice an opinion to contribute to the empowered authorities’ deliberations. Further, and most importantly, personal data privacy and confidentiality are not only legal matters, they pose ‘ethics’ questions also, and there the REC has responsibilities. Does, for example, ethics demand specific informed consent where the GDPR might countenance the public interest? We would suggest that answer is ‘no’, indeed, ethics may take a more solidarity-based view - that the desire for medical research and therapies in an increasingly individual-focused society requires that research be allowed to take place in the public interest. It could be that the ethics debate forces the legal, data protection debate to reconsider some of its more extreme autonomy-based (and solidarity-rejecting) interpretations of confidentiality and privacy. But that is for debate.

Questions for Discussions

Is this a reasonable approach to the problem of genetic relatives? 

How far will informed consent present a problem to new data intensive research methodologies and data sharing? 

How does your REC deal with requests for processing for further purposes that were not foreseen at the initial gathering of the data?

How far, and in what circumstances would your REC allow processing of data where informed consent was not gained, but where, for example, an appeal to the substantial public interest was made?

Further Reading:

Data Protection Directive 95/46/EC http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:e...

European Commission. Horizon 2020 Online Manual. https://ec.europa.eu/research/participants/docs/h2020-funding-guide/cross-cutting-issues/ethics_en.htm

European Commission (2019) Horizon 2020 Programme. How to complete your ethics self-assessment-material guidance. Human beings, page 6. European Commission. Directorate-General for Research & Innovation.

European Commission (2019) Horizon 2020 Programme. How to complete your ethics self-assessment-material guidance. Personal data, page 16. European Commission. Directorate-General for Research & Innovation.

European Commission (2019) Horizon 2020 Programme. How to complete your ethics self-assessment-material guidance. Non-EU countries, page 25. European Commission. Directorate-General for Research & Innovation.

General Data Protection Regulation 2016/679 http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32016R0679

OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980) http://www.oecd.org/internet/ieconomy/oecdguidelinesontheprotectionofpri...

OECD The OECD Privacy Framework (2013) https://www.oecd.org/sti/ieconomy/oecd_privacy_framework.pdf