Balancing Data Use and Data Privacy in Europe

Ever since the European Union began its review of its data protection laws nearly a decade ago, the world of pharmaceutical research became increasingly perturbed at the prospect of stringent new controls on data collection, analysis, and transfer. The concerns were well-founded, since the new legislation was driven from the outset by concerns over privacy intrusion by social media giants or conspiracies between search engines and online retailers. It was feared that a sledgehammer approach to Amazon, Google, or Facebook might inadvertently smash to a pulp the more delicate exchanges of data among scientists.

Now that the legislation has come into force, some more detailed appraisal is possible of how the work of researchers is being affected. A practical report on current reuse of health data by the European pharmaceutical industry has just been compiled for the European Federation of Pharmaceutical Industries and Associations by Rand Europe, which finds that electronic health records, health registry data and clinical trial data are reused most frequently, with lesser reliance on biobank data, prescribing and dispensing data, and claims data. More recently, social media data and data from wearable devices have also been used. These uses (or re-uses) provide, concludes the report, valuable insights into the real world that increase efficiency and reduce costs for both industry and health systems. 

But it is along the R&D pathway that the data finds most use, the report suggests. At the discovery and drug development stage, it serves to identify and better understand diseases, to develop targeted and personalized therapies and drugs, and to develop new analytical methods. At the clinical research stage it is informing clinical trial design, creating new approaches to patient stratification and feasibility studies, and helping to reduce the number of patients needed to enroll as controls.

Subsequently it plays a major role in marketing authorization and regulatory supervision, supports market access discussions, and makes possible the conduct of cost-effectiveness analyses. And at the post-authorization stage it supports pharmacovigilance and pharmacoepidemiology, enhances the medical evidence base, and informs practice guidelines and drug repurposing. It also plays a crucial role in effectiveness comparison between drugs.

The barriers the Rand report finds are as much technical as legal. Data is often of poor quality, with restricted-access, or biased-or simply non-interoperable. There is a lack of effective skills and experience, and also a lack of public and healthcare provider trust in the pharmaceutical industry. Alongside these are the many challenging administrative factors and a lack of clear and uniform regulations.

The report’s recommendations also focus more on technicalities than the legislative context. As the field of health data grows, continued research and development is needed on analytical tools and techniques, it says-highlight the need to link different datasets. It urges closer collaboration between the pharmaceutical industry and other key stakeholders (such as regulators and healthcare system actors) to improve accessibility to health data, promoting standards, and interoperability across datasets. There is also a need for improving data and analytical skills within the pharmaceutical industry.

But the sting in the tail is that the report also finds there is a need for clearer and more uniform regulations (including for data protection), and guidelines related to secondary data analysis. The attachment to privacy is also evident in the approach being taken by European lawmakers. The European Parliament’s health committee gave its support in mid-November to European Commission plans for digital transformation of health, but insisted that patient interests, particularly over data privacy, should be given high priority in implementing changes. A draft resolution won majority support from committee members after its proponents had expressed their concerns that patients should be the focus, and that adequate measures would be necessary to guarantee them data protection.

This is in line with the caution expressed by policymakers as they drafted the European Union approach to digital health. They already underlined the customary concerns over data handling and protection, with some sharp criticism about undue commercial exploitation.  European and national authorities must take seriously the issues of how data is produced, stored, analyzed and used, they said. "Without sufficient attention for this issue, data may be gathered and used in ways that are unlawful and undesirable," it warns. "This may for instance lead to problems with privacy, but also to unbeneficial commercial use of information (direct or indirect)."

It is these deeply-held reservations that continue to make pharmaceutical researchers nervous. And their views are shared by prominent regulators too. The risks were set out in trenchant tones by Guido Rasi, the executive director of the European Medicines Agency, earlier this year. Despite the "incredible opportunities" that new science offers for medicine, exploiting that potential is being held back by European Union legislation on data privacy, he told a meeting in the European Parliament. He admitted to "deep concern" over limits imposed on secondary use of data by the EU's General Data Protection Regulation.

The balance is being sought in Europe data governance between private protection and public benefit-but the balance has not yet been achieved.