European Health Research Evades A Data-Privacy Nightmare

The new European rules on data protection have won more coverage for banning under-16s from Facebook than for their influence on medical research. But the compromise text provisionally agreed this week by politicians, diplomats and officials has sent a huge sigh of relief across the health community in Europe, which was living under fear of something like a wipe-out of access to medical records. 

For more than two years the drug industry, academics and medical societies have been lobbying the European Union's institutions with warnings that going too far to protect personal privacy could create real problems for health.

As recently as last month the leading European drug industry association, EFPIA, was still expressing concerns that the proposed legislation carried threats for processing personal data concerning health and scientific research, and could "impede important biomedical research."

Many of the concerns hung upon the stringent requirements for consent–and on legislators' failure to recognize that in exceptional cases, obtaining advance consent to data processing for research purposes is not reasonably feasible – such as in research on treatments and diagnostics used in emergency medical settings, or the process by which a treating physician identifies prospective clinical trial participants through review of existing medical records, in order to invite them to participate. There were also anxieties that a lack of clarity could make clinical research extremely difficult.

Discussions were difficult, because the main purpose of the legislation was, from the outset, safeguarding personal privacy. Hot-button issues like data leaks from big corporations, the revelations of Edward Snowden about surveillance, and growing public concern over commercial exploitation of personal data by social media sites, reinforced the missionary approach of privacy advocates, facing health researchers with an uphill battle to make their voices heard.

But after lengthy negotiations between the European Commission – which proposed the measure back in 2012, the European Council of Ministers representing the 28 member states of the EU, and the European Parliament, which had repeatedly tried to toughen up the text, a deal was struck on the night of December 15, incorporating many of the provisions that the research community had been seeking, and on December 17 the key committee in the European Parliament endorsed it.

At the last minute, many of the most problematic provisions for health research were eased by amendments that provided exemptions from the overall constraints. For instance, the text now recognizes that 'the processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject.' Similarly, retention of the data is to considered lawful where it is necessary for public health or scientific research purposes.

EFPIA immediately welcomed the agreement as "a balanced approach on the rules regarding the use of data for research purposes." The compromise should preserve patient's confidentiality "while allowing innovation in healthcare products and services for the benefit of patients in Europe."

The European Alliance for Personalized Medicine was positively jubilant, claiming the credit for many of the modifications favorable to research. It welcomed 'the inclusion of many suggestions and recommendations it has made during the process.'

With a rhetorical flourish reflecting how relieved the research community feels, it said: 'The Alliance believes that this will have a positive impact on the health of 500 million potential patients across 28 Member States as well as that of their children, grandchildren and all the generations that will follow.'

Formal votes will take place in the Parliament and the Council early next year once the text has been translated and checked. The regulation will be applicable two years after its entry into force.