sou · H6B336 · 2018-06-05 00:00:00 — Enligt vad vi har inhämtat har registret inte underhållits . Vi bedömer att det inte finns något långsiktigt behov av en särskild reglering av ett rättspsykiatriskt forskningsregister och föreslår därför att registerlagen ska upphävas. Vårt uppdrag har varit att göra en vidare beredning av det förslag till ett centralt register för spårbarhet till vävnadsprover i landets bio- banker som Registerforskningsutredningen7 lämnade. föreslog att Svenska biobanks- registret skulle göras om till ett nationellt system för registrering av biobanksprover () med som huvudman och personuppgiftsansvarig. Utredningen om reglering av biobanker8 har parallellt med vår utredning haft i uppgift att utreda vissa aspekter av ett nationellt register för spårbarhet av vävnadsprover. Denna utredning föreslog att ett nationellt biobanksregister ska inrättas för forskningens behov, som det ska finnas kvar. Det senare registret ska tillgodose hälso- och sjukvårdens behov av spårbarhet av prover som tagits i samband med vård och behandling. Uppgifterna ska göras tillgängliga för vårdgivare och nås genom direktåtkomst i system för sammanhållen journalföring enligt 6 kap. patientdatalagen (2008:355).9 föreslås vara huvudman och personuppgiftsansvarig för ett nationellt biobanksregister över prover tagna för forskningsändamål. 6Ett nytt författningsstöd för behandling av personuppgifter, m.m. (Ju 2013/08833/Å). 7Registerforskningsutredningens slutbetänkande Unik kunskap genom registerforskning (SOU 2014:45). 8Utredningens om regleringen av biobanker slutbetänkande Framtidens biobanker (SOU 2018:4). 9Med ”direktåtkomst” avses här samma begrepp som i 6 kap. patientdatalagen. Vi ansluter oss i huvudsak till Utredningens om regleringen av biobanker förslag om ett nationellt register för spårbarhet av prover i biobanker, som ska få användas för forskning, kvalitetssäkring och framställning av statistik. Utredningen om regleringen av biobanker gjorde bedömningen att uppgifterna i det kommer att omfattas av statistiksekretess. För att tillförsäkra uppgifterna i registret ett god- tagbart skydd föreslår vi i stället en särskild sekretessbestämmelse som avser uppgifter om enskild i ett nationellt biobanksregister. Sekretessen ska gälla såvida det inte står klart att uppgiften kan röjas utan att den enskilde eller någon närstående till denne lider men (omvänt skaderekvisit). Sekretess kommer alltså att vara huvudregeln för dessa uppgifter. Det är samma nivå på sekretesskyddet som gäller för dessa uppgifter när de hanteras i hälso- och sjukvården. Vi har i uppdrag att analysera vilken rättslig reglering som behövs för att () ska ha möjlighet att lämna ut uppgifter om individers inkomstförhållanden ur sina register till europeiska databasen () samt att lämna nödvändiga författningsförslag. Det är dock inte enbart som är av intresse för vårt uppdrag att möjliggöra behandling av personuppgifter i forskningsdatabaser. Inom EU finns fler exempel på forskningssamarbeten där deltar tillsammans med andra länder. Vi föreslår en sekretessbrytande bestämmelse som inte enbart ska vara tillämplig på , utan på alla forskningsdatabaser som drivs av forskningshuvudmän som omfattas av dataskyddsförordningen. Under vissa förutsättningar ska en uppgift för vilken sekretess gäller få röjas för en forskningshuvudman utanför , som omfattas av dataskyddsförordningen. Om uppgiften i motsvarande fall skulle få lämnas ut till en svensk forskningsdatabas, och om forskningshuvud- mannen omfattas av motsvarande skyddsregler som gäller enligt offentlighets- och sekretesslagen samt lagen om forskningsdatabaser, får utlämnande myndighet pröva om uppgifterna kan lämnas ut. Vi anser att en sådan bestämmelse möjliggör önskvärda forsk- ningssamarbeten inom EU och innefattar ett gott skydd för den Skyddet av uppgifterna måste uppfylla de krav på säkerhet vid behandling av personuppgifter som ställs i dataskydds- förordningen. Under dessa förutsättningar kan även syftet med förordningen uppfyllas, nämligen att skydda fysiska personer med avseende på behandling av personuppgifter som det fria flödet av uppgifter inom unionen inte begränsas. Det kommer inte att vara en helt lätt uppgift för en svensk myndighet att avgöra om en forskningsdatabas inom EU uppfyller de villkor som krävs för att uppgifterna ska få röjas. Myndigheterna kommer att behöva information om hur den mottagande forsknings- databasen behandlar personuppgifter och om vilka skyddsregler som tillämpas. Vi finner att det är lämpligt att en myndighet, t.ex. Veten- skapsrådet, får i uppdrag av regeringen att bistå myndigheterna med sådan information. Den myndighet som får detta uppdrag bör sam- råda med Datainspektionen. Behandling av uppgifter om avlidna i forskning Vi har undersökt vilket skydd för uppgifter om avlidna i forskningens som det finns och om det finns något behov av att öka det. Vi bedömer att befintlig lagstiftning tillsammans med vårt förslag om forskningssekretess och tystnadsplikt utgör ett tillräckligt skydd för uppgifter om avlidna. Vid denna bedömning har vi även beaktat att skyddet för efterlevande indirekt skyddar även den avlidne. Vi anser att det inte ska införas något ytterligare skydd för uppgifter om avlidna. If our society is to develop and if we are to be able to solve various problems, we need research. We need research and research organisations in various disciplinary areas that produce results that can be used for our common good. has a world-leading position in terms of statistics about living conditions and health. Our individual-based registers provide good possibilities of successful research based on them. This means our country is also attractive for researchers in other countries. effective use of existing registers and databases is needed to be able to benefit fully from our unique situation. The Government stated in our terms of reference1 that better conditions are needed for register-based research and tasked us with proposing long-term regulation of research databases. In addition to this remit, we have also had, in this part of the inquiry, the remit of analysing: •whether there is a long-term need for special regulation of a forensic psychiatry research register; •what regulation is needed of a national biobank register; •what legal regulation is needed to enable Statistics (SCB) to release information about the income situation of individuals to the Income Study (); •whether stronger protection is needed for data about deceased persons in forensic research; and 1Processing of personal data for research purposes, terms of reference 2016:65. •what legal possibilities the EU’s Protection Regulation2 provides for the processing of personal data by the National Library of and other research libraries. The final part of our remit was reported to the in a memorandum in autumn (annex 5). In our interim report Processing of personal data for research purposes3 we analysed what regulation of the processing of personal data for research purposes is possible and may be required on account of that the Data Protection Regulation will be applicable as from 25 2018. In connection with that work we defined a need to pass a research data act with the purpose of enabling the processing of personal data for research purposes while protecting the rights and freedoms of the individual. In our interim report we therefore proposed a research data act that would be applicable to all processing of personal data for research purposes irrespective of the legal basis. We also reached the conclusion that an examination under the Act (2003:460) concerning the Involving Humans (the Act) constitutes such a suitable and specific safeguard that is required for personal data processing for research purposes of sensitive personal data or personal data concer- ning criminal offences, etc. to be permitted. In addition, we found that there is reason to further investigate the need for changes to the ethical review procedure. In our view, the full ethical review should be limited to processing of personal data that formally requires extensive protection of that kind. Current ethical review requirements also cover processing of personal data that can generally be regarded as less of a risk for the individual, but that still requires a suitable safeguard. Against this background it is not reasonable and proportionate to apply the same ethical review proce- dure to all kinds of processing of personal data covered by the Ethical 2Regulation of Parliament and the Council of on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Protection Regulation), called the Data Protection Regulation in the following. 3Interim report of the Inquiry, Personuppgiftsbehandling för forsknings- ändamål (Processing of personal data for research purposes) (SOU 2017: 50). If the procedure cannot be geared to the need for protection, this also risks eroding confidence in ethical review as a safe- guard. In the light of the restrictions on our mandate and the rest of the framework for our work, we proposed that a differentiated ethical review procedure should be investigated further in a separate form. A research database is a collection of personal data that has been collected from individuals or from other sources and which is a national resource that supplies data for several different research projects. The time during which a research database is in existence in the activities of a research organisation – the lifecycle of the database – can be divided into different stages. Some activities in the research database run continuously, while others have a stronger link to a certain period. The lifecycle perspective can be used to analyse what activities need to be regulated in order to achieve secure processing of personal data in the database. We describe the lifecycle of a research database in the following five stages: 1.Creation of a research database 2.Collection of personal data 3.Administration of the research database 4.Use of the research database 5.Closure of the research database In our assessment, regulation that only covers a few fields of research, identified centrally, and a small number of research organisations would not be sufficient to provide for safe handling of personal data in research databases. We therefore propose general regulation covering as many databases as possible. In practice there are also already a large quantity of different kinds of research databases in several different types of research organisations. We conclude that the principle of the freedom of research means that the initiative to create a research database should come from research organisations and not from the Government. In our view, the needs for collections of data can best be identified and formulated in research activities. Our proposal for long-term regulation therefore assumes that it is research organisations that will assess what research databases are needed. According to our remit, the regulation we propose also has to include good protection for personal privacy – in addition to meeting the needs of research. In our view, there is good protection of privacy when this right is in balance with other fundamental rights and legitimate public interests. We therefore propose suitable and secure regulation of research databases that both meets the needs of research and includes good protection of personal privacy. Long-term regulation of research databases We propose regulating the processing of personal data in a research database in a separate act, the act on research databases. This act regulates what research organisations will be allowed to be responsible for research databases and what safeguards are required for a research database to be compliant with the law. Under our proposal, both state higher education institutions and universities and the private higher education institutions that are covered by the principle of public access to information and have a right to award qualifications will be allowed to process personal data in research databases. Public authorities other than those that conduct education will be allowed to be responsible for research databases if their mission includes research. This applies to both central and local government authorities. One fundamental safeguard that we propose is that a research database must be approved under the Act. In this process, the scientific value of the research database must be assessed and weighed in relation to its potential risks with respect to the health, security and privacy of the included research subjects. In addition, we propose that all research that will use data in a research database will have to have ethical approval. We propose amendments to the Act that make these safeguards possible. Another important safeguard that we propose is a new provision on research secrecy in the Public Access to Information and Secrecy Act (2009:400) and a corresponding provision on an obligation to observe professional secrecy at private research organisations in the research databases act. The data in a research database as well as the research projects that use these data will therefore be covered by either research secrecy or an obligation to observe secrecy. In addition, the research databases act makes requirements concerning organisational safeguards. Such requirements also follow directly from the Data Protection Regulation. We specify them in more detail by requiring principal research organisations to have a head of operations with operational responsibility for a research database. There also has to be an organisational unit that is responsible for the security and privacy protection in the research database. In addition, the activities of the principal research organisation have to include risk-based information security work. The research databases act contains requirements concerning technical safeguards. The research organisation has to determine conditions for the allocation of authorisation for electronic access to personal data in a research database. The research organisation also has to check that access is used in the right way. The processing of personal data in a research database will come under the supervision of the Protection Authority in the same way as other processing of personal data. In addition to a research database being subject to supervision, we propose giving the the task of monitoring databases created under the new act. We consider that legislators must be kept informed about the effect of the act on the handling of personal data in research databases. Moreover, we propose giving the the task of initiating and supporting work to draft a code of conduct for the processing of personal data in research databases. A further important safeguard we propose is to give research subjects the possibility of insight into how their own data are handled in the research database. A research organisation will be able to grant the individual direct access to their own directly identifiable data. Taken together, the proposals we present will make up a package of safeguards for personal privacy. In addition to the requirements that apply under the regulation of data protection4, personal data in a research database will be protected by, for example: 4The Data Protection Regulation and the Data Protection Act proposed by the Government in Govt dataskyddslag (Protection Act), Govt 2017/18:105. •limitation of which research organisations are allowed to be responsible for a research database; •the research organisation’s responsibility for personal data; •conditions for the creation of a research database; •requirement of ethical review of the research database; •requirement of ethical review of the research projects that are to use the personal data; •secrecy and obligation to observe secrecy; •codes of conduct; •requirements concerning financing of the research database; and Forensic psychiatry research register In certain cases special laws already make research databases possible. One such law is the Act on Register (1999:353) (called the Register Act below). is the controller of personal data for the forensic psychiatry research register. The register may be used for two purposes: first, processing of personal data for research in forensic psychiatry, if the research and processing has been approved under the Act and, second, for monitoring, evaluation and quality in forensic psychiatry by the Board. In a report5 to the Government the Board has pointed out that the Register Act does not provide adequate support for research in forensic psychiatry. This is because current issues in forensic 5New statutory support for ’s personal data etc. (Ju 2013/08833/Å). psychiatry cannot be resolved with the aid of the limited information that is allowed to be registered in the register. According to information we have obtained the register has not been maintained since 2005. Our assessment is that there is no long-term need for special regulation of a forensic psychiatry research register and we therefore propose the repeal of the Register Act. A national biobank register Our remit has been to continue the preparation of the proposal for a central register for traceability of tissue samples in ’s biobanks presented by the Research Inquiry6. The Research Inquiry proposed converting the Swedish Biobank Register into a national system for registration of biobank samples (the National Biobank Register) with as the body responsible and controller of personal data. In parallel with this Inquiry, the Inquiry on the Regulation of Biobanks7 has been tasked with investigating certain aspects of a national register for traceability of tissue samples. That Inquiry proposed establishing a national biobank register for research needs, while retaining the Swedish Biobank Register. That register would meet healthcare needs of traceability of samples taken in connection with care and treatment. The data would be made available to healthcare providers and be reached by direct access in systems for integrated records under Chapter 6 of the Act (2008:355).8 is proposed as the body responsible for, and controller of personal data of, a national biobank register of samples taken for research purposes. We mainly concur with the proposals of the Inquiry on the Regulation of Biobanks for a national register for traceability of samples in biobanks to be used for research, quality and the production of statistics. 6Final report of the Research Inquiry, Unik kunskap genom registerforskning (Unique knowledge through register-based research) (SOU 2014:45). 7Final report of the Inquiry on the Regulation of Biobanks, Framtidens biobanker (Biobanks of the future) (SOU 2018:4). 8Here “direct access” means the same term as in Chapter 6 of the Act. The Inquiry on the Regulation of Biobanks made the assessment that the data in the national biobank register will be covered by statistics secrecy. To guarantee acceptable protection for the data in the register, we instead propose a special secrecy provision referring to data about an individual in a national biobank register. This secrecy would apply unless it is clear that the data can be disclosed without damage to the individual or someone close to them (reverse requirement of damage). So secrecy will be the general rule for these data. This is the same secrecy protection as applies to these data when they are handled in healthcare. Research databases in Europe We have the remit of analysing what legal regulation is needed to enable Statistics (SCB) to release information on the income situation of individuals from its registers to database called the Income Study () and to present the necessary legislative proposals. However, it is not only the that is of interest for our remit of making it possible to process personal data in research databases. In the EU there are several examples of research cooperation in which is participating along with other countries. We propose a secrecy override applicable not only to the but also to all research databases operated by research organisations covered by the Data Protection Regulation. This override would mean that, under certain conditions, data that is subject to secrecy may be disclosed to a research organisation outside that is covered by the Data Protection Regulation. If it would be possible to release the data to Swedish research database in corresponding cases, and if the research organisation is subject to secrecy rules corresponding to those that apply under the Public Access to Information and Secrecy Act and the research databases act, the releasing authority may examine whether the data can be released. We consider that such a provision enables desirable research cooperation in the EU and includes good protection for personal privacy. The protection for the data would have to meet the requirements concerning security in the processing of personal data set in the Data Protection Regulation. Under these conditions the purpose of the Regulation can also be met: i.e. protection of natural persons with regard to the processing of personal data at the same time as the free movement of data in the Union is not restricted. It will be a demanding task for a Swedish authority to determine whether a research database in the EU meets the conditions set for the disclosure of the data. Authorities will need information about how the receiving research database processes personal data and what safeguards are applied. The Inquiry finds that it is appropriate for a government agency, for example the , to be commissioned by the Government to assist authorities with infor- mation of that kind. The agency that is given this commission should consult with the Protection Authority. Processing of data about deceased persons in research We have examined the current protection of data about deceased persons in research and whether there is a need to increase it. Our assessment is that the existing legislation along with our proposal for research secrecy and an obligation to observe secrecy provides sufficient protection for data about deceased persons. In making this assessment we have also taken account of the fact that the protection for survivors also protects the deceased person indirectly. We consider that no further protection should be introduced for data about deceased persons. 1.1Förslag till lag om forskningsdatabaser 1 § Denna lag innehåller bestämmelser om behandling av person- uppgifter i en forskningsdatabas. I 4 kap. 5 § finns en bestämmelse om tystnadsplikt hos enskilda (privata) forskningshuvudmän. 2 § Syftet med denna lag är att möjliggöra behandling av person- uppgifter i en forskningsdatabas. Syftet är också att säkerställa att de registrerades personliga integritet skyddas vid denna behandling. Förhållandet till annan lagstiftning 3 § Denna lag kompletterar och rådets för- ordning (EU) 2016/679 av om skydd för fysiska personer med avseende på behandling av personuppgifter och om det fria flödet av sådana uppgifter och om upphävande av direk- tiv 95/46/EG (allmän dataskyddsförordning), nedan kallad data- skyddsförordningen. 4 § Vid behandling av personuppgifter enligt denna lag gäller lagen (2018:218) med kompletterande bestämmelser till EU:s dataskydds- förordning och föreskrifter som har meddelats i anslutning till den lagen, om inte annat följer av denna lag eller föreskrifter som har meddelats i anslutning till lagen. Om det i en annan lag eller i en förordning finns bestämmelser om behandling av personuppgifter i en forskningsdatabas som avvi- ker från denna lag ska de bestämmelserna gälla. 5 § Med forskningshuvudman avses i denna lag detsamma som i 2 § lagen (2003:460) om etikprövning av forskning som avser män- niskor.