Are Requirements to Deposit Data in Research Repositories Compatible With the European Union's General Data Protection Regulation?

To reproduce study findings and facilitate new discoveries, many funding bodies, publishers, and professional communities are encouragingand increasingly requiringinvestigators to deposit their data, including individual-level health information, in research repositories. For example, in some cases the National Institutes of Health (NIH) and editors of some Springer Nature journals require investigators to deposit individual-level health data via a publicly accessible repository (1, 2). However, this requirement may conflict with the core privacy principles of European Union (EU) General Data Protection Regulation 2016/679 (GDPR), which focuses on the rights of individuals as well as researchers' obligations regarding transparency and accountability. The GDPR establishes legally binding rules for processing personal data in the EU, as well as outside the EU in some cases. Researchers in the EU, and often their global collaborators, must comply with the regulation. Health and genetic data are considered special categories of personal data and are subject to relatively stringent rules for processing. According to the GDPR, personal data may be collected only for specific, explicit, and legitimate purposes. The GDPR considers further use of these data for scientific research purposes to be compatible with the original rationale for collection. Yet, it also recognizes the right of study participants to object to this use of their data, to withdraw consent if they wish, and to be informed of any data breaches. To exercise their rights, individuals must be informed about the processing of their data in the research repository. However, the way some repositories are set up might make it difficult for researchers to comply with the law. One such challenge centers on the oversight of data access. Controlled-access research repositories rely on data access committees to evaluate requests for permission to use data. As such, institutions that recruit volunteers for research might lose direct control of data sharing and thus cannot advise the participants who take part in their studies. Therefore, study participants may lose their opportunity to withdraw their data or to object to its processing. Data access committees should ensure consistency with the original consent; however, consent forms often are written in another language, reflect another cultural context, or are based on a different ethos, introducing the potential for errors. Current governance mechanisms may be inadequate to protect participants' wishes and rights. The GDPR also requires research institutions to take adequate technical and organizational measures to safeguard privacy. These requirements cannot be fulfilled by the research institutions because once the data are deposited, the repository takes control over safeguards. Another challenge lies in the GDPR's requirement for data processing to be adequate, relevant, and limited to what is necessary to fulfill a study's objectives. These conditions do not allow long-term retention of data for unspecified uses. At present, research repositories do not have mechanisms in place to regularly evaluate whether data are still necessary or to delete any that are not. Furthermore, destroying data archived in a research repository may seem counterintuitive, because it eliminates resources that may be useful in the future and is antithetical to one of the main reasons for a repository's existence: to increase research efficiency by providing previously collected data to inform new questions. Finally, the cross-border nature of research repositories may subject them to the laws, courts, and administrative bodies of multiple jurisdictions simultaneously. Obeying the law of one country may result in breaking the law of another. Recent court cases, particularly those related to law enforcement's access to personal data stored on servers abroad, illustrate the legal complexities and lack of foreseeability inherent in third-party requests for data (3). As shown in the following examples, compelling researchers to follow data deposition requirements that conflict with the law puts them in an unsustainable position that may jeopardize international collaboration and scientific excellence, prerequisites for evidence-based medicine. Data that once were considered anonymous, and therefore outside the scope of privacy regulations, are now often deemed personal and subject to the GDPR. For example, participants in a substudy of HUNT (the Nord-Trndelag Health Study) underwent whole-genome sequencing, which was partly financed by the NIH. Genetic data and some phenotypic variables were to be deposited in the Database of Genotypes and Phenotypes (dbGaP). In 2011, a Norwegian ethics committee deemed whole-genome sequencing data to be genuinely anonymous and the risk for reidentification from data in dbGaP only theoretical. Hence, the opt-out consent form stated that the genetic information is stored anonymously, i.e. without identifying information (4). Under the GDPR, however, genomic data are now generally considered identifiable in the EU, so their deposition by any EU researcher is subject to this regulation. Therefore, a question arises as to whether past consents to deposit genomic data are still legally valid. The GDPR also allows each EU member state to maintain or introduce additional conditions for processing health and genetic data. For instance, depositing individual genomic data is illegal in some countries. The Italian population study SardiNIA/ProgeNIA (National Institute on Aging), partly funded by the NIH, collected extensive phenotypes and detailed genetic data based on genotyping with high-density arrays coupled with low-pass whole-genome sequencing from 4 geographically clustered villages in Sardinia (5). About 10 years ago, the scientific community was uncertain as to how to interpret the Italian legislation, and the Sardinia project complied with the NIH requirement to deposit a set of sequencing and phenotypic data in dbGaP. However, under the current Italian rules, deposition of individual-level genetic data is prohibited because sharing of such data involves a risk that participants and their present and future relatives might be identified by nonauthorized parties (6). Researchers in Italy, therefore, may find it difficult to obtain funding and to publish their work, regardless of its scientific value. In conclusion, data deposition requirements and research repositories will have to adapt to the legal and ethical landscape of the GDPR. Noncompliance with the GDPR may incur administrative fines of up to 20 million, and the regulation is enforced by data protection authorities in each EU nation. Data deposition requirements also should account for the variation in national laws through waivers and recognition of equivalent access policies across borders. Additional solutions that support the data sharing endeavor include technologic tools, such as data tagging, which identifies authorized uses of data, and federated sharing environments in which research queries can be run remotely without data being physically transferred (7, 8). Furthermore, online dynamic consent strategies might help by enabling research participants to manage their data-sharing and other options over time (9). Developing solutions that support data deposition while ensuring legal compliance is necessary for research. Adopting the right solutions will lead to greater transparency and accountability in data sharing, as well as a more efficient and equitable scientific practice.