# International transfers of personal data for health research following Schrems II: a problem in need of a solution

Dara Hallinan, Alexander Bernier, Anne Cambon-Thomsen, Francis Crawley, Diana Dimitrova, Claudia Bauzer Medeiros, Gustav Nilsonne, Simon Parker, Brian Pickering, Stéphanie Rennes

► To cite this version:

Dara Hallinan, Alexander Bernier, Anne Cambon-Thomsen, Francis Crawley, Diana Dimitrova, et al. International transfers of personal data for health research following Schrems II: a problem in need of a solution. European Journal of Human Genetics, 2021, 29 (10), pp.1502-1509. 10.1038/s41431-021-00893-y. hal-03575582

HAL Id: hal-03575582

https://hal.science/hal-03575582

Submitted on 4 Dec 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# International transfers of personal data for health research following Schrems II: a problem in need of a solution

Dara Hallinan<fnref n="1" /> · Alexander Bernier<fnref n="2" /> · Anne Cambon-Thomsen<fnref n="3" /> · Francis P. Crawley<fnref n="4" /> · Diana Dimitrova<fnref n="5" /> · Claudia Bauzer Medeiros<fnref n="6" /> · Gustav Nilsonne<fnref n="7" />,<fnref n="8" /> · Simon Parker<fnref n="9" />,<fnref n="10" /> · Brian Pickering<fnref n="11" /> · Stéphanie Rennes<fnref n="12" />,<fnref n="13" />

Received: 13 October 2020 / Revised: 31 March 2021 / Accepted: 6 April 2021 / Published online: 6 May 2021
© The Author(s) 2021. This article is published with open access

## Abstract

On 16 July 2020, the Court of Justice of the European Union issued their decision in the *Schrems II* case concerning Facebook’s transfers of personal data from the EU to the US. The decision may have significant effects on the legitimate transfer of personal data for health research purposes from the EU. This article aims: (i) to outline the consequences of the *Schrems II* decision for the sharing of personal data for health research between the EU and third countries, particularly in the context of the COVID-19 pandemic; and, (ii) to consider certain options available to address the consequences of the decision and to facilitate international data exchange for health research moving forward.

## Introduction

This paper considers the effects of the Court of Justice of the European Union’s (CJEU) *Schrems II* decision—on Facebook’s transfers of personal data (PD) from the EU to the US—on the international exchange of PD for health research, specifically in the context of the COVID-19 pandemic.

Processing data for health research often involves processing PD. To facilitate the exchange of PD across borders, states and supranational organisations have elaborated laws governing the conditions of exchange. The law elaborating the conditions governing such transfers from the EU is the general data protection regulation (GDPR) [1].

This law provides various justifications for the transfer of PD outside the EU. In practice, the law has generally functioned as a framework to transfer PD outside the EU for health research purposes—albeit with certain exceptions [2]. On 16 July 2020, the CJEU—the EU’s highest court—issued its decision in the *Schrems II* case concerning the law on transfers of PD from the EU to third countries [3].

In its decision, the court made several statements whose impact on international transfers of PD for health research purposes are likely to be significant—with the concept of ‘international transfers of PD for health research purposes’, we include all transfers, of all forms of PD, undertaken for the purpose of health research and exclude any transfers undertaken for other purposes.

In this article, we aim: (i) to outline the consequences of the case for the legitimate international exchange of PD for

<footnote>Dara Hallinan
dara.hallinan@fiz-karlsruhe.de</footnote>

<footnote n="1">1 FIZ Karlsruhe—Leibniz-Institut für Informationsinfrastruktur, Hermann-von-Helmholtz-Platz 1, Eggenstein-Leopoldshafen, Germany</footnote>

<footnote n="2">2 McGill University Faculty of Medicine, Centre of Genomics and Policy, Montreal, Canada</footnote>

<footnote n="3">3 CNRS, Center for Epidemiology and Research in POPulation health (CERPOP), Université de Toulouse, Inserm, UPS, Joint Unit 1295, Toulouse, France</footnote>

<footnote n="4">4 Good Clinical Practice Alliance—Europe (GCPA) and Strategic Initiative for Developing Capacity in Ethical Review (SIDCER), Leuven, Belgium</footnote>

<footnote n="5">5 FIZ Karlsruhe—Leibniz-Institut für Informationsinfrastruktur, Hermann-von-Helmholtz-Platz 1, Eggenstein-Leopoldshafen, Germany</footnote>

<footnote n="6">6 Institute of Computing, University of Campinas, Campinas, Brazil</footnote>

<footnote n="7">7 Department of Clinical Neuroscience, Karolinska Institutet, Solna, Sweden</footnote>

<footnote n="8">8 Swedish National Data Service, University of Gothenburg, Gothenburg, Sweden</footnote>

<footnote n="9">9 Cancer Research UK, London, UK</footnote>

<footnote n="10">10 German Human Genome-phenome Archive, DKFZ, Heidelberg, Germany</footnote>

<footnote n="11">11 University of Southampton, Southampton, UK</footnote>

<footnote n="12">12 INRAE, Direction des affaires juridiques, Paris, France</footnote>

<footnote n="13">13 University of Strasbourg, Bureau d'économie théorique et appliquée, Joint Unit 7522, Strasbourg, France</footnote>
health research, specifically in the context of the COVID-19 pandemic; and (ii), to consider certain options to address the consequences of the case and to facilitate international data exchange moving forward.

We begin by describing the importance of international data exchange for health research ('The importance of international data exchange in health research'). We continue by providing an overview of the justifications available under the GDPR for the legitimate transfer of PD for health research ('The approach of the GDPR to international health research transfers'). We then provide a more detailed overview of the *Schrems II* case and how the decision impacts the transfer of EU PD for health research purposes ('Schrems II: the case, the decision, and transfers of PD for health research', 'Broader consequences of Schrems II for transfers of PD for health research' and 'Limitations of Article 49 options').

We then discuss two approaches to address the challenges posed to the international exchange of PD for health research by *Schrems II*. First, we highlight certain technological approaches ('Technical measures to overcome challenges'). We also, however, highlight a need for caution in considering these technological approaches as providing holistic solutions ('Limitations of technical measures to overcome challenges').

Second, we discuss a policy solution in the form of international transfer agreements specific to transfers of PD for health research purposes. We argue that such agreements would be beneficial to international health research whilst, in certain cases at least, having little disadvantage to other pertinent EU or third country interests ('Health research transfer agreements to overcome challenges').

## The importance of international data exchange in health research

Health research is often an international endeavour. In this regard, at least three types of arguments outlining the importance of the international exchange of PD for health research can be put forward.

First, several kinds of health research depend completely on the international exchange of PD. Such research includes, for example, research into questions best addressed by comparing data from multiple populations in distinct regions and research which can only be conducted with access to PD sets located in multiple different countries. For example, international task forces/interest groups devoted to the study of rare diseases may be completely dependent on being able to pool PD across borders [4].

Second, the optimal conduct of health research requires that PD be as accessible as possible so research can be synthesised and built upon. In this regard: PD

allows risks of bias to be assessed more thoroughly; PD permits flexible analysis, including reanalysis, through which research can be independently tested and verified with greater accuracy; and PD allows new scientific questions to be asked of existing data. For instance, the use of PD allows for investigations of interactions between interventions and patient-level characteristics not possible with other forms of data assemblies.

Finally, international data exchange serves ethical aims. It aids research resourcing and collaboration by reducing the resources required to collect PD. It maximises the contributions of individuals and institutions in the advancement of scientific knowledge. Further, data sharing brings researchers together into common projects and helps to break down the boundaries that impair research. International data exchange also facilitates the goal of equitable research, encouraging engagement, trust, transparency and the development of global capacity in research—see, for example, the CARE Principles [5].

The international exchange of PD for health research, however, is subject to legal conditions. Regarding transfers from the EU, these conditions are outlined in the GDPR.

## The approach of the GDPR to international health research transfers

Transfers of PD from the EU to third countries are only legitimate if based on a justification outlined in the GDPR. The aim of the justifications is to ensure that EU standards of data protection are maintained, in an 'essentially equivalent'—the term used in the GDPR and in *Schrems II* — manner in third countries. The GDPR lists these justifications in Articles 44 to 49. Justifications are organised in a three-tier hierarchy [6]. In each tier, justifications relevant for health research transfers are identifiable.

### Tier 1

Adequacy decisions under Article 45. An adequacy decision is a decision from the European Commission that protection for PD in a third country is 'essentially equivalent' to that in the EU. With an adequacy decision in place, transfers can proceed freely—subject to conditions in the decision. The Commission has only issued few adequacy decisions [7]. It is unlikely this number will increase rapidly as the procedure can take several years [8].

In principle, adequacy decisions can provide a framework for transfers of PD for health research. Certain adequacy decisions, however, only apply to specific sectors in a third country and may thus be of limited use to researchers working outside these sectors. For example, the Canadian adequacy decision only concerns commercial organisations [9, 10].
## Tier 2

Transfers subject to appropriate arrangements. If an adequacy decision is not in place for a third country, transfers of PD for health research may be legitimised based on bi- or multilateral arrangements with recipients which assure the standard of protection elaborated by EU law. Article 46 outlines several relevant approaches: ‘a legally binding and enforceable instrument between public authorities’; ‘binding corporate rules’—agreements valid within a company or group of companies; ‘data protection clauses’—contractual clauses on data transfer; ‘codes of conduct’; ‘certification mechanisms’; and ‘provisions… inserted into administrative arrangements between public authorities’.

## Tier 3

Specific situations. If neither a tier 1 or tier 2 option is available, EU researchers may still transfer PD to third countries based on ‘specific situation’ justifications outlined in Article 49. Several such justifications are relevant for health research, including: if a subject ‘has explicitly consented to the proposed transfer’; ‘the transfer is necessary for important reasons of public interest’; ‘the transfer is necessary…to protect…vital interests’; and the transfer ‘is necessary for the purposes of compelling legitimate interests pursued by the controller…not overridden by the interests or rights and freedoms of the data subject’.

The general approach of the GDPR, however, is subject to judicial interpretation. In this regard, recently, an important decision was taken by the CJEU in the *Schrems II* case.

### *Schrems II: the case, the decision, and transfers of PD for health research*

On 16 July 2020, the CJEU handed down its judgment in *Data Protection Commissioner v. Facebook Ireland Ltd, Maximilian Schrems (Schrems II)*.

The case concerns questions as to how Facebook might legitimately transfer PD from the EU to the US. In particular, the case dealt with two forms of transfer justification: (i) the privacy shield agreement—an adequacy decision for US corporate actors; [11] and (ii) standard contractual clauses (SCCs) —a form of Article 46 contractual clause pre-approved by the European Commission [12, 13]. The key question addressed in the case concerned the legitimacy of using these justifications for transfers to the US given that the US legal system permits mass surveillance operations, in which US authorities can access, in bulk, PD transferred from the EU.

The CJEU found the US system did not provide a level of protection ‘essentially equivalent’ to that provided by the EU regarding US authorities’ powers to access, in bulk, EU

citizens’ transferred PD. In particular, the CJEU highlighted two problems with the US system: (i) that intelligence agencies’ abilities to collect and analyse EU citizens’ PD was unnecessarily broad and included inadequate safeguards to protect rights—see, for example, para. 180; and (ii) the judicial review mechanisms for EU citizens did not meet the standards required by the EU Charter of Fundamental Rights—see, for example, para. 187.

The CJEU thus made two consequential pronouncements for health research transfers. First, the privacy shield adequacy decision was found to be illegitimate and was invalidated. Second, the SCCs outlined by the Commission are, in principle, still valid and useful to legitimate health research transfers from the EU to third countries but only if EU citizens’ rights in relation to the transfer(s) in question are provided with ‘essentially equivalent’ protection in the third country. Consequently, SCCs can only be used to legitimate health research transfers if: (i) a third country already provides ‘essentially equivalent’ protection; or (ii) supplementary measures assuring ‘essentially equivalent’ protection—contractual, technical, organisational, or other —can be put in place [14, 15].

Beyond the specific pronouncements made by the court, however, the decision also has much broader implications for international transfers of PD for health research.

### Broader consequences of *Schrems II* for transfers of PD for health research

Three broader consequences for health research transfers deserve further elaboration.

First, whilst *Schrems II* dealt specifically with privacy shield and SCCs, the logic of the decision applies to all another tier 2 transfer options for health research. In discussing SCCs, the CJEU was clear that to legitimately transfer PD from the EU, the law in a third country cannot function such that the standard of protection provided to EU citizens falls below the standard provided under EU law. In terms of their relationship with third-country law, all other tiers 2 justifications function comparably to SCCs. Thus, the basic requirements concerning SCCs and third-country laws apply to all other tiers 2 options.

The practical consequence of the above is that whilst previously researchers may have relied on uniform approaches—for example, uniform data transfer agreements—under tier 2 justifications, this is no longer possible. Researchers—or their host institutions—will now need to assess and confirm: (i) if a third country provides an ‘essentially equivalent’ standard of protection to that of EU law; and if not, (ii) whether supplemental safeguards can be implemented such that equivalent protection can be ensured in another way [14].
This will require researchers to expend supplemental
resources in conducting the assessments needed to ensure
legitimate transfers under tier 2 justifications. The precise
scope and degree of the supplemental burden remains
unclear. The burden may nevertheless—in some cases, at
least—constitute an obstacle to health research transfers.<fnref n="1" />
Certain researchers may not possess the resources needed
for assessments. Other researchers may be dissuaded
from taking on the risk of assessments, given the poten-
tially significant penalties applicable if transfers are
considered illegitimate—including significant fines under
Article 83(5) GDPR. Even researchers who have the
necessary resources and are not averse to the risk will
need to do cost-benefit analyses as to whether to divert
resources to facilitate assessments.

Second, whilst the case specifically considered the US,
the decision is also relevant for other third countries. Sev-
eral other third countries have already been highlighted as
potentially not providing ‘essentially equivalent’ protection.
Some of these third countries engage in mass surveillance
practices.<fnref n="2" /> Still, other third countries have been suggested to
be problematic as a result of other local law, or the practical
function of law in society [20].

Third, the case has reintroduced the problem of interna-
tional data transfers into the sphere of active public and poli-
tical debate. The underlying problems highlighted by the case
are not new. Indeed, the problems highlighted by the CJEU
concerning the privacy shield decision have been raised
repeatedly over the past years [21]. Prior to the case, however,
these problems had been addressed either with superficial
legalistic solutions—such as that the use of SCCs alone pro-
vide suitable protection—or lacked substantive consideration.
Following *Schrems II*, the underlying problems have been
rudely exposed. They are no longer subject to superficial
resolution and cannot be ignored.

One retort to our assertion that the consequences of the
decision are significant for transfers of PD for health research
might be: international transfer options outlined by non-US
adequacy decisions and those in Article 49 (tier 3 options)
are untouched by the decision. This retort is flawed. In

relation to adequacy decisions, the flaw is that there are only
a few decisions in force and these can thus only legitimate a
limited set of transfers. In relation to Article 49 options,
however, a deeper discussion is warranted.

Limitations of Article 49 options

A look at the applicability conditions for Article 49
options in relation to health research reveals extensive
limitations. Whilst full discussion is outside the scope of
this paper—see Mitchell et. al for a deeper discussion—
three types of limitation should be highlighted [22].

First, the applicability of several Article 49 justifica-
tions superficially relevant for health research transfers, is
in fact unclear. This is the case, for example, in relation to
Article 49(1)(d) justification ‘important reasons of public
interest’. The EDPB recognises the justification may be
used to legitimate certain transfers for health research in
the context of the COVID-19 pandemic [23]. There
remains a doubt, however, as to precisely which health
research activities qualify as important public interests
[24, 25].

Second, even when a justification's applicability is
clear, all Article 49 options are subject to general con-
ditions limiting their utility for health research transfers.
In particular, the EDPB highlights: '[tier 3 options] have
to be interpreted in a way which does not contradict the...
nature of [these options] as being exceptions from the
rule' [26]. This means Article 49 justifications should not
justify run-of-the-mill transfers for health research or
open, ongoing, sharing arrangements. The EDPB also
highlights that: 'Article 49 should never lead to a situa-
tion where fundamental rights might be breached' [26].
This statement implies that even Article 49 justifications
might not be used where third-country legal systems
cannot guarantee 'essentially equivalent' protection.

Third, even when the applicability of an Article 49 jus-
tification is clear, and the general conditions for application
are met, each justification is still subject to specific criteria
limiting utility for health research transfers. To rely on
Article 49(1)(a), for example, the GDPR requires a subject
to be: ‘informed of the possible risks of such transfers…due
to the absence of an adequacy decision and appropriate
safeguards’. The EDPB suggests this condition implies a
subject can only consent to a specific transfer to a third
country where the risks associated with the transfer are clear
in advance [22, 26].

In light of the prior analysis, an obvious question rears its
head: how might the challenges posed by *Schrems II* for
health research transfers be addressed moving forward?
Here we suggest two approaches. Our first approach con-
sists of technical measures.

<footnote n="1">¹ The burden might be minimised by single assessments valid, or
easily replicable, across multiple projects. The degree to which such
assessments will be permissible under data protection law, however,
and the degree to which they will be able to cover the range of forms
of health research transfers and countries they may relate to, remains
unclear. See [16].</footnote>

<footnote n="2">² See, for example, regarding Canada [17]. See, for example, regarding the UK [18]. On 31 January 2020, the UK withdrew from the EU, making the UK the third country. As of writing, EU–UK transfers continue largely as before under a ‘transition agreement’. This agreement is due to end, at the latest, on 30 June 2021. If no UK adequacy decision has been adopted by then the UK will be treated like any other third country—although the process toward adopting an adequacy agreement is now underway. See, for example, in relation to China [19].</footnote>
## Technical measures to overcome challenges

There are technical measures that do not involve actual data transfer. As these measures do not involve the transfer of PD, they offer pathways to avoid the challenges posed by data protection transfer rules. There are perhaps three commonly used technologies that facilitate international access to health research data without transfer.

First: remote access via a thin client (data visitation). A thin client is usually a low-performance computer application that establishes a connection to a remote server. The thin client provides a window to the data stored at the source location whilst the data itself never leaves the source jurisdiction. Researchers access the data remotely to perform their analyses and may only retrieve results. Scholars, such as Mitchell et al., highlighted the argumentation in the CJEU *Lindqvist* case that the mere act of making data accessible may not constitute an international transfer under EU data protection law [22, 27].

Second: access via remote execution. In this model, data is not made available directly to researchers. Instead, researchers are given a codebook or synthetic version of the data, they can use to produce a code/script for the analysis to be performed. The results of the execution of the code/script are then assessed by the data hosts at the source location before being returned to the researchers. This removes the need for data to be transferred or for researchers to ever actually see the data.

Third: a hybrid model. Infrastructure solutions can offer health researchers greater flexibility compared to a remote execution model but without the need to see the data as required by data visitation via a thin client. Researchers are not able to see the underlying data, but receive anonymised results in real-time—anonymised data are not PD under the GDPR. Such infrastructure can also offer federated solutions.

Although technical measures are doubtless useful in facilitating international health research transfers where legal obstacles may make this difficult, each measure exhibits limitations. Accordingly, technical measures cannot provide holistic answers.

## Limitations of technical measures to overcome challenges

Three types of limitation to the utility of technical measures should be highlighted.

First, measures display scientific limitations. Approaches such as data visitation and remote execution show promise regarding analyses on single large data sets and for certain types of 'second-level' analysis. Other important research needs, however, cannot be met with these approaches. As outlined in 'The importance of international data exchange

in health research', above, the availability of PD generally increases research efficiency and reduces bias. Data visitation and remote execution models do not permit PD to be exported and pooled in support of such ends.

Second, the measures display practical limitations. For example, users of data visitation or remote execution systems will require skills training and support to work in data holders' systems. This requires resource investment and available expertise on the part of the recipient researcher. Equally, to ensure standards concerning the use of PD are maintained, technical measures require extensive governance and control systems. The construction and maintenance of systems are resource-intensive and may restrict possibilities for data analysis. Further, to enable reproducibility, there remains a need for guidelines and standards for reporting analyses performed under data visitation and remote execution models.

Third, the measures display legal limitations. Pertinent legal definitions remain vague and are subject to swift jurisprudential change—one example is the CJEU *Breyer* case in relation to the definition of PD [28]. There are thus limits to the conviction with which technical measures can be proposed as solutions to legal problems. Regarding data visitation, the problem appears with the legal concept of 'transfer'. The *Lindqvist* case is now many years old and can be argued, as for example by Mitchell et al., to be out of step with more recent data protection thinking and jurisprudence [22]. The EDPB has even confirmed they see remote access as data transfer [15]. Regarding remote execution and hybrid models, the problem appears with the definition of PD and the degree to which synthetic data or anonymous data can be returned which are both scientifically useful and evade classification as PD [29].

The fact that technical measures may be inadequate to resolve all issues connected with current EU data protection challenges to health research transfers engenders a need to look elsewhere for solutions. Our second approach thus consists of a policy proposal.

## Health research transfer agreements to overcome challenges

We propose considering the conclusion of unique bi- and multilateral agreements outlining principles specifically governing health research transfers.<fnref n="3" /> Such agreements could insulate transfers of PD for health research purposes from

<footnote n="3">³ In this article, we have focussed on transfers of personal data for health research purposes. There may be scope for discussing specific international transfer agreements in relation to other forms of transfer —including in relation to research transfers that contain PD relating to health, or PD from which health data may be inferred. Such discussions, however, are outside the scope of this article.</footnote>
problematic, jurisdiction-specific, legislation—considering
legal and practical limitations. In turn, such agreements could
be concluded where general transfer agreements cannot be
concluded and could continue functioning where general
agreements fail. There are many objections which might be
raised to this proposal.<fnref n="4" /> Nevertheless, we consider the idea as
logical, interesting, and thus seek to open a discussion. Below,
we sketch a four-pillar supporting argument.

First, the idea that transfers of PD for health research
purposes should be considered as a unique form of inter-
national transfer should not be received as strange. There is
a general recognition that the conflicts of interests engaged
by PD processed for health research are distinct from those
which characterise other—usually commercial or bureau-
cratic—data processing purposes. Processing of PD for
health research purposes is thus often subject to separate
legal and ethical conditions to those applicable to other
processing purposes. This rationale is reflected in numerous
international and national instruments. The rationale is even
reflected in the GDPR. Against this background, why
should international transfers of PD for health research
purposes not be treated as unique forms of transfers?

Second, we would suggest that the negative impacts on
EU and third countries' non-research interests which, at
least currently, would accrue from such agreements, would
likely, in certain instances at least, be limited.<fnref n="5" /> For example,
should the EU and the US conclude a bilateral health
research-specific transfer agreement implementing limita-
tions on US intelligence services' activities necessary to
meet EU standards, we would tentatively suggest the impact
on US national security interests would be nominal. To our
knowledge, PD transferred internationally for health
research do not play a significant role in intelligence
activities.<fnref n="6" /> We do not suggest that PD transferred inter-
nationally for health research should be considered 'lower
risk' in relation to non-research processing. We simply aim
to highlight that the interests underpinning non-research
processing may, in certain instances at least, not suffer
significantly from restricted access to this data.

Third, the benefit to health research may be significant.
Under such agreements, researchers would be empowered
to engage in the international exchange of PD for health
research with a minimum of legal obstruction under EU
data protection law. Equally, such agreements could miti-
gate against the risk that future jurisprudential develop-
ments concerning substantively different types of PD
transfer might impact on the ability to engage in health
research transfers—as in *Schrems II*. Further, such instru-
ments could be tailored specifically to the needs of health
research and thus provide researchers with clarity not
necessarily present in generally applicable international
transfer provisions.

Finally, in terms of the content of such instruments,
health research is, usually, already subject to strict ethical
approval. The ethical principles which govern such
approvals already seek to protect the interests, and funda-
mental rights, of research subjects and to balance these
against the potential benefit of health research to society as a
whole. This scrutiny provides a precedent to limit and
inform the policy measures suggested above.

Conclusion

Transfers of PD for health research from the EU to third
countries must be legitimated under one of the justifications
in the GDPR. In principle, the GDPR offers a broad range
of such justifications. In the recent *Schrems II* case, how-
ever, the CJEU made consequential pronouncements for the
utility of these justifications for health research transfers.

Two pronouncements stand out. First, the CJEU invalid-
dated the EU-US privacy shield adequacy decision. Second,
the CJEU asserted that transfers based on bilateral agree-
ments are only valid if an 'essentially equivalent' standard
of protection to that offered under EU law can be ensured in
the third country. This latter assertion has particularly wide-
ranging implications for health research transfers.

From a legal perspective, the assertion is applicable to
many of the justifications generally relevant for the legit-
imation of international transfers for health research under
the GDPR. From a geographical perspective, the assertion is
potentially relevant in relation to numerous third countries.

Certain GDPR justifications for legitimating international
transfers for health research remain directly unaddressed in
*Schrems II*. The case does not extensively discuss non-US
adequacy decisions or the specific situation justifications in
Article 49. The utility of these options for health research
transfers, however, has limitations.

Moving forward, certain technical measures provide
promising approaches to allow international health research
involving EU PD to proceed despite legal obstacles. For
example, in data visitation and remote execution models,

<footnote n="4">⁴ For example: the idea of such agreements may be criticised as idealistic and as distant from current political and legal realities; such agreements are unlikely to appear in the near future and cannot offer short-term solutions; numerous questions remain open concerning the substance of such agreements and the procedures for their conclusion; and such agreements would likely, often, face significant obstacles to conclusion.</footnote>

<footnote n="5">⁵ We restrict our proposition to the current situation given the speed of technological advance and the ability for data sets to be subjected to advanced analytical processes—including AI—capable of drawing novel and unexpected inferences about individuals and populations.</footnote>

<footnote n="6">⁶ We make this statement on the basis of the information we are aware of concerning the issue. However, the issue has not been a topic of extensive empirical research and certain law enforcement and intelligence activity is done without specific information ever being released to the public.</footnote>
PD is never transferred outside the EU. Such technical solutions, however, have their own limitations.

Policy measures may provide an alternative form of solution. In this regard, we would like to begin a discussion on the idea of health research-specific international agreements. Such agreements would be beneficial to international health research and, in certain cases at least, would likely have a little negative impact on pertinent non-research interests.

**Acknowledgements** This work was developed as part of the Research Data Alliance RDA-COVID19-WG Recommendations and Guidelines on data sharing, and the RDA COVID-19 Legal and Ethics Considerations subWG, and we acknowledge the support provided by the RDA community and structures.

**Author contributions** DH was the main author of the paper. AB, FPC, GN and SP contributed extensively to the text. AC-T, DD, CBM, BP and SR contributed to the conceptualisation of the paper as well as by providing extensive commentary and feedback.

**Funding** This work has partly been produced by AB with the support of the following grants. EUCANCan: 'EUCANCan: a federated network of aligned and interoperable infrastructures for the homogeneous analysis, management and sharing of genomic oncology data for Personalized Medicine' CIHR 160202/Eur. Comm. (2019-2023). EuCanSHare: 'EuCanSHare: An EU-Canada joint infrastructure for next-generation multi Study Heart research' FRSQ 278114/CIHR 16033/Eur. Comm. (2018-2024). Canada Foundation for Innovation Cyberinfrastructure Initiative, the Ontario Research Fund, BC Knowledge Development Fund and the Ministère de l'Économie, de la Science et l'Innovation for 'The Cancer Genome Collaboratory' project. This work has partly been produced by AC-T with the support of the RDA Europe Ambassador programme. It has received funding from the European Union's Horizon 2020 (H2020) research and innovation programme via the RDA EU 4.0 project (ref. GA no. 777388). This work has partly been produced by CBM whose work was partially supported by the following grants. FAPESP Research Innovation and Dissemination Centre CNPq 305110/2016-0 and 428459/2018-8. Open Access funding enabled and organized by Projekt DEAL.

## Compliance with ethical standards

**Conflict of interest** The authors declare no competing interests.

**Publisher's note** Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

**Open Access** This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/.

## References

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 2016. OJ, L 119/1.

2. Peloquin D, DiMaio M, Bierer B, Barnes M. Disruptive and avoidable: GDPR challenges to secondary research uses of data. Eur J Hum Genet. 2020;28:697–705.

3. Data Protection Commissioner v. Facebook Ireland Ltd, Maximillian Schrems. 2020. ECLI:EU:C:2020:559.

4. Hansson MG, Lochmüller H, Riess O, Schaefer F, Orth M, Rubinstein Y, et al. The risk of re-identification versus the need to identify individuals in rare disease research. Eur J Hum Genet. 2016;24:1553–8.

5. RDA. CARE principles for indigenous data governance. Policy. 2019.

6. Hallinan D. Protecting genetic privacy in biobanking through data protection law. Oxford, UK: Oxford University Press. 2021.

7. European Commission. Adequacy decisions: How the EU determines if a non-EU country has an adequate level of data protection. Website. Available from: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/a adequacy-decisions_en. Last consulted 5 Mar 2021.

8. Kuner CB. Transborder data flows and data privacy law. Oxford, UK: Oxford University Press. 2013.

9. Commission Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act (notified under document number C(2001) 4539) (2002) OJ, L 2/13.

10. Bernier A, Knoppers BM. Pandemics, privacy, and public health research. Can J Public Health. 2020;111:454–7.

11. Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176) (Text with EEA relevance) (2016) OJ, L 207/1.

12. European Commission. Standard Contractual Clauses (SCC) Standard contractual clauses for data transfers between EU and non-EU countries. Website. Available from: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Last consulted 5 Mar 2021.

13. European Commission. Data protection—standard contractual clauses for transferring personal data to non-EU countries (implementing act). Policy Consultation. 2020. Available from: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12741-Commission-Implementing-Decision-on-standards-contractual-clauses-for-the-transfer-of-personal-data-to-third-countries. Last consulted 5 Mar 2021.

14. European Data Protection Board. Frequently asked questions on the judgment of the court of justice of the European Union in case C-311/18—data protection commissioner vs Facebook Ireland Ltd and Maximillian Schrems. Policy. 2020.

15. European Data Protection Board. Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. Policy. 2020.

16. Bovenberg J, Peloquin D, Bierer B, Barnes M, Knoppers BM. How to fix the GDPR's frustration of global biomedical research: Sharing of data for research beyond the EU must improve. Science 2020;370:40–42.

17. Maldoff G, Tene O. 'Essential equivalence' and European adequacy after Schrems: the Canadian example. Wis Int'l LJ. 2016; 34:211–83.
18. European Parliament. Proposed mandate for negotiations for a new partnership with the United Kingdom of Great Britain and Northern Ireland European Parliament resolution of 12 February 2020 on the proposed mandate for negotiations for a new partnership with the United Kingdom of Great Britain and Northern Ireland (2020/2557(RSP)). Policy. 2020.

19. Arbeitsgericht Düsseldorf, 9 Ca 6557/18, 05.03.2020, ECLI:DE: ARBGD:2020:0305.9CA6557.18.00.

20. Slokenberga S, Reichel J, Niringiye R, Croxton T, Swanepoel C, Okal J. EU data transfer rules and African legal realities: is data exchange for biobank research realistic? Int Data Priv Law. 2019;9:30–48.

21. Boehm F. Assessing the new instruments in EU-US data protection law for law enforcement and surveillance purposes. Eur Data Prot L Rev. 2016;2:178–90.

22. Mitchell C, Ordish J, Johnson E, Bridgen T, Hall A. The GDPR and genomic data—the impact of the GDPR and DPA 2018 on genomic healthcare and research. Report. 2020.

23. European Data Protection Board. Statement on the processing of personal data in the context of the COVID-19 outbreak. Policy. 2020.

24. Article 29 WP. Working document on a common interpretation of Article 26(1) of Directive 95/46/EC of 24 October 1995. Policy. 2005.

25. Ploem M, Essink-Bot M, Stronks K. Proposed EU data protection regulation is a threat to medical research. *BMJ*. 2013; 346. Available from: https://www.bmj.com/content/346/bmj.f3534. long. Last consulted 5 Mar 2021.

26. European Data Protection Board. Guidelines 2/2018 on derogations of Article 49 under regulation 2016/679. Policy. 2018.

27. Bodil Lindqvist. ECLI:EU:C:2003:596, 2003.

28. Patrick Breyer v. Bundesrepublik Deutschland [2016] ECLI:EU:C:2016:779.

29. Quinn P. The anonymisation of research data—a pyric victory for privacy that should not be pushed too hard by the EU data protection framework? Eur J Health Law. 2017;24:347–67.