The VASCUNET Manifesto on Data Privacy Compliant Real World Evidence

Between 1997 and today, the history of the VASCUNET collaboration1Behrendt C.A. Venermo M. Cronenwett J.L. Sedrakyan A. Beck A.W. Eldrup-Jorgensen J. et al.VASCUNET, VQI and the International Consortium of Vascular Registries – unique collaborations for quality improvement in vascular surgery.Eur J Vasc Endovasc Surg. 2019; 58: 1-2Abstract Full Text Full Text PDF PubMed Scopus (21) Google Scholar has been accompanied by various milestones of the digital revolution. In 1998, when only 1% of European inhabitants used the internet, a company known for the most popular search engine was founded in a garage in California, USA. Subsequently, the increasing data exchange between the European Union (EU) and the US led to the “Safe Harbour” agreement in 2000. While in 1993 only 3% of the world's information was stored digitally, this proportion increased to 96% in 2007.2Hilbert M. López P. The world's technological capacity to store, communicate, and compute information.Science. 2011; 332: 60-65Crossref PubMed Scopus (790) Google Scholar Shortly afterwards, in 2008, the catchphrase “big data” was introduced to the biomedical community,3Doctorow C. Big data: welcome to the petacentre.Nature. 2008; 455: 16-21Crossref PubMed Scopus (42) Google Scholar and only four years later, it wasn't surgeon but data scientist that was voted “the sexiest job of the 21st century”.4Davenport T.H. Patil D.J. Data scientist: the sexiest job of the 21st century.Harv Bus Rev. 2012; 90: 128Google Scholar These rapid developments led to both opportunities and challenges for real world research using clinical and administrative registries. Research groups proved that the concept of data privacy is a complex and fragile construct.5Sweeney L. k-anonymity: A model for protecting privacy.Int J Uncertain. 2002; 10: 557-570Crossref Scopus (5074) Google Scholar Recently, the “EU–US Privacy Shield” agreement, a continuation of the “Safe Harbour”, agreement allowing transatlantic data transfer, collapsed over a decision of the European Court of Justice, creating a legislative vacuum in this field. In May 2018, after a two year transition phase, the EU General Data Protection Regulation (GDPR) came into force. This new EU data protection legislation created a uniform set of rules across the EU fit for the digital era, to improve certainty as to the law, and boost trust in the digital single market for citizens. Within the first year of the GDPR, more than 200 000 complaints have been filed and fines totalling more than €56 million have been issued. Although this complex set of regulations is a binding legislative act that has been put in place without the need for a Member State law, there are approximately 70 opening clauses, leaving limited room for national legislators to modify these rules. Various data sources can be used in real world evidence research. VASCUNET has primarily used national, regional, or centre based registry data collected for quality improvement and healthcare research purposes. These registries reached varying completeness and not all have been validated. Some of these registries are operated by public authorities. Others are operated privately, e.g., by commercial organisations or scientific societies. Depending on the regulations related to data processing, explicit informed consent is required for these data. In a few countries, data from registries are cross linked to other data sources such as administrative data. For instance, cross linkage to cover exact date of death after abdominal aortic aneurysm repair is important when comparing results. Single or multicentre registries usually contain personal data extracted from the electronic health records of the participating centres. Owing to the fast development of big data and smart data methods, data from picture archiving and communication systems (PACS) are also of increasing interest, e.g., for predictive models in aortic repair using machine learning techniques. GDPR contains three important changes to the former regulatory framework inside Union and Member States law. Firstly, the process of anonymisation is considered to be an act of processing personal data and as such needs to adhere to the regulation. Secondly, pseudonymised data should be considered as personal data under most circumstances. Thirdly, to achieve an anonymised data set, several principles of data privacy, including the concept of k-anonymity, should be taken into consideration.5Sweeney L. k-anonymity: A model for protecting privacy.Int J Uncertain. 2002; 10: 557-570Crossref Scopus (5074) Google Scholar The foundation of international quality improvement is based on candid sharing of registry data for scrutiny and analysis, in order to identify areas for possible future improvement of care, to benefit patients. In VASCUNET, the implications of the GDPR on real world data projects were meticulously discussed over past years. The following items describe the ambition of the VASCUNET collaboration to perform future international registry collaboration projects in the GDPR era. (1) The projects coordinated by VASCUNET as data controller are performed according to GDPR. No data concerning European citizens will be transferred or processed outside the EU without following the legal prerequisites. (2) VASCUNET is dedicated to the lawful, fair and transparent processing of personal data. The collaboration follows the rules of purpose limitation and data minimisation. The accuracy of data will be assured by regular validation projects. VASCUNET will ensure that only data needed for future research are stored, and that the integrity and confidentiality of the data is secured. If lawful, necessary data will be stored to prove the validity of research to third parties with legimitate interest. (3) VASCUNET supports the implementation of technical improvement to established registries, including “privacy by design” features such as encryption, separability, load bearing capacity, and measures to improve trustworthiness, integrity and availability. Over the coming years, it will be one of the main missions of the VASCUNET collaboration to develop a GDPR compliant European data platform, to facilitate future international registry projects.