Data Protection Bill [HL] — House of Lords, 2017-10-30
Topic: Technology
Narendra Babubhai Patel (Crossbench, Unknown): My Lords, I shall speak also to my Amendments 14 and 111. Perhaps I may first thank the Minister and his team, who kindly agreed to see me and others to discuss what amendments I might have following my Second Reading speech. I am not sure that we resolved any issues, but I at least thank him for his courtesy and hope that, after today, we will resolve those issues. I will speak first to Amendments 12 and 14. I beg the Committee’s indulgence for taking slightly more time than your Lordships might expect for a group of amendments, partly because I think this is the only time we are dealing with the major sector issues—the sector being the universities and other research institutions on which we are about to rely a lot for our economic growth; I will come to that. I am supported enthusiastically by the Wellcome Trust, the MRC, Cancer Research UK, the AMRC, the Sanger Institute, the Academy of Medical Sciences, the ESRC and many others. They are extremely anxious that what we do with the Bill does not in any way counter their ability to use data for productive research—and I do mean productive research. I declare an interest: I am a fellow of the Academy of Medical Sciences and of the Royal Society of Edinburgh, and I have a strong association with Dundee University. I cannot miss the opportunity to say that last week Dundee University was ranked number one globally for science innovation, beating every university in the United States. That is a fantastic achievement in science research. It beat all the so-called elite universities in England that we hear about, as well Clause 7 sets out a legal basis for processing personal data in the public interest. This reflects article 6(1)(e) of the GDPR. It is incredibly important to get the clause right as it will be the only legal gateway available for many research purposes. Why is this the case? Most research purposes rely on informed consent as a legal basis for processing. Consent is the basis of article 6(1)(a) of the GDPR. However, GDPR-compliant consent for the use of personal data is not always a feasible option as a legal basis. Consent is often important in the interests of fairness and transparency but will not be the appropriate legal basis for much research I will highlight two relevant sets of circumstances to illustrate why public interest is a necessary legal basis for many valuable research purposes. The first is where consent is not possible. There are a number of situations in which it is problematic to seek consent. Seeking consent may be impracticable where health data have been collected in the past and the time and expense seeking and approaching individuals for consent would be prohibitive. It may compromise effective population coverage; for example, requiring consent has been shown to have a negative impact on the quality of data for cancer registries. It may cause distress or harm in situations where patients may be inconvenienced or upset by being contacted for their consent to use their data for a research project, even if they do not subsequently object to the research going ahead; for example, contacting people about a study examining unexplained child deaths could cause serious distress. It may lead to bias because of self-selection bias among data subjects when asked a question. It may prevent studies large enough to produce meaningful results because the cost of seeking consent across a large number of people can be very high I will give one or two examples pertaining to the five issues that I have described. A study of more than 40,000 people demonstrated a highly significant association between the use of minor tranquillisers such as Diazepam and the risk of serious road traffic accidents. This was done through linking prescriptions issued by GPs and data on hospital admissions and deaths. By the way, this study had considerable implications for the safety of patients prescribed Diazepam, and their treatment, and of course also for other road users, but would not have been possible if data could not be processed on a consent basis. A study of the incidence of breast cancer in women was used to show that affluent women have a higher incidence than socially deprived women, but that socially deprived women had poorer survival statistics. This study used identifiable data without consent; it used hospital and GP records to look at a number of factors involved in cancer treatment Access to patient records also helps researchers to identify suitable participants to be invited to take part in studies. This is essential for evaluating new medicines, technologies and interventions for the prevention, diagnosis and treatment of disease. For example, in my own field, when the UK collaborative trial of ovarian cancer screening was set up to investigate different ovarian cancer screening methods, 1.2 million patients were invited to take part by post, leading to 200,000 women consenting to take part. It is a world-renowned study whose results have benefited the whole world. If consent were the only available legal basis, that recruitment strategy would not have been possible as these women had not given consent to the initial contact. Of the 1.2 million women contacted, only 32 women raised any concerns about being contacted These are just some of the many examples of vital research that, although very much in the public interest, cannot be done on the basis of consent. The research community has developed a system of robust and proportionate safeguards for these situations, to ensure that research on important topics can be undertaken using personal data where consent is not possible while protecting the research subjects. The use of personal data in these circumstances is controlled through safeguards. Studies using health data are reviewed by the Health Research Authority’s confidentiality advisory group; they must also receive a positive opinion from a research ethics committee to be eligible. The use of this data must be considered to be in the public interest, so we have safeguards In this country, we also have the benefit of a National Data Guardian for health and social care—a position I very much hope will be placed on a statutory footing through a Private Member’s Bill that is progressing through the other place. This guardian’s role is to protect patients’ rights and interests over data about them, within and beyond health and care services. The reason for this exposition into the governance of personal data in health research is to illustrate that the UK has a robust, well-established system of safeguards and oversight for processing personal data in the public interest when it comes to health and medical research I turn to the second issue: where consent cannot meet GDPR standards. Even with the most rigorous standards and through engagement with participants, consent may not meet the new, stricter standards specified by the GDPR as a basis for processing under article 6(a). The working party of EU data protection regulators—the article 29 working party—produced an opinion in 2011 on the definition of consent that ran to 38 pages. It is not a straightforward legal basis for researchers to use. Furthermore, data collected for research purposes often has significant value beyond the limited, original purpose of its collection. Research can proceed in unanticipated ways, with different teams using the data and processing it in such a way that the data subjects could not feasibly be informed at the outset of the full extent of how their data could be used, for what purposes or by whom My own unit started collecting data in 1958, before I even started as a junior doctor, and carried on collecting information manually for over 50 years. The consent we had from the pregnant women who had had babies was to us using the data to improve the services. Subsequently, 45 years later this was the only data available—in this country or worldwide—to prove that the intrauterine environment and the effect on that environment produces adult diseases. That is now well established. That information would never have been available if we did not have that data. We are proud that we have collected it Another example is UK Biobank. It relies on broad consent where the participants give consent for pseudonymised data to be used for a variety of research studies under certain conditions. This broad consent approach is approved by an ethics committee and reduces the burden on participants because they do not need to be contacted for consent for each new study. I have no doubt that my noble friend Lady Manningham-Buller will have something to say about this as she is the chairman of the Wellcome Trust, which is the holder of the data.