Towards the re-use of personal data concerning health for scientific research: a proactive approach within the European legal framework
Creators: name: Paolo, Guada
name: Bincoletto Giorgia
Publisher: name: Zenodo
Year: 2023
Subjects: Personal Data Protection
Data Protection by Design
Scientific Research
Health Data
GDPR

description: The secondary processing of personal health data for scientific research in the medical field is fundamental for fostering innovation and growing knowledge that improves individual and public health. This data primarily processed for healthcare purposes by healthcare providers may be secondarily used by researchers for scientific purposes. However, the data controller and all the stakeholders shall assess the applicable grounds and conditions and then comply with the data protection law to safeguard fundamental rights and freedoms. Research represents an unavoidable prerequisite for ensuring the development of knowledge and, more generally, the progress of science. It is also the prime mover of social changes with direct effects on the community, on the quality of our life, on the training processes of the new generations. The relevance of the interests it bears is often the object of balancing with the rights and principles recognized by the legal system. In the medical field it is necessary to emphasize the relationship between individual and collective interests. The obvious advantage in terms of individual care must be balanced with the more general need to protect public health. It is, therefore, essential to identify some criteria aimed at determining the correct point of contact between these needs. The European legal framework is characterized by a significant number of regulatory interventions in line with the European data strategy. First of all, when the research implies the processing of personal data concerning health, we have to take into account the General Data Protection Regulation (GDPR) and the discipline issued in the national contexts (e.g. in Italy, France). Furthermore, we need also to focus on the current proposal for the creation of a European Health Data Space (EHDS) that will foster data access and sharing in the healthcare context. This is the first domain-specific common European data space initiated within the “European strategy for data” of 2020, and it is related to the processing of electronic health personal and non-personal data for primary and secondary purposes. The EHDS needs to be compliant with the data protection law, the data-related acts and the applicable law in the specific sector at the EU and Member States levels (GDPR; Directive 2011/24 on on the application of patients’ rights in cross-border healthcare; Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union; Regulation 2017/745 on medical devices and Regulation (EU) 2017/746 on in vitro diagnostic medical devices; Data Governance Act; the Data Act proposal; the Artificial Intelligence Act proposal). This particularly prolific regulatory activity by the European legislator is certainly a strong point, as even the issue of the use of data for medical and biomedical research finds defined rules and principles which seek to favor it; however, compliance with all the obligations and requirements that are (and will sooner be) imposed and the coordination between the various regulatory interventions represent a critical issue which risks discouraging and curbing research activity rather than fostering it. Within this scenario, we propose a proactive, legal-technical e-health solution that complies with the rules and principles of the legal frameworks and empowers the individual’s control over electronic personal health data while promoting medical research. To this end, the data protection by design concept plays a central role, and an interdisciplinary approach is fundamental in combining legal and technical perspectives. This solution may concretely support researchers and professionals involved in medical research projects since: it defines a clear basis for processing personal data for secondary research purposes; it uses the additional safeguards of the explicit consent (as provided by the Italian framework); it gives high importance to the provision of complete and transparent information to the data subjects (i.e. as planned by the French national initiative). Such an approach is in line with the GDPR approach on fostering secondary uses of personal data and enhances scientific research by involving as many subjects as possible in a safe and compliant environment.