Draft version for stakeholder interaction and discussion - B1MG Legal Taxonomy status-April 2021 - Taxonomy of member state legal requirements applicable to cross-border exchange of health and genetic data in the European 1+MG Project
Creators: name: Tzortzatou, Olga
name: Thorogood, Adrian
name: Becker, Regina
name: B1MG WP2
name: 1+MG WG2
Publisher: name: Zenodo
Year: 2022
Subjects: B1MG
Beyond 1 Million Genomes
1+MG
1 Million Genomes Initiative
ELSI
Legal landscape
taxonomy - data lifecycle

description: The 1+MG aims to develop an ethical and legal governance framework to enable cross-border access to genomic and related health data for healthcare, research, and policy-making purposes. The ethical and legal governance framework must ensure compliance with both European Laws - namely the General Data Protection Regulation (GDPR), as well as the laws of signatory Member States. This document aims to describe the range of divergence between Member State laws relevant to the activities of the 1+MG. The scope of this document are authoritative rules with legally binding force found in statutes or regulations issued by a government agency. The taxonomy is organized according to stages in the data lifecycle - collection, generation, primary use, storage, secondary use, and results. At each stage of the life cycle, the taxonomy sections are broken down further into relevant subject matter areas potentially subject to Member State legal requirements. Within each subject matter area, Member State rules are organized into categories and compared based on their function, i.e., their effect on relevant 1+MG activities. In assessing function, one can consider common factual use cases of cross-border access to genomic and related health data for healthcare, research, and policy-making purposes (see e.g., the 1+MG Healthcare Use Case Workshop Summary). Where Member State rules are functionally equivalent, they are grouped together into the same category. This functional comparison is neutral to the formal nature of the legal rule (the regulatory field in which it applies or its scope of application). Examples are sometimes provided to provide additional context. In summary, each section provides a taxonomy describing the range of divergence between types of Member State laws. This taxonomy focuses only on legal requirements of a public-order nature, as the most important and non-negotiable rules that have to be respected by the 1+MG. It will not look at non-binding rules found in guidelines, or at rules emanating from private-ordering such as institutional policies or contracts (which are to some degree negotiable). The taxonomy is neutral as to the source or form of the rule (e.g., criminal law; human tissue law; national data protection law; sector-specific data protection law; law implementing national data centre; binding code of conduct; common law). For example, while 1+MG is not concerned with human biosamples per se, human tissue rules may indirectly limit what data types can be made available to 1+MG. Establishing such a taxonomy of legal rules does face considerable complexity and limitations. For example, the taxonomy must presumably not only cover different Member States but also different scopes of application of those laws. Data may be collected and generated as part of healthcare provision, research projects, or national genomic initiatives (which themselves may have more of a clinical or research focus). Different rules may apply depending on the sector (e.g., public v.s. private healthcare providers). Rules may differ depending on the data type (e.g., special rules for health and/or genetic data). Rules may also differ depending on the secondary use made of the data (e.g., research, healthcare, policy-making). Some rules may be mandatory, while others may allow exceptions under certain circumstances. Also, a thematic list may not reflect the interdependencies between rules (such as the relationship between legal basis, data subject rights and technical and organizational measures).