Are Requirements to Deposit Data in Research Repositories Compatible With the European Union's General Data Protection Regulation?
Authors: Deborah Mascalzoni, Heidi Beate Bentzen, Isabelle Budin-Ljøsne, Lee Andrew Bygrave, Jessica Bell, Edward S. Dove, Christian Fuchsberger, Kristian Hveem, Michaela Th. Mayrhofer, Viviana Meraviglia, David R. O'Brien, Cristian Pattaro, Peter P. Pramstaller, Vojin Rakic, Alessandra Rossini, Mahsa Shabani, Dan Jerker B. Svantesson, Marta Tomasi, Lars Ursin, Matthias Wjst, Jane Kaye
Journal: Annals of Internal Medicine (2019)

Ideas and Opinions5 March 2019Are Requirements to Deposit Data in Research Repositories Compatible With the European Union's General Data Protection Regulation?Deborah Mascalzoni, PhD*, Heidi Beate Bentzen, LLM*, Isabelle Budin-Ljøsne, PhD, Lee Andrew Bygrave, LLD, Jessica Bell, PhD, Edward S. Dove, PhD, Christian Fuchsberger, PhD, Kristian Hveem, MD, PhD, Michaela Th. Mayrhofer, PhD, Viviana Meraviglia, PhD, David R. O'Brien, JD, Cristian Pattaro, PhD, Peter P. Pramstaller, MD, Vojin Rakić, PhD, Alessandra Rossini, PhD, Mahsa Shabani, PhD, Dan Jerker B. Svantesson, PhD, Marta Tomasi, PhD, Lars Ursin, PhD, Matthias Wjst, MD, and Jane Kaye, DPhilDeborah Mascalzoni, PhD*Institute for Biomedicine, Eurac Research, Bolzano, Italy, and Uppsala University, Uppsala, Sweden (D.M.), Heidi Beate Bentzen, LLM*Norwegian Research Center for Computers and Law and Centre for Medical Ethics, University of Oslo, Oslo, Norway (H.B.B.), Isabelle Budin-Ljøsne, PhDNorwegian Institute of Public Health, Oslo, Norway (I.B.), Lee Andrew Bygrave, LLDNorwegian Research Center for Computers and Law, University of Oslo, Oslo, Norway (L.A.B.), Jessica Bell, PhDUniversity of Oxford, Oxford, United Kingdom, and University of Melbourne, Melbourne, Victoria, Australia (J.B., J.K.), Edward S. Dove, PhDUniversity of Edinburgh, Edinburgh, United Kingdom (E.S.D.), Christian Fuchsberger, PhDInstitute for Biomedicine, Eurac Research, Bolzano, Italy (C.F., V.M., C.P., P.P.P., A.R.), Kristian Hveem, MD, PhDInstitute for Biomedicine, Eurac Research, Bolzano, Italy; HUNT Research Center and K.G. Jebsen Center for Genetic Epidemiology, Norwegian University of Science and Technology, Levanger, Norway (K.H.), Michaela Th. Mayrhofer, PhDBBMRI-ERIC, Graz, Austria (M.T.M.), Viviana Meraviglia, PhDInstitute for Biomedicine, Eurac Research, Bolzano, Italy (C.F., V.M., C.P., P.P.P., A.R.), David R. O'Brien, JDHarvard University, Boston, Massachusetts (D.R.O.), Cristian Pattaro, PhDInstitute for Biomedicine, Eurac Research, Bolzano, Italy (C.F., V.M., C.P., P.P.P., A.R.), Peter P. Pramstaller, MDInstitute for Biomedicine, Eurac Research, Bolzano, Italy (C.F., V.M., C.P., P.P.P., A.R.), Vojin Rakić, PhDCenter for the Study of Bioethics, University of Belgrade, Belgrade, Serbia (V.R.), Alessandra Rossini, PhDInstitute for Biomedicine, Eurac Research, Bolzano, Italy (C.F., V.M., C.P., P.P.P., A.R.), Mahsa Shabani, PhDKU Leuven and Leuven Institute for Human Genomics and Society, Leuven, Belgium (M.S.), Dan Jerker B. Svantesson, PhDBond University, Gold Coast, Queensland, Australia (D.J.S.), Marta Tomasi, PhDUniversity of Trento, Trento, Italy, and Free University of Bozen-Bolzano, Bolzano, Italy (M.T.), Lars Ursin, PhDNorwegian University of Science and Technology, Trondheim, Norway (L.U.), Matthias Wjst, MDHelmholtz Zentrum München and Technical University Munich, Munich, Germany (M.W.), and Jane Kaye, DPhilUniversity of Oxford, Oxford, United Kingdom, and University of Melbourne, Melbourne, Victoria, Australia (J.B., J.K.)Author, Article, and Disclosure Informationhttps://doi.org/10.7326/M18-2854 SectionsAboutFull TextPDF ToolsAdd to favoritesDownload CitationsTrack CitationsPermissions ShareFacebookTwitterLinkedInRedditEmail To reproduce study findings and facilitate new discoveries, many funding bodies, publishers, and professional communities are encouraging—and increasingly requiring—investigators to deposit their data, including individual-level health information, in research repositories. For example, in some cases the National Institutes of Health (NIH) and editors of some Springer Nature journals require investigators to deposit individual-level health data via a publicly accessible repository (1, 2). However, this requirement may conflict with the core privacy principles of European Union (EU) General Data Protection Regulation 2016/679 (GDPR), which focuses on the rights of individuals as well as researchers' obligations regarding transparency and accountability.The GDPR ...References1. National Institutes of Health, U.S. National Library of Medicine, Trans-NIH BioMedical Informatics Coordinating Committee (BMIC). NIH data sharing policies. Accessed at www.nlm.nih.gov/NIHbmic/nih_data_sharing_policies.html on 14 December 2018. Google Scholar2. Springer Nature. Research data policies FAQs. Accessed at www.springernature.com/gp/authors/research-data-policy/faqs/12327154 on 14 December 2018. Google Scholar3. Bentzen HB, Svantesson DJB. Jurisdictional challenges related to DNA processing in transnational clouds. In: Svantesson DJB, Kloza D, eds. Transatlantic Data Privacy Relationships as a Challenge for Democracy. European Integration and Democracy Series, vol. 4. Cambridge, United Kingdom: Intersentia; 2017:241-60. Google Scholar4. Norwegian University of Science and Technology. The HUNT study—a longitudinal population health study in Norway. NTNU HUNT Research Centre. Accessed at www.ntnu.edu/hunt on 14 December 2018. Google Scholar5. Pala M, Zappala Z, Marongiu M, Li X, Davis JR, Cusano R, et al. Population- and individual-specific regulatory variation in Sardinia. Nat Genet. 2017;49:700-7. [PMID: 28394350] doi:10.1038/ng.3840 CrossrefMedlineGoogle Scholar6. Authorisation no. 9/2014. General Authorisation to Process Personal Data for Scientific Research Purposes. Italian Official Gazette. 30 December 2014; n. 301. Google Scholar7. Dyke SO, Philippakis AA, Rambla De Argila J, Paltoo DN, Luetkemeier ES, Knoppers BM, et al. Consent codes: upholding standard data use conditions. PLoS Genet. 2016;12:e1005772. [PMID: 26796797] doi:10.1371/journal.pgen.10057728 CrossrefMedlineGoogle Scholar8. Budin-Ljøsne I, Burton P, Isaeva J, Gaye A, Turner A, Murtagh MJ, et al. DataSHIELD: an ethically robust solution to multiple-site individual-level data analysis. Public Health Genomics. 2015;18:87-96. [PMID: 25532061] doi:10.1159/000368959 CrossrefMedlineGoogle Scholar9. Budin-Ljøsne I, Teare HJ, Kaye J, Beck S, Bentzen HB, Caenazzo L, et al. Dynamic Consent: a potential solution to some of the challenges of modern biomedical research. BMC Med Ethics. 2017;18:4. [PMID: 28122615] doi:10.1186/s12910-016-0162-910 CrossrefMedlineGoogle Scholar Author, Article, and Disclosure InformationAffiliations: Institute for Biomedicine, Eurac Research, Bolzano, Italy, and Uppsala University, Uppsala, Sweden (D.M.)Norwegian Research Center for Computers and Law and Centre for Medical Ethics, University of Oslo, Oslo, Norway (H.B.B.)Norwegian Institute of Public Health, Oslo, Norway (I.B.)Norwegian Research Center for Computers and Law, University of Oslo, Oslo, Norway (L.A.B.)University of Oxford, Oxford, United Kingdom, and University of Melbourne, Melbourne, Victoria, Australia (J.B., J.K.)University of Edinburgh, Edinburgh, United Kingdom (E.S.D.)Institute for Biomedicine, Eurac Research, Bolzano, Italy (C.F., V.M., C.P., P.P.P., A.R.)Institute for Biomedicine, Eurac Research, Bolzano, Italy; HUNT Research Center and K.G. Jebsen Center for Genetic Epidemiology, Norwegian University of Science and Technology, Levanger, Norway (K.H.)BBMRI-ERIC, Graz, Austria (M.T.M.)Harvard University, Boston, Massachusetts (D.R.O.)Center for the Study of Bioethics, University of Belgrade, Belgrade, Serbia (V.R.)KU Leuven and Leuven Institute for Human Genomics and Society, Leuven, Belgium (M.S.)Bond University, Gold Coast, Queensland, Australia (D.J.S.)University of Trento, Trento, Italy, and Free University of Bozen-Bolzano, Bolzano, Italy (M.T.)Norwegian University of Science and Technology, Trondheim, Norway (L.U.)Helmholtz Zentrum München and Technical University Munich, Munich, Germany (M.W.)Note: This article is based on work from European Cooperation in Science and Technology (COST) Action IS1303—Citizen's Health Through Public–Private Initiatives: Public Health, Market and Ethical Perspectives—supported by COST (https://www.cost.eu).Grant Support: Ms. Bentzen receives funding from the Research Council of Norway under the project Legal Regulation of Information Processing Relating to Personalized Cancer Medicine (grant 238999). Drs. Mascalzoni, Bygrave, and Kaye and Ms. Bentzen are supported by NordForsk (grant 81105) and the Economic and Social Research Council (part of United Kingdom Research and Innovation) under the project Governance of Health Data in Cyberspace. Dr. Budin-Ljøsne receives funding from Biobank Norway, which is funded by the Research Council of Norway (grant 245464). Dr. Mayrhofer receives funding from ADOPT BBMRI-ERIC (GA 676550). Mr. O'Brien receives funding from the U.S. National Science Foundation (grant CNS-1237235). Dr. Rakić receives funding from the Serbian Ministry of Education, Science and Technological Development (grant 41004). Dr. Shabani is supported by an FWO postdoctoral fellowship.Disclosures: Authors have disclosed no conflicts of interest. Forms can be viewed at www.acponline.org/authors/icmje/ConflictOfInterestForms.do?msNum=M18-2854.Corresponding Author: Jane Kaye, DPhil, HeLEX Centre for Health, Law and Emerging Technologies, Nuffield Department of Population Health, University of Oxford, Ewert House, Ewert Place, Summertown, Oxford OX2 7DD, United Kingdom; e-mail, jane.[email protected]ox.ac.uk.Current Author Addresses: Drs. Mascalzoni, Fuchsberger, Meraviglia, Pattaro, Pramstaller, and Rossini: Institute for Biomedicine, Eurac Research, Via Galvani 31, 39100 Bolzano, Italy.Ms. Bentzen and Dr. Bygrave: Norwegian Research Center for Computers and Law, Department of Private Law, Faculty of Law, University of Oslo, P.O. Box 6706, St. Olavs plass, 0130 Oslo, Norway.Dr. Budin-Ljøsne, Norwegian Institute of Public Health, P.O. Box 222, Skøyen, 0213 Oslo, Norway.Dr. Bell: Melbourne Law School, 185 Pelham Street, The University of Melbourne, Victoria, 3010, Australia.Dr. Dove: School of Law, University of Edinburgh, LG.12, Old College, South Bridge, Edinburgh EH8 9YL, United Kingdom.Drs. Fuchsberger, Meraviglia, Pattaro, Pramstaller, and Rossini: Institute for Biomedicine, Eurac Research, Via Galvani 31, 39100 Bolzano, Italy.Dr. Hveem: HUNT Research Center, Forskningsvegen 2, 7600 Levanger, Norway.Dr. Mayrhofer: BBMRI-ERIC, Neue Stiftingtalstrasse 2/B/6, 8010 Graz, Austria.Mr. O'Brien: Berkman Klein Center for Internet and Society, Harvard University, 23 Everett Street, 2nd Floor, Cambridge, MA 02138.Dr. Rakić: Center for the Study of Bioethics, Institute for Social Sciences, University of Belgrade, Kraljice Natalije 45, P.O. Box 605, 11000 Beograd, Serbia.Dr. Shabani: Center for Biomedical Ethics and Law, University of Leuven, Kapucijnenvoer 35, 3000 Leuven, Belgium.Dr. Svantesson: Faculty of Law, Bond University, Gold Coast, Queensland, 4229, Australia.Dr. Tomasi: Faculty of Law, University of Trento, Via Verdi 53, 38100, Trento, Italy.Dr. Ursin: K. G. Jebsen Center for Genetic Epidemiology, Department of Public Health and Nursing, Norwegian University of Science and Technology, Håkon Jarls gate 11, 7030 Trondheim, Norway.Dr. Wjst: Helmholtz Zentrum München, National Research Centre for Environmental Health, Institute of Lung Biology and Disease, D-85764 Neuherberg, Germany.Dr. Kaye: HeLEX Centre for Health, Law and Emerging Technologies, Nuffield Department of Population Health, University of Oxford, Ewert House, Ewert Place, Summertown, Oxford OX2 7DD, United Kingdom.Author Contributions: Conception and design: D. Mascalzoni, H.B. Bentzen, I. Budin-Ljøsne.Analysis and interpretation of the data: D. Mascalzoni, H.B. Bentzen, I. Budin-Ljøsne, L.A. Bygrave, J. Bell, E.S. Dove, K. Hveem, M.T. Mayrhofer, D.R. O'Brien, C. Pattaro, V. Rakić, M. Shabani, D.J.B. Svantesson, M. Tomasi, L. Ursin, M. Wjst, J. Kaye.Drafting of the article: D. Mascalzoni, H.B. Bentzen, I. Budin-Ljøsne, L.A. Bygrave, J. Bell, E.S. Dove, K. Hveem.Critical revision for important intellectual content: D. Mascalzoni, H.B. Bentzen, I. Budin-Ljøsne, L.A. Bygrave, J. Bell, C. Fuchsberger, K. Hveem, M.T. Mayrhofer, V. Meraviglia, C. Pattaro, P.P. Pramstaller, V. Rakić, A. Rossini, M. Shabani, M. Tomasi, M. Wjst, J. Kaye.Final approval of the article: D. Mascalzoni, H.B. Bentzen, I. Budin-Ljøsne, L.A. Bygrave, J. Bell, E.S. Dove, C. Fuchsberger, K. Hveem, M.T. Mayrhofer, V. Meraviglia, D.R. O'Brien, C. Pattaro, P.P. Pramstaller, V. Rakić, A. Rossini, M. Shabani, D.J.B. Svantesson, M. Tomasi, L. Ursin, M. Wjst, J. Kaye.Obtaining of funding: D. Mascalzoni, H.B. Bentzen, I. Budin-Ljøsne.Administrative, technical, or logistic support: D. Mascalzoni, H.B. Bentzen, I. Budin-Ljøsne.Collection and assembly of data: D. Mascalzoni, H.B. Bentzen, I. Budin-Ljøsne, L.A. Bygrave, J. Bell, E.S. Dove, K. Hveem, M.T. Mayrhofer, D.R. O'Brien, C. Pattaro, V. Rakić, M. Shabani, D.J.B. Svantesson, M. Tomasi, L. Ursin, M. Wjst, J. Kaye.This article was published at Annals.org on 19 February 2019.* Dr. Mascalzoni and Ms. Bentzen share first authorship. PreviousarticleNextarticle Advertisement FiguresReferencesRelatedDetailsSee AlsoBalancing Protection and Free Movement of Personal Data: The New European Union General Data Protection Regulation Heidi Beate Bentzen and Njål Høstmælingen Metrics Cited byAccelerating cancer omics and precision oncology in health care and research: a Lancet Oncology CommissionMust-have Qualities of Clinical Research on Artificial Intelligence and Machine LearningA Framework to Govern the Use of Health Data for Research in Africa: A South African PerspectiveIntegrating Technology in Neuropsychological AssessmentWhat ethical approaches are used by scientists when sharing health data? An interview studyExchange of Human Data Across International BoundariesWill the European Health Data Space change data sharing rules?Research Biobanks and External Researchers Under the European General Data Protection Regulation: Between Controller-Processor Relationship and Joint ControllershipData protection, data management, and data sharing: Stakeholder perspectives on the protection of personal health information in South AfricaOpen science and sharing personal data widely – legally impossible for Europeans?Open science, data sharing and solidarity: who benefits?Data Sharing Under the General Data Protection RegulationThe Impact of the GDPR on the Governance of Biobank ResearchData Management of Sensitive Human Proteomics Data: Current Practices, Recommendations, and Perspectives for the FutureChallenges of Genetic Data Sharing in African StudiesLegal and ethical framework for global health information and biospecimen exchange - an international perspectiveSociety for Immunotherapy of Cancer clinical and biomarkers data sharing resource document: Volume I—conceptual challengesSpecial Section on Ethics in Health InformaticsAre Public Repository Requirements Exacerbating Lack of Diversity?Sharing data safely while preserving privacyLeveraging European infrastructures to access 1 million human genomes by 2022The GDPR and the research exemption: considerations on the necessary safeguards for research biobanksConsent insufficient for data release 5 March 2019Volume 170, Issue 5Page: 332-334KeywordsBioethicsForecastingGeneticsGenomicsHealth economicsInternetPhenotypesPrecision medicinePrevention, policy, and public healthResearch funding ePublished: 12 February 2019 Issue Published: 5 March 2019 Copyright & PermissionsCopyright © 2019 by American College of Physicians. All Rights Reserved.PDF downloadLoading ...