MEPs have agreed changes to the EU Data Protection Regulation which could hinder health research across Europe. But this isn't the end of the process; the Regulation will now be discussed by MEPs, the Council and Commission offering further opportunities to make changes. Groups supporting health research across Europe - including AMRC - are now looking at how they can ensure that the European legislators consider the impact on health research when agreeing the final framework.
In January 2012, the EU published its plans to reform European data protection laws. This included a regulation setting out a general EU framework for data protection. The proposals in this regulation cover the use of all personal data which includes patient data collected each time a person visits an NHS hospital or their GP. Patient data is a valuable resource for health research (more on how it is used here) so these proposals will have implications for health research.
When the detail came out, the proposals in the Regulation were pretty good for health research. Recognising that access to patient data is valuable for research, it included a "derogation" which provides an exception from some of the requirements of managing personal data when it is being used for scientific research. But there were a few areas where we wanted further clarification of the definitions used and the scope.
In January 2013, the Rapporteur leading the European Parliament's scrutiny of the Regulation published his report, recommending changes to the Regulation. He suggested tightening the derogations which allow data to be used for scientific research. If these proposals came into force, this would stop a lot of research using patient data underway in the UK at the moment.
We supported a joint statement explaining why these changes are bad news for research and recommending how the Regulation could better support research. And we held a workshop in Brussels bringing together researchers from across Europe to hear from the European Data Protection Supervisor, the European guardian of personal data protection - and discuss our concerns with the proposals. You can read a note of our discussions here.
What has happened?
MEPs laid amendments to the Regulation, which were considered by the Civil Liberties and Home Affairs (LIBE) committee last week. The Committee adopted several amendments which will have a serious negative impact on research using patient data if they pass into law. These were agreed in one go as a block of 85 so it's hard to tell what specifically MEPs were concerned about; there was a clear move to tighten up rules around data protection in the wake of the Edward Snowdon revelations.
What will be the impact of these changes if they pass into law?
These changes would signficantly hinder, or make impossible, much health research using personal data. In particular:
They would stop identifiable data from being used in research without consent.
Ideally consent will always be sought before any researcher considers using identifable data, but where research is important and it is not possible or practical to seek consent from everyone, there is a mechanism which allows researchers to apply to access identifiable data without consent. In the UK this decision is made by the Health Research Authority. This access has enabled research such as:
- Allowing researchers to obtain contact information for patients undergoing colonoscopy to invite them to take part in a follow up study
- Enabling researchers to study cancer care waiting times and effects on survival with a focus on the impact of socio-economic and ethnic inequalities in cancer care.
It would become much harder for studies seeking to use pseudonymised (or key-coded) health data in research without consent.
Many studies use key-coded data which can be linked with other sources of data and then, once joined-up, provided to researchers in an anonymised form.
For example this can allow researchers to join up data from both GP and hospital treatment to look at a patient's whole journey through the health system. They look at this in anonymised form as they are not interested in knowing who the patient is. And because researchers do not see any identifiable data and the key is held securely elsewhere, broad forms of consent are used to allow them to access this data.
The changes tighten this up, requiring more specific consent from each person who provides pseudonymised data to a research project unless the study can demonstrate a 'high public interest'. This change could impact on studies using data from the UK Biobank and the Clinical Practice Research Datalink, and potentially the new Genomics England.
The Regulation is expected to enter trilogue - negotiations between MEPs, the President of the Council (made up of ministers from each member state) and the commission - so there are further opportunities for it to be changed.
The original plan was for the EU to complete the revised data protection legislation by spring 2014, the deadline now is 2015. However elections for the European Parliament will take place in May 2014 and there is political pressure to pass these new laws before then.
What can medical research charities do?
A number of pan-European groups - including AMRC - are working together to raise concerns about the impact of these amendments on health research, including developing a joint statement.
Case studies of research which may be prevented by these changes are helpful to illustrate the impacts. The voice of patients - who are both concerned that their personal information be kept confidential but want research to go ahead to benefit themselves and others - will also be very valuable in the debate.
Medical research charities can play a key role in helping ensure all these nuances of the debate are heard. Do get in touch if you have any examples of research you are funding using patient data which you are concerned might be affected by these proposed changes.
This may also be an important issue to raise with MEP candidates ahead of the European elections in May 2014 as if they are successful, they will be in Europe voting on these changes. AMRC is working with our members to develop election messages and meet with UK candidates.