The current state-of-play
The GDPR represents the most progressive measure to protect individual privacy in twenty years, and is rapidly becoming a global baseline, considered by many as model legislation. The territorial reach of the regulation demonstrates what has been coined the “Brussels effect:” the capacity of the EU to forge sectoral standards as a condition of market access, which in turn are adopted by international and domestic firms to minimize burdens of pursuing separate compliance requirements. However, as an omnibus regulation, the general principles that apply to banking, private commerce and other forms of processing apply to publicly funded biomedical research, with some conditional exceptions. Since the GDPR’s enactment in May 2018, the biomedical science community has been caught in a metaphorical crossfire, struggling to find an admissible legal basis for long-term international data transfers.
International data transfers under the GDPR are particularly problematic for US federal agencies such as the National Institutes of Health (NIH), the single largest source of biomedical research support in the world. Presently, there are no international transfer mechanisms readily available to US federal agencies. EU counterparts are not pursuing international agreements or administrative arrangements under Article 46; standard contractual clauses, codes of conduct and certification mechanisms under Article 46 are not feasible for governmental bodies; and there is reluctance to make use of Article 49 derogations, which constitute exceptions to the main rules of data protection law in limited circumstances, in the absence of an adequacy decision or appropriate safeguards. US public agencies are unable to comply with Article 46 obligations, due to principles of sovereign immunity and statutory conflict. These include provisions specifying indemnification, judicial redress, auditing of data systems by a foreign entity and submitting to the jurisdiction of foreign courts. Article 46 transfer mechanisms have become even less flexible following the increased requirements for international transfers following the Schrems II decision.
The result is a system of distributed analysis: rather than share data in real time, highly productive groups such as the International Genomics of Alzheimer’s Project and others must run identical but isolated analyses, and then pool results using summary meta-analysis. The approach yields data of reduced scientific value, constrains the number of research questions that can be explored, is more costly, and inefficient.
As one stark example, research oncologists at NIH’s Clinical Center were unable to secure European donor samples from an established bone and marrow transplantation network to conduct hematopoietic stem cell transplantation therapy for patients under experimental treatment, for otherwise intractable cancers. The GDPR is not only a data issue per se but can have direct effects on patient care in a research setting.
Possible remedies
Greater interpretive clarity and responsible remedies are needed if the US and EU scientific communities are to pursue large initiatives toward curative treatments, diagnostics, and vaccines. GDPR transfer mechanisms must expand to resolve the unintended consequences on biomedical data sharing and incorporate scientific research as an explicit public interest.
Among available transfer mechanisms, frameworks modeled after Privacy Shield might potentially provide a legal basis for personal data transfer. A second prospect is the development of a bilateral or multilateral international agreement or administrative arrangement for use by US or third country public agencies and their affiliates and EU public bodies. A third would be to craft sector-specific contractual clauses, approved by the Commission, for use when sharing pseudonymous data with non-EU public agencies for scientific research purposes. Each may require augmentation of U.S. privacy legislation, including judicial redress for EU residents whose samples and data are processed in the US, among other safeguards.
A less robust option would be to make fuller use of the Article 49 derogation to the prohibition on international data transfers for transfers necessary for important reasons of public interest (Article 49(1)(d)). Last Fall, NIH concluded its lone data use agreement under the GDPR based on this exemption, resuming a 20-year partnership with the Finnish National Institute of Health and Welfare (THL) to identify susceptibility genes for Type 2 diabetes and associated traits.
An additional supportive measure may be to create a consistent standard of anonymization. The absence of well-defined metrics of identifiability has impeded data sharing due to concerns with non-compliance. Together with agreed standards, innovations in privacy enhancing technologies will reduce concerns that data subjects could be reidentified through linked molecular phenotypic and genotype datasets, inferential analytics, and imputation techniques.
In principle, and with sufficient political will, these seem workable propositions. Although the US and EU systems of data privacy protection evolved independently, they share identical core principles and safeguards enshrined in privacy law. This is reflected in the establishment of cooperative frameworks to protect privacy in the criminal justice context, such as the 2017 EU-U.S. Umbrella Data Protection Agreement. The same agreed principles could be extended to reach a sound legal basis for transatlantic scientific data flows in biomedicine and public health.
(This commentary does not represent an official Federal agency position and intended solely to stimulate discussion.)
