Forty-two months on, progress towards a new approach to data regulation in Europe continues… Here’s an update following the Council of Ministers’ agreement on a final position.
In January 2012, the European Commission adopted its proposal for a General Data Protection Regulation (5853/12). The new Regulation is intended to replace the previous European law on data protection (Directive 95/46/EC). The regulation aims to protect individuals with regard to the processing of personal data and free movement of such data. The European Parliament adopted its first reading position on the proposals for a Data Protection Regulation on 12 March 2014. The Council of Ministers agreed their General Approach on 15 June 2015. The regulation now goes into trialogue negotiations, which began this month in an atmosphere of optimism, between the three European institutions, to agree on a compromise.
The first draft of the Regulation set out a framework in which individuals’ privacy could be protected, requiring specific and explicit consent for the use and storage of personal data. The Commission recognised that specific consent is not always possible in research and included exemptions, when subject to safeguards, for research (Article 83). We think these exemptions are necessary to ensure valuable medical research remains possible.
The European Parliament’s amendments significantly reduced these exemptions, prohibiting, or making impractical, the use and storage of personal data without specific consent (Article 81 and 83). The European Parliament’s position could stop or severely hinder some approaches to medical research. The Parliament version has been described by a colleague from the Medical Research Council as making medical research “at worst illegal, at best unworkable”.
If the Parliament’s position for stricter rules on consent for research is implemented, health research would be harmed. Obtaining specific consent when personal data is used would limit researchers’ ability to use such data. Safeguards already exist to keep checks on how personal data is used in research, in the form of ethics committees. If the use of personal data is prohibited, where gaining specific consent is not practicable, medical research may be slowed down in its endeavours to make the European population healthier.
On 15 June 2015, the Justice and Home Affairs Council agreed its General Approach on the entire Data Protection Regulation. The Council’s position keeps the exemptions for research from some of the data subject rights, with increased safeguards in place. This position is closer to the Commission’s version on research.