Safeguarding personal data: International collaboration and sharing of data on health research (2021)

The era of omics data and computing has opened and will still open new possibilities for analyzing health data to search for disease mechanisms and evaluate treatment. Biomedical and biological data need to be linked to information about the person from which it originates, in order to achieve its full potential for research and evaluation of treatment. The basis for using such data and biological material is an informed consent from the person who provides the data and agreement between the researcher and the person providing the data and material, with regard to what it will be used for, as well as how the data and information are safeguarded.

Medical research and researchers, and maybe more in the cancer field than in other disciplines, constitute an international collaborative endeavor where networks across national borders are fundamental. This raises issues on how data regarding the individual can be protected in accordance with rules and regulations as well as the agreement between the researcher and participant in the study. The law governing such an agreement is the law in the country where the agreement was made and signed. Care must be taken to protect personal data and the identity of the person signing into a clinical trial. Combining with other data, e.g. socioeconomic information, the risk of inadvertently being able to identify a person rises.

The differences on safeguarding personal data in different legislations within and between the EU and the US have had several implications. The basis in the EU is the GDPR (General Data Protection Regulation)¹ that went into effect in 2018. A fundamental challenge is the statutory conflicts between GDPR and the legislation of other countries. For example, US federal institutions are protected by sovereign immunity with the implication that non-US citizens cannot sue such institutions in case of illegal use of their data.³

The collaboration between national institutes of health and EEA countries is immense; in 2019 there were 5000 ongoing projects, of which 100 were of Norwegian origin. ^{4, 5} While these projects are affected, some that do not require new data transfers have still been able to finish. What is perhaps more serious is the inability to find transfer mechanisms for new research projects.

The Schrems II judgement in the European court and new guidance from the European Data Protection Board have added both clarity and complexity to the challenges. The Norwegian research infrastructure for health data, “Helseanalyseplattformen”,⁶ that had intended to use an American cloudbased solution is currently put on pause as a consequence of the incompatibility between US and European legislations.

The implications for the long research ties between the EU and the US are disturbing and has resulted in a joint report and statement from three umbrella organizations of academies of sciences, European Academies of Science Advisory Council (EASAC), Federation of the European Academies of Medicine (FEAM) and All European Academies (ALLEA). ⁷

During the last years, there is an increasing trend from journals that data should be published along with the paper itself. In this context, it is important to remember that the regulations governing such publications for researchers in the EEA area are those of the GDPR and not those of the country of the editorial office. ³

Traditionally, genomic data have attracted most focus when it comes to be safeguarded and protected as personal data. Proteomics data have to a large degree been entered into open and accessible databases. However, with refined and improved tools for analyses, a discussion is emerging on how to safeguard personal data also when using this technology since “Plasma proteomes can be re-identifiable and potentially contain personally sensitive and incidental findings” as to whether also proteomics data need to be treated
more in line with genetic data. ⁹

Safeguarding personal data is important and the basis for trust between patients and researchers and need to be guarded carefully. The solution lies with the politicians to find agreements that balance personal data protection and advancement of science. Such advancement is a basis for health care and welfare of their citizens and occurs in a process which also involves international
collaboration.

^REFERENCES:

1. ^{EUR-Lex - 32016R0679 - EN - EUR-Lex (europa.eu)}
2. ^{European Parliament on Schrems II The CJEU Judgement in the Schrems II Case (europa.eu)}
3. ^{Ursin, G. & Bentzen, H.B.. Open science and sharing personal data widely – legally impossible for Europeans? Acta Oncologica 60, 12,1555-1556, 2021 https://doi.org/10.1080/0284186X.2021.1995894}
4. ^{Eiss, R.. Confusion over data-privacy law stalls scientific progress. Nature, Vol 584, p. 489, 2020 d41586-020-02454-7.pdf (nature.com)}
5. ^{Implications of GDPR for US-EU Cooperation in Biomedical Science Observations from the US National Institutes of Health (iscintelligence.com)}
6. ^{Setter arbeidet med Helseanalyse-plattformen på pause - ehelse}
7. ^{International Sharing of Personal Health Data for Research. European Academy of Sciences Advisory Council report.}
8. ^{Heidi Beate Bentzen H.B., Castro, R., Fears, R., Griffin, G., ter Meulen, V. & Ursin, G. Remove obstacles to sharing health data with researchers outside of the European Union. Nature Medicine 27(8):1329-1333, 2021. doi: 10.1038/s41591-021-01460-0.}
9. ^{Geyer, P. E. , Mann, S.B., Peter V. Treit, P.T & Mann, M. Plasma Proteomes Can Be Reidentifiable potentially Contain Personally Sensitive and Incidental Findings. Molecular and Cellular Proteomics. 20, 100035, 2021 DOI:https://doi.org/10.1074/mcp.RA120.002359}

CCBIO Opinion. Text: Rolf Reed, CCBIO Strategic Advisor