Council on data protection: Uncertainties on patients’ rights

The Council adopted a partial general approach on Data protection on 15 June 2015. Following this, a trilogue process with the European Parliament was launched in July in order to come to a final agreement within the next few months. For patients, it is important that the Regulation reaches a balanced approach, protecting their privacy rights, and allowing data processing^[1] to continue for healthcare, public health and research purposes.

In a nutshell

The Council has taken into account the view that some exemptions are needed from the obligation to always ask patients for their specific consent for health research. EPF advocated for this alongside non-profit research and public health NGOs in the “Data Saves Lives” Campaign. Without such provisions, key research projects could have been hampered.

However, EPF also notes that provisions proposed by the Council leave many uncertainties on patients’ rights as regard access to their data, information and transparency.

On the provision regarding always seeking specific consent for scientific purpose (Recitals 25aa, 42, 42a), EPF maintains that informed consent should be the rule but we agree exemptions are sometimes needed, provided there are  other safeguards in place.

The Council also took into account our call to specifically mention registries and explain their importance (Recital 125aa). However, the exact legislative provisions on registries are not yet clearly laid out. In EPF’s perspective, the Regulation should ensure member states cooperate to facilitate the setting up of joint registries when needed.

A strong caveat is that the proposal leaves the possibility for member states to adopt further legislation on health and genetic data (Article 9(5)). While we believe setting safeguards for patients is a priority, we would have preferred more harmonised provisions at EU level in order to facilitate research cooperation between member states.

To balance this, we believe more clarity and transparency on provisions that apply in different member states is needed for organisations that participate of lead health research projects, including patient organisations.

Gaps on patients’ rights

The draft regulation on data protection aims at improving the rights of EU citizens as regards access to their own data, and information on how their data are used.

Access to one’s own health record is a key concern for patients. But we still face obstacles that prevent us from accessing our health information, such as fees or extensive rights of health professionals to retain information.

While we welcome that the Council specifically mentions the right to access medical records, we believe this access should be provided for free to patients. Besides the Council proposes that access should be provided “at reasonable intervals”, but patients with chronic and long term conditions may have more frequent needs to access their health data to manage their conditions,.  We therefore believe thee reasonable intervals should be removed, or clear criteria should be established on what ‘reasonable’ means, taking into accounts the needs of different groups.

Furthermore, EPF does not support Article 83 (1) in its current wording as it leaves uncertainties on patients’ rights to information about processing of their data, their right to access, and to modify or have the data erased when it comes to research.

While we agree exemptions may sometimes be needed for research, we think they need to be better defined and justified. For example, administrative burden should not be a sufficient reason not to apply these rights.

No agreement on key parts

 

The Council has not reached an agreement on articles linked to the processing of personal data for health purposes, the processing of genetic data, and the exemption for scientific purposes (Articles 81, 81a and 83 (3)).

EPF has previously highlighted various issues in these areas from the patients’ perspective which we believe EU institutions should take into account (read EPF statement on the Commission’s proposal).

No agreement was reached on obligations for data controllers to have transparent policies regarding processing of personal data, and data subjects’ rights. EPF strongly support such transparency provisions as this information could contribute to empower patients.

“EPF is strongly committed to continue bringing the patients’ voice into this debate to ensure the final Regulation reaches the right balance for patients and for research. It is patients’ privacy, and patients’ health that is at stake” concludes EPF Secretary General Nicola Bedlington.

Contact: Laurène Souchet, EPF Policy Officer, laurene.souchet@eu-patient.eu