EPF welcomes the New Data Protection Agreement

On 15 December, the Council and the European Parliament reached a compromise on the Data Protection Regulation. Overall EPF welcomes this agreement which is positive for research and also grants more right to patients and other data subjects who share their information for research or health related purposes.

A positive compromise acknowledging the value of research

As highlighted in December by the European Data in Health Research Alliance, the compromise is on the whole positive for research and addresses concerns regarding consent rules. Indeed while informed specific consent remains the rule in research, some exemptions are needed. The compromise allows researchers to collect and process data without specific consent, provided other appropriate safeguards (e.g. pseudonymisation) are in place to protect the privacy of subjects.

The text also recognises the value of registries for health research (recital 51), but doesn’t set specific provisions to encourage cooperation between Member States to remove obstacles to the setting up of patient registries as called for by EPF.

The compromise also makes secondary use of health data for research purpose lawful (Article 5).  EPF welcomes this as health data collected primary for health care or other purpose can be an important source of data to advance health research.

Better rights for patients, with some limitation

The regulation provides new rights for patients to access the data that is being used, to have a copy of it, to have their data rectified, or to object to the processing. Data controllers also have more obligations to provide information about the use of patients’ data.

In our position, EPF advocated for free access to medical records. The compromise text explicitly mentions the right to access one’s own medical record (recital 51). Access to information should be free of charge if it is at a “reasonable interval,” otherwise controllers have the right to apply a “reasonable fee” (Article 12). While the interpretation of “reasonable interval” will require monitoring, we welcome the Regulation as a step forward.

Some derogations have been put in place for research, with regard to the right to be forgotten or the right to information, when it could undermine research activities. When deemed necessary, Member States may also create derogations from data subject rights to access or rectify their data and the right to object (Article 83).

While EPF agrees some derogations are needed and welcomes the wording which limits derogation to what is justified, adoption of specific exemptions at national level may lead to different rights across the European Union for patients. Monitoring the implementation of the Regulation once it is officially adopted will be key to ensure derogations are proportionate.

“EPF has worked together with the non-profit researcher community during this debate to ensure that patients can share their data for research, with adequate protection. We welcome that the final Regulation reflects this” said Nicola Bedlington, EPF Secretary General.

The final text is foreseen to be adopted in the first half of 2016.

Contact: Laurène Souchet, EPF Policy Advisor, laurene.souchet@eu-patient.eu