WP2 - Task 1 - Legal challenges with respect to laboratory-data sharing in the EU/EEA | UNITED4Surveillance

UNITED4Surveillance Grant Agreement Number 101102070 WP2 Outbreak detection – Task 1: Improving Laboratory Based-Reporting Legal challenges with respect to laboratory-data sharing in the EU/ EEA Disclaimer Copyright message This document was produced under the terms and conditions of Grant Agreement No. 101102070 for the European Commission. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or HaDEA. Neither the European Union nor the granting authority can be held responsible for them. © UNITED4Surveillance Consortium, 2025 This deliverable contains original unpublished work except where clearly indicated otherwise. Acknowledgement of previously published material and of the work of others has been made through appropriate citation, quotation or both. Reproduction is authorized provided the source is acknowledged. UNITED4Surveillance Grant Agreement Number 101102070 These data reflected the status as of April 2023. Following data validation rounds conducted after the kick-off workshop, the data has been updated as described in UNITED4Surveillance Deliverable report 2.1. Disclaimer This document was created in response to a discussion during the kick-off workshop for the Joint Action UNITED4Surveillance, Work Package 2 “Outbreak Detection”, Task 1 “Improving lab-based reporting” on 26 April 2023. A significant number of participants brought up that legal challenges with respect to lab-data sharing should be addressed also at EU/EEA level. The document describes some of these challenges, as were highlighted by the needs and gaps survey that was held, and subsequently offers some potential ways to address these challenges. The latter potential solutions in no way express the opinions of the countries that participated in the survey. Background Between 13 March and 12 April 2023, we conducted a survey to identify needs and gaps with respect to lab-based reporting within work package 2 “Outbreak Detection”. All 25 EU/ EEA countries that are part of the UNITED4Surveillance consortium were invited, of which 23 participated (response rate: 92%; see map with participating countries in blue). The survey consisted of five sections: (i) general, (ii) legal, (iii) policy and organizational, (iv) technical (data and IT) and (v) financial aspects. The following summary highlights identified legal constraints and challenges. Q6: Extent of legal challenges with lab-based data sharing for notifiable diseases Of the 23 respondents, 16 (70%) indicated to experience challenges or constraints to some or little extent, whereas two countries reported very large or large challenges. Challenges or constraints were defined as data deemed critical to meet objectives of lab-based surveillance cannot be shared legally. Challenges included no legal basis for sending data from laboratory to the National Institute of Public Health (NIPH), no legal basis for sending pathogen genetic sequence data from laboratory to NIPH, no legal basis for linking data from laboratories to notified case data. In such cases, the public disclosure of pathogen genetic sequence data, including e.g. a sample identifier – which makes it pseudonymized personal data – almost certainly also has no legal basis. Q7: Legal bases for processing of lab-based data by NIPH All countries considered the lab-based data personal data. The variation, in terms of how many and which of the legal bases listed in the General Data Protection Regulation (GDPR) Art 6.1 are applied in the participating EU/EEA countries, was very high. In the majority of countries (13/23; 57%), one legal basis applies which differed by country, followed by two legal bases in five countries (22%), three in four (17%) and four in one country, respectively (4%). UNITED4Surveillance Grant Agreement Number 101102070 Q10: NIPH assessment of the risk of identification of a person based on lab surveillance data To the question, whether the NIPH assesses the risk of identification of a person based on the lab surveillance data provided to the NIPH (i.e. risks to the rights and freedoms of data subjects) that is part of a Data Protection Impact Assessment (DPIA, GDPR Art 35.7.c), 11/23 countries (48%) conduct such an assessment in general, whereas 5 (22%) do not. Q11: Availability of legal expertise at NIPH to assist with setup & maintenance of lab surveillance Of the 23 respondents, 11 (48%) reported having sufficient legal expertise at the NIPH, followed by 8 (35%) that indicated having limited and 3 (13%) having no expertise, respectively. Q12: Examples how national or international legislation hampers or facilitates lab surveillance at national level Of the 23 respondents, 17 (74%) answered this free text question: • 10/17 (59%) reported that national legislation facilitates lab-reporting & data sharing • 4/17 (18%) reported challenges on data linkage o Not mandatory or allowed to share national identifier o Requires per-case authorization from specific health data protection bodies • 2/17 (12%) reported challenges on data sharing o Specific informed consent needed to share respiratory specimen with National Reference Laboratories (NRLs) or other labs o GDPR hinders sharing of sequence data where sequence ID is pseudonymized • 3/17 (18%) mentioned that international legislation facilitated lab surveillance o International COVID-19 reporting opened new avenues for reporting of other pathogens o European Center for Disease Prevention and Control (ECDC) guidance on notifiable diseases encourages voluntary participation of labs • 1/17 (16%) reported a discrepancy between EU and national legislation o EU Zoonosis Directive mandatory reporting vs. not allowed under national law Potential improvements to the legal basis The GDPR allows for national legislation to implement how personal data, including the special category of medical data, can be processed in the public interest, as is the case for public health of infectious diseases. National legislation may well date from a time when lab data was less important for preventing and controlling infectious diseases (e.g. positive or negative result only, implicit in case notification data), or was often generated centrally at the NIPH and did not need to be transferred. This changed substantially with the UNITED4Surveillance Grant Agreement Number 101102070 advent of (cheap) genetic sequencing of the pathogens, where also the public sharing of these data gained importance since infectious diseases do not respect administrative borders. The survey highlighted that several countries experience challenges with sharing of lab-based data. Here we provide suggestions for potential improvements in the short and long term. Today’s standard of preventing and controlling of infectious diseases requires that pseudonymized clinical microbiology laboratory data can legally be processed at national level, by the national public health agency or equivalent, on the legal basis of a task carried out in the public interest (GDPR Art 6.1.e). To what extent these data are actually generated and shared in practice at national level – e.g. depending on available resources – remains an additional and separate issue. The potential adaptation of EU or national legislation to improve public health is normally a time-consuming process. However, progress can potentially also be made in addition to such adaptations. A fifth of the respondents currently do not assess the risk of identification of an individual based on lab surveillance data (see Q10) and about half of the respondents reported having limited or no legal expertise at the NIPH to assist with setup and maintenance of lab surveillance (see Q11). One concrete suggestion would therefore be to organize trainings for legal professionals specifically on the legal aspects of public health, including the sharing of personal data and the special categories needed for public health (health data, sexual preference, genetic information). In its most accessible form, this could be e.g. a freely accessible tutorial on e.g. the ECDC Virtual Academy, while more in-depth training courses could be organized as well. Such trainings may be useful for epidemiologists and microbiologists as well. Since there can be unclarity on e.g. which legal basis can be used for laboratory-based surveillance, it may be good to conduct an assessment at EU level of what is actually allowed under the GDPR and e.g. what jurisprudence and European Data Protection Supervisor guidance exists. For instance, an assessment could be made – if not already done – of how the rights and freedoms of individuals could or would be infringed by national-level processing of limited (pseudonymized) personal data, along with microbiological data on the pathogen they are infected with, for the purpose of prevention and control of infectious diseases. In other words, what is the probability and impact of identification of an individual based on these data and for a different purpose than intended. A second need would be a common assessment of how not processing these data, or processing only anonymized data at national level, would harm the public interest. A third need would be a common assessment of how the balance between public interest and individual rights and freedoms can reasonably be struck. Finally, the legal basis for sharing of these data, or subsets thereof, in public databases such as European Nucleotide Archive (ENA), Sequence Read Archive (SRA) or Global Initiative on Sharing All Influenza Data (GISAID), should also be clarified. Since infectious diseases have different incidences, severity, transmission modes (some associated with e.g. sexual preference, a special category of personal data) and potential for outbreak, such assessments should likely be performed by individual disease and aetiological agent. In addition, those assessments would need to consider the nature and extent of the personal data elements that would need to be shared for each disease to reach sufficient added value for public health. While this is a complex endeavour requiring both public health and legal experts, an expert opinion on this matter that can e.g. subsequently be taken into account by the EU as well as national data protection supervisors, and individual legal experts, could well be of high value for many countries while waiting for potential improvement of legislation.