Viewpoin
B idging he Eu opean Da a Sha ing Di ide in Genomic Science
F uzsina Molná -Gábo 1, JD, PhD; Michael J S Beau ais2,3, BA, BA (Ju isp udence), BCL, JD, MSc; Alexande
Be nie 2, BCL, JD, LLM; Ma ia Pila Nicolas Jimenez4, JD, PhD; Mikel Recue o4, LLB, JD, LLM; Ba ha Ma ia
Knoppe s2, BA, LLB, BCL, MA, DLS, PhD
1Facul y o Law, Uni e si y o Heidelbe g, Heidelbe g, Ge many
2Cen e o Genomics and Policy, Facul y o Medicine and Heal h Sciences, McGill Uni e si y, Mon eal, QC, Canada
3Facul y o Law, Uni e si y o To on o, To on o, ON, Canada
4Resea ch g oup in social and legal sciences applied o he new echnosciences IT 1541-22, Facul y o Law, Uni e si y o he Basque Coun y, Basque
Uni e si y Sys em, Bilbao, Spain
Co esponding Au ho :
F uzsina Molná -Gábo , JD, PhD
Facul y o Law
Uni e si y o Heidelbe g
BioQuan Cen e
Im Neuenheime Feld 267 (BQ267)
Heidelbe g, 69120
Ge many
Phone: 49 62215451 ex 336
Email: uzsina.molna -gabo @uni-heidelbe g.de
Abs ac
In his iewpoin , we a gue o he impo ance o c ea ing da a spaces o genomic esea ch ha a e de ached om con ex s in
which undamen al igh s conce ns ela ed o su eillance measu es o e ide a pu pose-speci ic balancing o undamen al igh s.
Genomic esea ch elies on molecula and pheno ypic da a, on compa ing indings wi hin la ge da a se s, on sea chable me ada a,
and on ansla ing esea ch esul s in o a clinical se ing. These me hods equi e sensi i e gene ic and heal h da a o be sha ed
ac oss bo de s. In e na ional da a sha ing be ween he Eu opean Union (EU) o he Eu opean Economic A ea and hi d coun ies
has acco dingly become a co ne s one o genomics. The EU Gene al Da a P o ec ion Regula ion con ains ules ha acco d
p i ileged s a us o da a p ocessing o esea ch pu poses o ensu e ha s ic da a p o ec ion equi emen s do no impede biomedical
esea ch. Howe e , he Gene al Da a P o ec ion Regula ion ules applicable o in e na ional ans e s o da a acco d no such
p e e en ial ea men o in e na ional da a ans e s made in he esea ch con ex . The ules ha go e n he in e na ional ans e
o da a c ea e conside able ba ie s o in e na ional da a sha ing because o he cos -in ensi e p ocedu al and subs an i e compliance
bu dens ha hey impose. Fo ce ain ju isdic ions and selec use cases, he e exis p ac ically no law ul mechanisms o enable
he in e na ional ans e o da a because o conce ns abou he p o ec ion o undamen al igh s. The p oposed solu ions u he
ail o add ess he need o sha e la ge da a se s o local and egional coho s ac oss na ional bo de s o enable join analyses. The
Eu opean Heal h Da a Space is an eme ging ede a ed, EU-wide da a in as uc u e ha is in ended o unc ion as an in as uc u e
b inging oge he EU heal h da a o imp o e pa ien ca e and enable he seconda y use o heal h- ela ed da a o esea ch pu poses.
Such in as uc u e is implemen ing new ins i u ions o suppo i s unc ioning and is being implemen ed in eliance on a new
enabling law, he egula ion on he Eu opean Heal h Da a Space. This inno a ion p o ides he oppo uni y o acili a e EU
con ibu ion o in e na ional genomic esea ch e o s. The d a egula ion o his da a space p o ides o a concep o da a
in as uc u e in ended o enable c oss-bo de da a exchange and access, including access o gene ic and heal h da a o scien i ic
analysis pu poses. The d a egula ion also p o ides o obliga ions o na ional ac o s aimed a making da a widely a ailable.
This e o is laudable. Howe e , in he absence o u he , mo e undamen al changes o he manne in which he EU egula es
he seconda y use o heal h da a, i is easonable o belie e ha EU pa icipa ion in in e na ional genomic esea ch e o s will
emain impeded.
(J Med In e ne Res 2022;24(10):e37236) doi: 10.2196/37236
KEYWORDS
in e na ional da a ans e ; scien i ic esea ch; genomics; sa e da a spaces; da a p o ec ion
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 1h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
The Gene al Da a P o ec ion Regula ion
Hu dle o In e na ional Genomic
Resea ch
The launch o many la ge-scale mul ina ional esea ch p ojec s
o e he pas 2 decades exempli ies he impo ance o
in e na ional da a sha ing in genomics and omics esea ch [1,2].
C oss-ma ching da a be ween cen e s, es ablishing la ge
communi y e e ence da a collec ions, and accessing ex e nal
e e ence da a se s enhances he unde s anding o human biology
and disease and bene i s ansla ional s a i ied medicine.
Thus, da a p o ec ion issues ela ed o in e na ional da a sha ing
a e inex icably linked o genomic esea ch. Fu he mo e, whe e
da a p o ec ion issues a e conside ed in an in e na ional con ex
bu wi h Eu opean Union (EU) in ol emen , e e ence o he
EU Gene al Da a P o ec ion Regula ion (GDPR) [3] becomes
una oidable.
This egula ion is pe cei ed o hinde a he han p omo e
c oss-bo de da a sha ing a he in e na ional le el [4]. The main
objec i e o he GDPR is o c ea e nuanced ules ha balance
he bene i s and isks o p ocessing pe sonal da a and p o ec ing
indi idual in e es s. The in e na ional da a ans e mechanisms
o he GDPR ac o ensu e ha he obliga ions applicable
acco ding o EU da a p o ec ion law con inue o be applied a e
he da a a e ans e ed ou side he EU and he Eu opean
Economic A ea, including he p opo iona e balancing o
bene i s and ha ms.
Regula o s and cou s o en deem unlaw ul ou bound ans e s
o da a om he EU and Eu opean Economic A ea o hi d
coun ies ha implemen conside able S a e su eillance
measu es. Such legal de e mina ions ac as a unc ional ba o
he ou bound ans e o genomic da a o EU and Eu opean
Economic A ea p o enance o such hi d coun ies. Fu he mo e,
such a legal de e mina ion places on p ospec i e da a ans e o s
he conside able bu den o assessing he S a e su eillance
p ac ices o hi d coun ies be o e pe o ming in e na ional da a
ans e s in a o he eo . This heigh ens he complexi ies and
compliance cos s inhe en in pe o ming ou bound da a ans e s
om he EU and he Eu opean Economic A ea o hi d
ju isdic ions.
Thus, any conce ns abou undamen al igh s a ising in a hi d
coun y in ela ion o su eillance ac i i ies ca ied ou by public
au ho i ies in luence he assessmen o he le el o p o ec ion
in ha coun y and lead o i s ules being ound disp opo iona e
o e en dis ega ding he co e o he undamen al igh s
conce ned. This p ac ice p ecludes ou bound ans e s o
genomic da a om being pe o med unless signi ican poli ical
changes a e made o he policing and su eillance p ac ices o
hose hi d coun ies [5]. Al hough i is c ucial o aise he le el
o da a p o ec ion in ela ion o he su eillance ac i i ies o
S a e ac o s om a undamen al igh s pe spec i e, his is a
long- e m endea o . Un il his is achie ed, da a sha ing o
socially signi ican pu poses such as scien i ic esea ch will
decline. Remo al o hese conside able ba ie s o da a sha ing
in genomic esea ch is con ingen on poli ical de e mina ions
ha a e ou side he scope o ac i i ies o scien i ic esea ch
communi ies.
In his pape , we a gue o he impo ance o c ea ing da a spaces
o enable in e na ional collabo a ion in he use o genomic da a.
These da a spaces should be de ached om con ex s in which
undamen al igh s conce ns ela ed o su eillance measu es
o e ide a pu pose-speci ic balancing o undamen al igh s and
o he bene i s and isks o p ocessing pe sonal da a and
p o ec ing indi idual in e es s. Fi s , we assess he ele an
p o isions o he GDPR and de ail hei implica ions o da a
expo e s and impo e s. Second, we ou line how S a e
su eillance p ac ices can a ec he po en ial o esea che s o
sha e genomic da a. Thi d, we add ess he undamen al igh s
con ex o scien i ic esea ch. Fou h, we analyze possible
solu ions ha would enable genomic da a o be ans e ed o
esea che s in coun ies ou side he EU and he Eu opean
Economic A ea wi hou in e na ional consensus being achie ed
on issues o S a e su eillance. Con ac ual issues a e i s
discussed, ollowed by secu e da a spaces. This s uc u e allows
us o add ess he challenges o in e na ional da a ans e s in
he cu en legal si ua ion in de ail, iden i y he main p oblems,
and, on his basis, conside which solu ions could p o ide a
emedy, also in he con ex o u he cla i ica ion o he
co ne s ones o he Eu opean Heal h Da a Space (EHDS).
Backg ound: GDPR T ans e Rules
In his sec ion, we desc ibe in conside able de ail he
in e na ional da a ans e ules o he GDPR. This discussion
p o ides he necessa y con ex in aming he challenges ha
he in e na ional da a ans e ules c ea e o genomic
esea che s. This desc ip ion is necessa y o demons a e how
ou p oposed solu ion esponds o he needs o scien i ic
esea che s and would also mee he demands o EU and
Eu opean Economic A ea da a p o ec ion egula o s.
The main legal mechanism by which pe sonal da a may be
ans e ed om he EU and he Eu opean Economic A ea o a
hi d coun y o scien i ic esea ch pu poses is a decision o
he Eu opean Commission con i ming he adequacy o he le el
o da a p o ec ion in he ecipien coun y.
The Eu opean Commission is esponsible o de e mining
whe he a hi d ju isdic ion is adequa e. Once a ju isdic ion has
been deemed adequa e, ou bound ans e s o da a o ha hi d
ju isdic ion can be made wi hou addi ional legal compliance
e o s being equi ed. I he des ina ion o an in e na ional da a
ans e is no subjec o an adequacy decision, addi ional
measu es enabling legal compliance mus be implemen ed be o e
he ou bound ans e is pe o med.
The ollowing c i e ion is used o de e mine whe he a hi d
ju isdic ion can be deemed adequa e. An adequa e le el o da a
p o ec ion equi es ha he hi d coun y ensu e, by i ue o
i s domes ic legisla ion and in e na ional commi men s, a le el
o da a p o ec ion “essen ially equi alen ” o ha gua an eed in
he EU [6].
This does no mean ha an iden ical le el o p o ec ion is
equi ed. The me hods used o p o ec da a by he hi d coun y
may di e om hose used in he EU, bu such me hods mus
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 2h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
ne e heless p o e e ec i e in p ac ice [7]. The GDPR also
de ines ules guiding he assessmen o adequacy as o whe he
he essence o he undamen al igh o da a p o ec ion is
espec ed and whe he i s limi a ion is subjec o he p inciples
o necessi y and p opo ionali y.
The ex o he applicable laws in he conce ned ju isdic ion is
no he sole c i e ion assessed in pe o ming his e alua ion.
Indeed, he p ac ices o au ho i ies, adminis a i e bodies, and
cou s in he coun y o des ina ion a e o equal ele ance in
assessing whe he adequacy s a us can be law ully con e ed.
Decisions o he Eu opean Commission es ablishing p i a e
sec o a eas in he Uni ed S a es as adequa e o he pu pose o
ecei ing da a ans e s om he EU ha e been annulled wice
by he Cou o Jus ice o he EU (CJEU). This cou is he
p incipal cou ha is esponsible o in e p e ing he
undamen al igh o da a p o ec ion in he EU [5,6]. The
annulmen o hese decisions was oo ed in conce ns abou he
undamen al igh s o da a p o ec ion, espec o p i a e li e,
and e ec i e emedies (ie, he a ailabili y o ed ess
mechanisms o a ec ed pa ies) as de ined by he EU Cha e
o Fundamen al Righ s, a legally binding ca alog o human
igh s applicable in he EU (c A icle 7: Respec o p i a e
and amily li e, A icle 8: P o ec ion o pe sonal da a, and
A icle 47: Righ o an e ec i e emedy and o a ai ial). In
his decision, he CJEU concluded ha he su eillance p ac ices
o US au ho i ies and he lack o ed ess a ailable o EU ci izens
ela i e he e o iola ed he a o emen ioned human igh s
gua an ees [8].
The e o e, in summa y, he Eu opean Commission is esponsible
o asc ibing adequacy s a us o coun ies ou side he EU and
he Eu opean Economic A ea. This equi es he Eu opean
Commission o de e mine ha he conce ned ju isdic ion
p o ides da a p o ec ion gua an ees essen ially equi alen o
hose a ailable in he EU.
Recen adequacy decisions po end a change om a ela i ely
lenien adequacy analysis o a mo e s ingen e alua ion ha
equi es he legisla ion and adminis a i e p ac ices in he
conce ned ju isdic ion o mi o hose in he EU. This is seen
e y clea ly in he case o Japan [9]. In Japan, he adequacy
decision o he Eu opean Commission ela ed only o he p i a e
sec o , conside ing ha o e sigh mechanisms in da a p o ec ion
law di e in hei design in he p i a e and public sec o s. Such
es ic ions on he scope o adequacy can be unde s ood as a
s ong indica o ha sec o -speci ic e alua ions o o eign da a
p o ec ion legisla ion will, in he u u e, be used o con e
adequacy s a us on a sec o -speci ic o s a u e-speci ic basis
a he han on a na ional basis. Gi en he igo and g anula i y
o ecen Eu opean Commission adequacy analyses, i is no
su p ising ha he le el o da a p o ec ion is cu en ly con i med
by an adequacy decision o he Eu opean Commission in only
13 coun ies and e i o ies a ound he wo ld [10].
Implica ions o he GDPR T ans e
Mechanisms o Da a Impo e s and
Expo e s
I da a a e ans e ed om he EU o he Eu opean Economic
A ea o a ju isdic ion ha is no subjec o an adequacy decision,
a dis inc legal mechanism mus be implemen ed o ensu e he
law ulness o he da a ans e . The le el o da a p o ec ion in
he hi d coun y mus be examined no only in he case o an
adequacy decision bu also when he in e na ional da a ans e
is based on ano he ans e mechanism es ablished in he GDPR
[5]. The ca ego ies o a ailable ans e mechanisms include
he imposi ion o addi ional sa egua ds ha main ain he
s anda d o da a p o ec ion in he EU and he Eu opean
Economic A ea, which a e exhaus i ely enume a ed in he ex
o he GDPR. A he ime o w i ing, he only ans e sa egua d
ha has been de eloped in a s anda dized manne a e he
S anda d Con ac ual Clauses. These S anda d Con ac ual
Clauses equi e ans e o s o in eg a e s anda d- o m con ac ual
language in o hei da a ans e ag eemen s, which imposes
nume ous GDPR-de i ed compliance- ela ed obliga ions on
he ecipien s o he da a ans e , e ec i ely app oxima ing he
ex a e i o ial applica ion o he GDPR. The o he ans e
mechanism is a con ex -speci ic de oga ion om he applica ion
o he GDPR o enable a speci ic ans e ha could no
o he wise be pe o med in compliance wi h he equi emen s
o he GDPR. The e is a conside able ange o de oga ions ha
a e po en ially ele an o in e na ional ans e s o genomic
da a. Howe e , hese de oga ions a e in ended o enable pe sonal
da a o be ans e ed ou o he EU o he Eu opean Economic
A ea on an ad hoc, excep ional basis. The e o e, S anda d
Con ac ual Clauses a e he only eal mechanism ha could a
p esen enable con inuous, ongoing in e na ional ans e s o
pe sonal da a o ju isdic ions ha do no bene i om an
adequacy decision.
Sende s and ecipien s o pe sonal da a who base hei da a
exchange on con ac ual clauses such as he S anda d
Con ac ual Clauses o he Eu opean Commission a e also
obliged o e i y be o e each ans e whe he he le el o da a
p o ec ion secu ed unde EU law is me in he ecipien coun y.
Acco dingly, he S anda d Con ac ual Clauses can only be
d awn on o secu e in e na ional da a ans e s i he na ional
legisla ion in he coun y o da a impo allows he da a ecipien
esea che o comply wi h he con ac ual p o isions [11].
Howe e , i is unclea whe he his can ealis ically succeed.
Resea che s canno bind hemsel es o ules con adic ing hei
obliga ions unde domes ic law, such as equi emen s o disclose
da a o local au ho i ies. Fu he mo e, in some coun ies—such
as he Uni ed S a es— esea che s a e o en subjec o legisla ion
ha p e en s hem om signing he S anda d Con ac ual
Clauses. In addi ion, hei po en ial o enhance da a subjec s’
p o ec ion by, o ins ance, es ablishing ins i u ional complain
mechanisms has only a limi ed e ec on he ac ual imp o emen
o he undamen al igh s p o ec ion o hose a ec ed i
adminis a i e and judicial emedies in he conce ned
ju isdic ion canno sa egua d he undamen al igh s o EU
ci izens. Hence, e en he ecen call o special con ac ual
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 3h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
clauses o he scien i ic esea ch p ocessing sec o [12] alls
la i he egula o y en i onmen does no secu e a compa able
le el o undamen al igh s p o ec ion o he da a subjec
equi alen o ha o he GDPR. In his case, he conce ned
sec o canno be deemed adequa e as o he applicable ules
( ela ed o compliance wi h na ional su eillance mechanisms)
p eclude esea che s om con ac ually binding hemsel es o
e ms ha app oxima e hose o he GDPR. As a consequence,
esea ch endea o s in ol ing a ans e o pe sonal da a om
he EU o he Eu opean Economic A ea o he Uni ed S a es
o en canno be implemen ed in many cases, such as sending
deiden i ied human gene ic da a o he Impu a ion Se e hos ed
by he Uni e si y o Michigan o pooling pe sonal da a on a
single se e as en isaged by he In e na ional Alzheime ’s
Conso ium and he US-based Alzheime ’s Disease Sequencing
P ojec [13].
Pe o ming an assessmen o he law and p ac ice o he
ju isdic ion o a des ina ion is e e ed o in he li e a u e as a
“mini-adequacy decision” [14]. Wi h each ans e , da a
expo e s a e equi ed o conside he ease o access o da a by
go e nmen ac o s, he possibili y o he simpli ied exe cise
o igh s and e ec i e emedies o b each he eo , and whe he
he des ina ion o he ans e is go e ned by he “ ule o law.”
Pe o ming such an analysis in indi idual cases and moni o ing
changes in local law and go e nmen p ac ices is likely o
exceed he capabili ies o esea che s expo ing da a, who a e
obliga ed o pe o m he es in he i s place. The e is s ill no
help ul guidance on how da a con olle s esponsible o
de ining he pu poses and essen ial means o da a p ocessing
a e supposed o pe o m a ask ha he Eu opean Commission
has ailed o ackle on mo e han one occasion, as e idenced by
he annulmen o i s adequacy decisions by he CJEU. Shi ing
he bu den o an all-encompassing assessmen o a hi d
coun y’s legal sys em o expo e s o da a migh lead o
quasi-a bi a y e alua ions as well as o di e gences in he
applica ion o he adequacy c i e ia om one ano he [15]. I
hese e alua i e exe cises a e ca ied ou poo ly, i could lead
o he e osion o he undamen al igh s o he a ec ed EU
ci izens. This could ake a long ime o emedy as he CJEU is
he only body compe en o do so, and i equi es mo e han a
yea o decide cases [16].
Do Anonymiza ion o Secu i y Measu es
O e a Solu ion?
Acco ding o he Eu opean Da a P o ec ion Boa d, he g oup
o na ional supe iso y au ho i ies in e p e ing he GDPR, any
anonymiza ion mus be comple ely i e e sible. Some u he
conside ha anonymiza ion mus be u u e-p oo such ha
anonymiza ion is impe ious o new echnologies no ye
in en ed. Indeed, he Eu opean Da a P o ec ion Boa d p esen s
he dele ion o o iginal da a and he emo al o cha ac e is ics
as ideal echnical measu es o anonymiza ion [17,18].
An exigen h eshold o wha cons i u es anonymized da a is
a ba ie o in e na ional genomic esea ch. In heal h- ela ed
genomic da a p ocessing, his app oach poses acu e di icul ies
as he in e oga ion o disease e iology and o he de e minan s
o heal h equi es pe sonal da a. Dele ing o s ipping da a se s
o ce ain a iables in he name o anonymiza ion is hen di ec ly
opposed o he e y eason o which p ocessing is unde aken.
Examples include cance imaging da a— he anonymiza ion o
head and neck images cons i u es a se ious challenge o he
p ese a ion o essen ial scien i ic da a; as such, modi ica ion
o he da a can diminish hei scien i ic quali y and u ili y [19].
In addi ion, emo ing me ada a o a speci ic o ma (eg, Digi al
Imaging and Communica ions in Medicine) [20] om cance
imaging da a se s ha may cons i u e indi ec iden i ie s (eg,
he manu ac u e ’s se ial numbe ) would imply he loss o
aceabili y o he pa ien . A loss o aceabili y can ha e
pa icula ly se e e consequences in in e na ional clinical ials
whe e he abili y o ollow pa ien s is essen ial and he
iden i iable e i ica ion o he s udy esul s cons i u es a legal
du y in many coun ies; hei e u n o he pa ien s mus
ep esen an inhe en pa o he s udy concep [21].
Fu he mo e, da a anonymiza ion me hodologies can
sys ema ically dep i e he membe s o small popula ion g oups,
including adi ionally ma ginalized g oups, om inclusion in
scien i ic da a se s. This is he case as he indi ec iden i ie s o
small popula ion g oups a e less common han hose o majo i y
g oups and, he e o e, deiden i ica ion me hods end o emo e
hem om da a se s mo e o en [22].
As a esul , he ad an ages o anonymiza ion canno be ealized
in a esea ch con ex wi hou d as ically educing he po en ial
o he esea ch. Dec easing he ichness o da a diminishes hei
scien i ic alue, u he limi ing he esea ch ques ions ha he
da a can add ess, he applicable esea ch me hods, and he
ele ance o he esea ch indings. In addi ion, di e gen da a
quali y will ul ima ely educe in e ope abili y be ween da a se s
and may e en a ec he ep oducibili y and compa abili y o
esea ch esul s, des oying hei s a is ical alidi y [23].
Me hods o he han da a anonymiza ion, such as coding and
enc yp ion, canno necessa ily acili a e he in e na ional ans e
o pe sonal da a. These me hods do no p eclude he applica ion
o he GDPR o he da a. The Eu opean Da a P o ec ion Boa d
conside s coding and enc yp ion me hods o be supplemen a y
measu es enhancing da a p o ec ion compliance e o s a he
han anonymiza ion echniques ha ende da a nonpe sonal.
I seems ha secu i y measu es widely used in genomic esea ch,
such as pseudonymiza ion, canno emedy his issue, ei he .
The Eu opean Da a P o ec ion Boa d conside s enc yp ion
me hods and coding, such as pseudonymiza ion, o be
supplemen a y measu es enhancing da a p o ec ion a he han
measu es ha ende da a nonpe sonal and, hus, ou side o he
ma e ial scope o he GDPR [24]. Acco dingly, GDPR
equi emen s o ans e canno be ul illed in mos cases i i
is no possible o p o ec enc yp ed and coded da a agains
la ge-scale access and moni o ing by he hi d coun ies’ law
en o cemen agencies wi hou co esponding adminis a i e
and judicial emedies.
Consequences o he Cu en Rules
In summa y, i can be s a ed ha all mechanisms o e ed by he
GDPR o secu e admissibili y o in e na ional da a ans e s can
only be applied i he ecipien ou side he EU o he Eu opean
Economic A ea p o ides an essen ially equi alen le el o da a
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 4h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
p o ec ion. The undamen al igh s con ex su ounding da a
p ocessing in he ecipien coun y will in luence he assessmen
o whe he ules de ining da a p ocessing in a ce ain sec o a e
essen ially equi alen o he GDPR s anda d. This means ha
he bu den o in es iga ing adequacy in ecipien coun ies
wi hou an adequacy decision by he Eu opean Commission
will ul ima ely lie wi h he da a expo e . A he same ime, da a
ecipien esea che s will need o de e mine whe he hey can
sign he o e ed GDPR S anda d Con ac ual Clauses and adhe e
o hem o whe he he e exis con adic ing obliga ions o hem
based on na ional laws. These ules place a bu den on
esea che s in an e a whe e compiling la ge da a se s ac oss
coho s and coun ies is c ucial o achie emen s in genomic
science.
Wha happens cu en ly o a da a ans e o a hi d coun y
wi hou an adequa e le el o da a p o ec ion? In he absence o
an adequacy decision and in he e en ha S anda d Con ac ual
Clauses o o he ans e mechanisms canno ensu e an
essen ially equi alen le el o da a p o ec ion in he coun y o
he da a ecipien , he con olle mus p o ide addi ional secu i y
measu es ha e ec i ely p e en ex e nal access o he da a
and, hus, p o ec he igh s o da a subjec s. The unc ion o
addi ional measu es is simila o ha o any ans e mechanism:
hey should compensa e o he lack o high-le el da a p o ec ion
ha is essen ially equi alen o ha in he EU and he Eu opean
Economic A ea. These addi ional measu es include he
anonymiza ion o all pe sonal da a o p i acy-p ese ing
echniques such as enc yp ion and coding, whe e only he da a
expo e has he key and which canno be ci cum en ed by
o he s [24].
Anonymiza ion is no a iable solu ion o ci cum en he
applica ion o da a p o ec ion ules. On he one hand, genomic
da a a e highly iden i iable because o u he da a linkages. In
con as , he bene i s o genomic esea ch in a heal h con ex
can only be achie ed egula ly i he e is a leas a s a i ied
possibili y o acing he da a back o he a ec ed pa ien s and
p obands.
Conce ning p i acy-p ese ing echniques, a disc epancy
be ween echnical measu es and he s anda d o “essen ial
equi alence” eme ges. Adequacy is undamen ally a legal
s anda d ha includes conside a ions o da a access by
au ho i ies and he legal obliga ion o da a impo e s o comply
wi h access o de s. Depending on he legal sa egua ds and
a ailable ed ess mechanisms, he o de and co esponding
obliga ion o comply wi h i may in hemsel es c ea e a
p ocessing con ex o da a impo a ion ha is below he
s anda d o he EU. Fu he mo e, issues such as enc yp ion and
he a ailabili y o o he da a o bypass he con ex ual anonymi y
o e ed by pseudonymiza ion (coding) a e echnical. O e u ning
echnical da a secu i y will allow o he applica ion o a
p ocessing con ex ha would ende p o ec ion inadequa e.
Al hough esea che s will only be able o in luence echnical
measu es applied o hei da a p ocessing, he law ul access by
he ecipien coun ies’au ho i ies and i s in e ela edness wi h
he echnical ac o needs o be deal wi h.
Eme ging Solu ions o Law ul Da a
Access by Thi d-Coun y Au ho i ies
Gene ally, he ask o assessing whe he he le el o da a
p o ec ion in a hi d coun y is equi alen in subs ance o he
le el unde EU law is no a mechanical exe cise bu mus
in ol e sophis ica ed analysis o he legal o de o he hi d
coun y. The analysis mus no only co e all a eas o law in
e ms o legisla ion and case law bu also u he ex end o
adminis a i e p ac ices. Tha is, a s udy o he li e al ex o
he law is insu icien . Fac s on he g ound, such as ac ions aken
by adminis a i e bodies, also ma e . E alua ing he
conse a o y measu es ha he ecipien s o in e na ional da a
ans e s ake agains o de s o eques s o in o ma ion om
law en o cemen agencies and su eillance bodies could in o m
he assessmen o he “essen ial equi alence” o a ecipien
ju isdic ion’s legal sys em and a e en p ac ices.
In Canada, o example, some en i ies make i clea ha hey
will only comply wi h a alid cou o de om law en o cemen
agencies. When eading he anspa ency epo s o hese
o ganiza ions, i becomes clea ha mos eques s a e no legally
au ho ized as law en o cemen agencies a e essen ially “asking”
o access bu canno compel i [25]. E en i he e is a cou
o de , i migh only co e limi ed da a se s independen o he
collec i e access o which a law en o cemen agency has asked.
Canadian human-pa icipan esea ch no ms, which a e binding
on ede ally unded esea ch, unde sco e he obliga ion o bo h
esea che s and hei ins i u ions o uphold p omises o
pa icipan con iden iali y, which can equi e esea che s and
esea ch ins i u ions o con es cou o de s o da a [26].
Al hough he e is li le ha can be done abou su ep i ious
su eillance, p ocedu es equi ing da a ecipien s o con es
au ho i ies’ eques s and o de s o access o pe sonal da a
should be conside ed when de e mining whe he an in e na ional
ans e espec s he undamen al igh s o da a subjec s. We
belie e ha he analysis o adminis a i e p ac ices ha p o ec
undamen al igh s will e eal conside able simila i ies be ween
EU and non-EU legal sys ems, which a e mo e elling han he
supe icial di e ences a ising om he o mal compa ison o
he ex s o EU and non-EU da a p o ec ion legisla ion.
Coun ies o which he Eu opean Commission has denied GDPR
adequacy s a us o ha ha e had hei adequacy s a us
o e u ned by decisions o he CJEU ha e aken ac ion o
heigh en he p o ec ion o undamen al igh s ha is acco ded
o hei ci izens. In he Uni ed S a es, da a p o ec ion igh s such
as he “ igh o dele ion” a e now acknowledged in case law
[27]. In addi ion, some coun ies ha did no o e adminis a i e
and judicial da a p o ec ion emedies o o eign ci izens a e
s a ing o do so [28]. In Japan, independen adminis a i e
o e sigh has hi he o only been acknowledged in he con ex
o p i a e sec o use [29]. Soon, a no el adequacy decision
applicable o pe sonal da a p ocessing by public sec o
esea che s migh be implemen ed in Japan, ex ending p o ec ion
wi h ega d o he public sec o use o da a. Al oge he ,
signi ican p og ess will s ill be equi ed o aise undamen al
igh s p o ec ion in ela ion o public au ho i y su eillance o
a globally s anda dized le el. Da a sha ing o scien i ic esea ch
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 5h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
and heal h ca e pu poses is a p essing global heal h conce n and
a p edica e o achie ing heal h equi y. The pu sui he eo
canno be made con ingen on global consensus on issues o
S a e su eillance. P ecluding he in e na ional exchange o
genomic and heal h da a o poli ical easons condemns a - isk
popula ions o bea poo heal h ou comes o place p essu e on
go e nmen s o align on su eillance policy.
Scien i ic Resea ch: I s Technique and
Legal S a us
Once wi hin he scope o he applica ion o sec o -speci ic da a
p o ec ion law, i is p ima ily he con ex o genomic esea ch
ha will guide he—o en complica ed—weighing exe cise o
compe ing igh s and in e es s, such as be ween esea ch
eedom and da a p o ec ion, bo h o which a e undamen al
igh s capable o being limi ed. In addi ion, o he legally ele an
posi ions on he side o he da a subjec , such as hei igh o
heal h and hei igh o decide wha o do wi h hei da a ( igh
o p i a e and amily li e), may mo e he me apho ical scale in
a o o genomic science in ce ain con ex s. In genomics,
a ec ed pa ien s may ha e signi ican , eal oppo uni ies o
bene i om esea ch indings, o ins ance, he clinical alidi y
o a gene ic mu a ion o when a a ian is con i med h ough
ansla ional scien i ic esea ch.
I is an ou s anding achie emen as o how a his weighing
has been enhanced on he legisla i e le el in he GDPR, whe e
he emphasis on esea ch eedom is s ongly guided by he
ele ance o scien i ic endea o s in he public in e es and
pe mi s he da a subjec s’da a p o ec ion in e es s o be limi ed
while a he same ime s i ing o minimize isks o hei
p i acy [30]. Unde he GDPR speci ic egime o scien i ic
esea ch, he p ima y ole o da a secu i y is o mi o he
ou come o he ade-o be ween he main in e es s o
p ocessing in insic o scien i ic eedom and hose o p i acy
in he con ex o esea ch, wi h o he impo an in e es s such
as hose o he public guiding he ade-o . Obliga ions o da a
con olle s and p ocesso s o implemen echnical da a secu i y
measu es as de ined by he GDPR gene ally and o scien i ic
da a p ocessing speci ically (eg, A icle 89 sa egua ds ha
manda e da a minimiza ion and pseudonymiza ion) add ess he
ade-o esul be ween hese e y in e es s and igh s a he
legisla i e le el. Al oge he , supplemen a y measu es
comple ing da a p o ec ion in he genomic da a go e nance
con ex , pa icula ly echnical secu i y and adminis a i e
p o ec ions agains en o ced da a elease, and he o e sigh o
u u e use in oduce a cumula i e p ac ice o good go e nance
a he han a “sil e bulle ” consis ing o a singula me hod ha
alone gua an ees da a p o ec ion, as is implici in he discussion
o secu e mul ipa y compu a ion and o he echnological
measu es in ecen Eu opean guidance [24].
Scien i ic Resea ch as an Elemen o
Legal Weighing Exe cises
Weighing compe ing igh s and in e es s and ansla ing he
esul o his balancing exe cise in o p ac ices, policies, and
echnical measu es enabling secu e genomic da a exchange will
become mo e complex in he u u e. His o ically, he analysis
has equi ed he bila e al conside a ion o he indi idual in e es
in he p o ec ion o pa ien s and esea ch pa icipan s ela i e
o he esea ch eedom o scien is s and he b oad socie al
in e es in ad ancing esea ch and deli e ing a high s anda d
o heal h ca e. Howe e , he ele an in e es s a e now becoming
mul ipola . Namely, he balancing o in e es s o be pe o med
becomes mul ipola . I becomes necessa y o conside no only
he p i acy in e es s o indi iduals ela i e o scien i ic eedom
and he public in e es in scien i ic p og ess bu also he
addi ional complexi ies o S a e su eillance di ec ed a
indi iduals and he public.
When he adequacy o a hi d coun y’s da a p o ec ion is
con es ed on he basis o law en o cemen ’s po en ial access o
da a and he emo al o da a anonymi y, he ini ial weighing
con ex ela ed o scien i ic esea ch and he GDPR’s p i ileging
o da a p ocessing o scien i ic esea ch pu poses shi s
conside ably.
The essen ially bila e al ela ionship be ween p i acy and
scien i ic eedom un il hen de e mined he app op ia e secu i y
measu es o be implemen ed. Howe e , whe e he e is a p ospec
o su ep i ious S a e su eillance o o law en o cemen access
o da a, he secu i y measu es and o he sa egua ds o be
implemen ed di e . The choice o app op ia e secu i y measu es
and o he sa egua ds mus accoun o he po en ial o S a e
su eillance o law en o cemen access o da a, which is a
di e en analysis al oge he . In hese ci cums ances, he
assump ion o con ex ual anonymi y ha unde gi ds he
go e nance o da a o scien i ic pu poses migh be mo e easily
dissol ed han assumed, especially in ela ion o he
iden i iabili y o genomic da a and wi h he echnological ools
a ailable o law en o cemen [31].
Fu he mo e, i seems misleading o ame da a p o ec ion
obliga ions wi hin he bina y dis inc ion be ween anonymized
da a and pe sonal (including pseudonymized) da a. As al eady
desc ibed, he anonymized-pe sonal bina y is no a pe inen
dis inc ion in he con ex o he decision as o whe he
p ocessing da a o scien i ic esea ch pu poses and ans e ing
hem o hi d coun ies can occu in a manne complian wi h
he GDPR. I is pe sonal da a o which he ules o he GDPR
apply, including ules on ans e . The isk o iden i iabili y is
hus implied in he da a secu i y and ans e mechanisms o
he da a p o ec ion law and he ules o he GDPR.
The issue he e is ha he main echnical measu es ha would
s ill enable meaning ul and bene icial genomic science a e
con adic ed by conside a ions su ounding he legal and de
ac o possibili y o law en o cemen ci cum en ing con ex ual
anonymi y. We belie e ha he e needs o be a dis inc legal
amewo k enabling scien i ic esea ch as he cu en ly p oposed
solu ions pose challenges o esea che s ha hey canno sol e
on hei own (Table 1). This amewo k should p o ec , whe e
necessa y, scien i ic esea ch om o he in e es s. The c ea ion
o such a amewo k should be based on a no ma i e decision
ins ead o i s acili a ion being only dependen on he echnical
agili y o da a expo e s and impo e s. The main concep o
he p oposed legal amewo k is elabo a ed on in he ollowing
sec ions. Signi ican elemen s o he concep a e he u he
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 6h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
de elopmen o con ac ual obliga ions o da a impo e s,
c ea ing sa e da a spaces, and wo king owa d linking hese wi h da a in as uc u es wo ldwide.
Table 1. Iden i ied challenges ela ed o in e na ional da a ans e s, solu ions cu en ly explo ed, emaining challenges, and p oposed solu ions o hese
challenges.
Sugges ed solu ionsRemaining challengesExplo ed solu ionsChallenges
Adop speci ic heal h esea ch sec o
adequacy assessmen s o ake in o ac-
coun speci ic ade-o s among igh s,
app op ia e echnical measu es, and
long-s anding compliance e o s wi hin
he sec o , including adminis a i e
measu es
Blanke adequacy decisions easily
dis ega d sec o al di e ences in ap-
plicable da a p o ec ion ules
C ea ion o clea ules o he ade-
quacy assessmen p ocedu e
Lack o adequacy decision by he
Eu opean Commission
Emphasize he con ex ual anonymi y
o da a, o example, when he con ex
is no changed du ing da a p ocessing
(eg, by allowing da a o be isi ed)
Loss o in o ma ion con en o da a
o scien i ic esea ch, anonymi y
o da a is con ex dependen , and
subs i u e measu es o p o ec ion
can be ci cum en ed
Nonapplica ion o da a p o ec ion
ules and ins ead use subs i u e
measu es o mee he adequacy
s anda d
Da a anonymiza ion and p i acy-
p ese ing da a secu i y measu es
a e p omo ed as he only solu ions
o da a p o ec ion conce ns
Link he de elopmen o codes o con-
duc wi h he sec o al adequacy assess-
men and he de elopmen o ce i ica-
ion mechanisms wi h supplemen a y
echnical measu es o in e na ional
da a ans e s
Cu en solu ions ha a e no ele-
an o he con ex o genomic e-
sea ch o a e no ele an o in e -
na ional da a ans e s [32]; unda-
men al igh s issues aised
Bo om-up sec o -speci ic con-
c e iza ion o da a p o ec ion ules
and app op ia e supplemen a y se-
cu i y measu es
Missing codes o conduc and ce -
i ica ion mechanisms
The Way Fo wa d I:Adap ing Con ac ual
Se ings
To pe o m a da a ans e om he EU o he Eu opean
Economic A ea o a hi d ju isdic ion ha does no mee he
“Eu opean essen ial gua an ees,” i is necessa y o apply
e ec i e supplemen a y measu es ha aise he s anda d o da a
p o ec ion o ha ensh ined in he GDPR. These measu es can
include a combina ion o echnical measu es, p i a e law
a angemen s, and o ganiza ional p ac ices.
In he absence o e ec i e supplemen a y measu es, supe iso y
au ho i ies will bea he obliga ion o de e mining whe he
con ac ual and o ganiza ional bes e o s o mi iga e he
po en ial o su eillance bodies and law en o cemen agencies
o make su ep i ious use o da a should be conside ed su icien
o enable he in e na ional ans e o da a [31]. Po en ially
ele an measu es include he in eg a ion o con ac ual language
manda ing mu ual anspa ency o ag eemen s be ween da a
impo e s and expo e s. This migh include he obliga ion o
egula ly p o ide speci ic in o ma ion abou eques s ecei ed
om au ho i ies ega ding pe sonal da a p ocessed unde he
ele an con ac . I disclosing speci ic de ails abou such
eques s is o he wise p ohibi ed, gene al in o ma ion could s ill
be p o ided (eg, wa an cana ies) [33].
Mo eo e , he inclusion o obliga ions speci ic o he da a
impo e me i s conside a ion. These could include an obliga ion
o ake legal ac ion o challenge an o de o disclose pe sonal
da a un il all pa hways o do so ha e been ex inguished.
P eceden s o such measu es exis in Canadian esea ch e hics
guidance [26]. These ecommenda ions a e o en pai ed wi h
sugges ions o c ea ing join liabili y be ween he da a expo e
and he ecipien as well as wi h ules o compensa ion, such
as he inclusion o an obliga ion o he da a impo e o
indemni y he da a subjec , ega dless o aul , agains all
damage caused by access o he da a subjec ’s da a by en i ies
o hei S a e. Issues ela ed o he e ec i e en o cemen o such
addi ional clauses emain open. Da a expo e s can demons a e
and documen hei in en ion o ac in a legally complian
manne by obse ing he equi emen o he supe iso y
au ho i ies and con ac ing he pa icula da a impo e o a ange
o hese changes o be made o he p o isions o he con ac ual
clauses. The s epwise escala ion o disc e iona y measu es by
supe iso y au ho i ies may e en ually educe he exposu e o
da a expo e s ac ing in good ai h o high penal ies. Howe e ,
i does no pe se lead o an imp o emen in he posi ion o da a
subjec s as he demons a ion and documen a ion o he will o
comply wi h he law by he con ac ual pa ies does no
necessa ily gua an ee en o ceable igh s o da a subjec s.
Fu he mo e, he p opo ionali y o such ex ensions o
con ac ual ag eemen s will o en depend on whe he he da a
impo e is eplaceable in he sho and medium e m by an
impo e who may mo e easily gua an ee an adequa e le el o
da a p o ec ion. Howe e , his assessmen s anda d is a
double-edged swo d. Al hough he i eplaceabili y o a da a
impo e migh be a good ya ds ick o u he enabling
s anda ds in he economic sec o , he i eplaceabili y o a
scien i ic coope a ion pa ne mus always be judged agains
he backd op o he high s anda ds o which he exe cise o he
undamen al igh o scien i ic eedom is linked. The isk
emains ha he eplaceabili y o di e en pa ne s in genomic
science migh quickly be based on a supe icial compa ison o
a ailable echnical equipmen o ex e nal indica o s o success.
Al hough hese me ics can in luence he exe cise o scien i ic
eedom, hey mus no in luence he p o ec i e alue assigned
o scien i ic eedom as a igh o eedom.
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 7h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
The Way Fo wa d II: Sa e Da a Spaces
o Scien i ic Resea ch
Wi h he Eu opean Da a S a egy, he EU aims o c ea e a single
space o da a ha will allow hem o low eely wi hin he EU
and ac oss sec o s o he bene i o businesses, esea che s, and
public adminis a ions. One o he co e pilla s o his s a egy
is p ecisely he p omo ion o “Common Eu opean da a spaces
in s a egic sec o s and domains o public in e es ,” including
he Eu opean Heal h and Eu opean Resea ch Da a Spaces [23].
The EHDS aims o enable an e icien exchange o and di ec
access o di e en heal h- ela ed da a ac oss he EU in
compliance wi h da a p o ec ion egula ions, in pa icula he
GDPR [34]. As o he egula o y subjec ma e , he design o
he ules o da a exchange as well as connec ing he EHDS
wi h he eme ging genomic esea ch in as uc u e is o
pa icula ele ance. The “1+ Million Genomes” is an ini ia i e
o indi idual EU membe s a es ha aims o enable he sha ing
o a leas one million genomes by 2022 [35]. This ini ia i e is
pa icula ly impo an as he EHDS exp essly includes genomic
da a in i s scope and should be connec ed o he “1+ Million
Genomes” ini ia i e in his ega d.
A se ies o measu es a e p oposed o os e hese spaces,
including he deploymen o da a in as uc u es, ools, and
compu ing capaci y by way o scaling and in e ope a ing
eposi o ies and da abases in a ede a ed manne [36].
Concen a ing secu e da a p ocessing in a clois e ed da a space
migh alle ia e he impe ec egula o y en i onmen applicable
o esea ch da a p ocessing. Howe e , he long a m o he law
en o cemen egula ions o hi d coun ies c ea es di icul ies
in secu ing he undamen al igh o da a p o ec ion h oughou
he en i e li e cycle o esea ch da a p ocessing. The e o e,
addi ional se ings may be needed o help main ain da a
p ocessing wi hin a sa e en i onmen , such as p e en ing he
download o da a as a echnical sa egua d accompanied by he
legal sa egua d o con ac ually p ohibi ing i . A u he s ep
owa d upholding a sa e en i onmen o esea ch da a
p ocessing is o o e a sea chable me ada a basis wi hou
mo ing da a, deploying da a analysis se ices ha allow o he
submission o esea ch ques ions, and comple ely o egoing
access o he esea ch da a hemsel es. Fede a ed da a sha ing
models ha could g ound such de elopmen a e being
success ully implemen ed by in e na ional esea ch da a a chi es
such as he Eu opean Genome-Phenome A chi e [37] and by
conso ia such as he Eu opean-Canadian Cance Ne wo k [38].
In addi ion o p ocessing da a o p ima y heal h ca e pu poses,
he es ablishmen o he EHDS o seconda y da a p ocessing
is linked o making elec onic heal h da a, heal h- ela ed da a
al eady s o ed by a ious da a holde s, and da a whose in luence
on heal h is known, such as genomic da a, widely a ailable o
he pu poses o heal h esea ch o a ious da a use s [39]. Such
da a holde s include public and p i a e esea ch ins i u ions
[40]. The d a EHDS egula ion obliges da a holde s o make
he ca ego ies o elec onic da a lis ed in he egula ion a ailable
o seconda y use [41]. The e m “making a ailable” means
making he da a a ailable o a so-called Heal h Da a Access
Body a i s eques [42]. In addi ion, da a holde s a e obliged
o p o ide he Heal h Da a Access Body wi h a gene al
desc ip ion o he da a se s hey s o e [43].
De elopmen s by he EHDS o
Seconda y Use o Genomic Da a o
Scien i ic Resea ch
EU membe s a es a e equi ed o appoin o es ablish public
bodies en i led Heal h Da a Access Bodies [44]. Heal h Da a
Access Bodies ecei e and e iew da a use s’ eques s o access
o da a ha a e e ained in he EHDS o seconda y use,
including scien i ic esea ch use [45]. P ospec i e da a use s
mus submi eques s o Heal h Da a Access Bodies, which
decide whe he o au ho ize access o he eques ed da a [46].
In adminis e ing such eques s, Heal h Da a Access Bodies
assess a numbe o ac o s s ipula ed in he legisla ion. Rele an
conside a ions include whe he he applican in ends o use he
eques ed da a o a pu pose ha he law au ho izes, whe he
he legisla i e p econdi ions o da a access ha e been ul illed,
and whe he access o he eques ed da a is necessa y o he
applican o ul ill hei s a ed pu pose [47]. I an applican
ul ills he p econdi ions o da a access, he Heal h Da a Access
Bodies mus issue a da a pe mi in a o he eo . The pe mi
explici ly es ablishes he condi ions acco ding o which he da a
can be used. Such a pe mi is alid o a maximum o 5 yea s
[48].
The eques ed da a a e p o ided in ei he pseudonymized o
anonymized o m. Inso a as i is possible o he ecipien o
achie e hei pu poses in eliance on anonymized da a, he da a
will be made a ailable o hem in an anonymized o m. In all
cases, da a use s a e s ic ly p ohibi ed om eiden i ying he
da a ha a e p o ided o hem [49,50].
Da a access is p o ided h ough a secu e da a p ocessing
en i onmen . This secu e en i onmen is subjec o legisla i ely
es ablished secu i y and in e ope abili y equi emen s. This
en i onmen implemen s he echnical and o ganiza ional
measu es equi ed by he GDPR. Fo example, da a use s a e
p e en ed, h ough echnical con ols, om downloading da a
ha a e held in he secu e p ocessing en i onmen [51]. The
p oposed legisla ion does no conside Heal h Da a Access
Bodies o be me e s ewa ds o he da a ha a e made a ailable
o da a use s. Ra he , bo h he da a use and he Heal h Da a
Access Body sha e legal esponsibili y o ensu ing he law ul
use o he eques ed da a— he law conside s hem o be “join
con olle s” [52].
The Eu opean Commission will collabo a e wi h membe s a es
o c ea e a cen al in as uc u e ha enables da a use s o access
c oss-bo de da a h ough na ional poin s o con ac . Membe
s a es can appoin hei coo dina ing Heal h Da a Access Bodies
as hei espec i e na ional poin s o con ac . These con ac
poin s will become he au ho ized pa icipan s in he
in as uc u e [53,54]. Na ional poin s o con ac in each EU
membe s a e will compile and publish a holis ic, EU-wide
ca alog o a ailable da a se s. This will assis p ospec i e da a
use s in disco e ing ele an da a se s ha a e held in o he EU
membe s a es o he pu pose o eques ing access he e o [55].
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 8h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
Opening Up he EHDS o In e na ional
Scien i ic Collabo a ions
The Eu opean Commission in ends o enable hi d coun ies
and in e na ional o ganiza ions o in eg a e hei own na ional
poin s o con ac wi h he EHDS in as uc u e. The
Commission, oge he wi h he ep esen a i es o he na ional
poin s o con ac o EU membe s a es, e e ed o as he “join
con olle ship g oup,” mus pe o m a compliance assessmen
be o e admi ing o eign nodes o he o e all EHDS ne wo k
[56]. I he ou come is a o able, he Eu opean Commission
will adop an implemen ing ac , which s a es ha he conce ned
o eign node is complian wi h he EHDS egula ion and u he
equi emen s o he seconda y use o da a and p o ides access
o da a use s loca ed in he EU o he elec onic heal h da a i
has access o on equi alen e ms and condi ions [57].
The eupon, he o eign node is admi ed o he EHDS
in as uc u e and joins he na ional nodes o EU membe s a es.
The p oposed EHDS legisla ion es ablishes specialized ules
applicable o he seconda y p ocessing o heal h da a o
scien i ic esea ch pu poses. These a e compa ible wi h he mo e
gene al GDPR ules ha equi e da a p o ec ion in e es s o be
balanced agains he esea ch in e es s pu sued. To his end, he
GDPR equi es he necessi y and p opo ionali y o he in ended
da a p ocessing o be assessed and conside ed ela i e o he
sec o -speci ic objec i es he eo .
In admi ing non-EU in as uc u e nodes o he pan-EU ne wo k
o na ional poin s o con ac , he Eu opean Commission submi s
he applican o eign nodes o he a o emen ioned assessmen
p ocedu e. By ou eading, his assessmen p ocedu e mi o s
he “adequacy” e iew ha he Eu opean Commission
unde akes be o e es ablishing ha da a impo e s in a hi d
ju isdic ion a e au ho ized o ecei e pe sonal da a ans e s
om he EU wi hou such ans e s equi ing addi ional legal
compliance measu es. The e o e, be o e o eign nodes a e
in eg a ed in o he EHDS in as uc u e, i will be necessa y o
he applican nodes om hi d coun ies o demons a e
compliance wi h he o e all equi emen s o he GDPR, he
EHDS egula ion, and he EU undamen al igh s amewo k
o he sa is ac ion o he join con olle ship g oup. This is
con ingen on a ho ough assessmen o he legal ules and
p ac ices in he applican ’s ju isdic ion as ega ds S a e
su eillance, among o he ac o s.
The p oposed egula ion c ea es a ela ionship o join
con olle ship be ween EU na ional poin s o con ac and hei
non-EU co olla ies. This enables da a subjec s in he EU o
asse legal claims agains hei own espec i e na ional EU
poin s o con ac o misuses o da a ha occu h ough he aul
o non-EU poin s o con ac . This may lead o posi i e ou comes
in acili a ing access o legal emedies o EU da a subjec s.
Howe e , EU poin s o con ac could be held liable o he
ac i i ies o hei non-EU pa ne s h ough no aul o hei own,
including h ough he b each o EU undamen al igh s ha
a ise because o he su eillance ac i i ies o non-EU S a e
ac o s. This p ospec i e liabili y could ha e a chilling e ec on
he join con olle ship g oup ha is esponsible o de e mining
whe he o eign nodes should be admi ed. Tha is, na ional EU
nodes migh hesi a e o admi o eign nodes o he la ge ne wo k
i he beha io o he o eign nodes could cause he na ional EU
nodes o be held liable o a b each o he GDPR o he EHDS
egula ion.
The use o a compliance assessmen ha mi o s he GDPR
adequacy p ocedu e o admi o eign nodes o he ne wo k o
na ional poin s o con ac o he EHDS is a cu ious legal design
choice. The EHDS echnical pla o m is an icipa ed o in eg a e
secu e da a p ocessing capabili ies ha p eclude da a om being
ex e nally downloaded o o he wise eplica ed. Rega dless o
he legal da a p o ec ion no ms—and su eillance
p ac ices—applicable in he coun y o o igin o he con ibu ed
da a, he echnical design o he EHDS should achie e a
common, GDPR-complian s anda d o da a p o ec ion
gua an ees. The e o e, i should be u he examined whe he
he policy choice o equi e a comp ehensi e compa ibili y
assessmen , akin o a GDPR adequacy de e mina ion, be o e
in eg a ing o eign nodes in o he EU ne wo k is jus i ied a all.
The in eg a ion o na ional heal h da a spaces in o a la ge
in e na ional ne wo k will equi e go e nmen s and egula o s
o pionee no el legisla i e and nonlegisla i e measu es. In his
espec , he Eu opean Commission holds a a e ied ole as bo h
lawmake and pionee o c i ical in e na ional in as uc u e
[12]. The Eu opean Commission has p e iously been c i icized
o no conside ing exis ing measu es ha a e used o balance
he isks and bene i s o scien i ic esea ch in pe o ming
adequacy assessmen s di ec ed a he heal h sec o . Pe cei ed
ambigui ies a ise in he guidelines o he Eu opean Commission
as o he c i e ia ha mus be used o de e mine whe he he
no ms o hi d coun ies should bene i om a a o able
adequacy decision. This c ea es legal unce ain ies ega ding
he unc ioning o he adequacy egime, which is he cen al
mechanism ha enables hi d coun ies o bene i om
unencumbe ed ans e s o da a om he EU [58]. I emains o
be seen whe he he Eu opean Commission will implemen
anspa en , comp ehensible, and in e nally consis en
me hodologies in deciding on he accession o hi d coun ies’
in as uc u es o he EHDS.
The GDPR con inues o apply o da a p ocessing in he EHDS.
The e o e, i emains open o membe s a es o implemen
supplemen a y condi ions ha a e applicable o da a p ocessing
and in e na ional da a ans e in he EHDS. The po en ial o
membe s a es o do so is bounded by he limi s es ablished in
he GDPR. None heless, his could de ac om he ha monizing
p ospec s o he EHDS in enabling dis inc membe s a es o
apply hei own di e gen na ional no ms o hei espec i e
nodes o he in as uc u e. Fo example, membe s a es can use
domes ic law o exp essly es ablish limi s o he ans e o
speci ic ca ego ies o pe sonal da a o a hi d coun y o
in e na ional o ganiza ion o impo an easons o public
in e es . Such limi s may be imposed so long as he conce ned
coun y o in e na ional o ganiza ion does no al eady bene i
om a GDPR adequacy decision [59].
In summa y, he legisla ion c ea ing he EHDS ep ises
nume ous es ic i e and limi a i e elemen s o he GDPR ha
will con inue o impede he po en ial o make plen i ul use o
da a o genomic esea ch suppo ing heal h esea ch and ca e.
J Med In e ne Res 2022 | ol. 24 | iss. 10 | e37236 | p. 9h ps://www.jmi .o g/2022/10/e37236 (page numbe no o ci a ion pu poses)
Molná -Gábo e alJOURNAL OF MEDICAL INTERNET RESEARCH
XSL
•
FO
Rende X
