Bruch - Security, Solidarity, Science

PrivacyImplicationsofResearchData:ANISOSymposium11SEPTEMBER 2016, DENVER

Security, Solidarity, Science and the rule of law

Open Science and privacy protection in transnational cooperation

Dr. Christoph BruchHelmholtz Association

Contents

§ HelmholtzAssociation

§ TheGermanNationalCohort

§ Dataprotectioninaninternationalsetting

Seite2Denver,11.09.2015

HelmholtzAssociation



HelmholtzAssociation

§ Staff:38,237

§ Budget:€ 4.45billion� Twothirdscomefrompublic

sponsors (ina9:1splitbetweenFederalandstateauthorities)

� TheindividualHelmholtzCentresareresponsibleforattractingmorethan30%themselves intheformofcontractfundingprovidedbypublicandprivatesectorsponsors.

§ Eachyear,severalthousandvisitingscientistsandresearchersfromallaroundtheworldcometotheHelmholtzCentres

TheGermanNationalCohort


NAKOFactsandfigures§ Itwillprovideamajor,centralresourceforpopulation-basedepidemiologyin

Germany,andwillhelptoidentifynewandtailoredstrategiesforearlydetection,prediction,andprimarypreventionofmajordiseases.

§ Overalldurationof25–30 years§ 18regionalstudycentres§ 200,000womenandmenaged20–69 years§ 200,000

� extensiveinterview� self-completion questionnaires� awiderangeofmedicalexaminations� collectionofvariousbiomaterials

§ 40,000� “Level2”programme

§ 30,000� Magneticresonanceimagingexaminationprogramme

§ After4–5 years,allparticipantswillbeinvitedforare-assessment.


NAKOTimeline


NAKOStudycentresoftheGermanNationalCohort


NAKOdataprotection/managementconcept§ 2datasources

� Datageneratedwithintheproject§ Interviews/Questionnaires§ Medicalexaminations(level1:all;level2:40,000;MRT:30,000)§ Collectionofvariousbiomaterials

� Linkagetosecondarydatatoobtainadditionalinformationonthe individual’shealthandemploymenthistory§ Patientfiles§ statutoryhealthinsurances§ Dataonoccupationalhistory§ Geocodedenvironmentaldata

§ DataProtectionConcept� Centraldatamanagement� CompliancewiththeFederalDataProtectionActs� Compliancewith „OpinionoftheGermanEthicsCouncil”� Adataprotectionconceptwasdeveloped inclosecollaborationwiththeGermanfederaland

statecommissioners.� A‘CodeofEthics’oftheGNChasbeendeveloped.� Anexternalethicsadvisoryboardhasbeenestablished.


NAKOdataprotection/managementconcept


NAKOCriticismconcerningdataprotectionconcept

§ DataprotectionisahighlycontentiousissueinGermany

§ AcivillibertiesorganizationcriticizedNAKObecauseofallegedshortcomings(Atleastsomehavebeenamelioratedbynow.)ofitsdataprotectionconcept:� Discrepancybetweeninformation concerning intendeduseinconsentformanduser(=research)agreement/rules

� Nooptions forrequestingcontentatlaterstagesasnewusesareintended

� Nowautomaticrenewalofconsent thatisonlyvalidfor5years.(Thiswording isproblematicanywayasbylawconsentcanbewithdrawnanytime.)

� Consentformallegedlydidnotenableparticipanttoinsertdisagreementwithparticularpartofthatform.(noNO-Field)

� Ambiguities inrespecttoprohibition ofcommercialuse


NAKOillustrates

§ thecommitmentoftheresearchcommunitytodataprotection

§ theeffortnecessarytoreachandmaintainanadequatelevelofdataprotection

§ tensionsexistingbecauseofinherentconflictsofinterestbetweenresearchwhichisaboutuncoveringandprivacywhichisaboutseclusion


Theresearchcommunityisprodataprotection

§ Dataprotectionisaprerequisitetobuildtrustwhichinturnisaprerequisiteforthecooperationofthedatasubject(testperson,interviewee)

§ ThereisastrongincentivetodemonstratecommitmenttodataprotectionsincethereisatendencytocollectmorePPI.

§ Commitmenttodataprotectionisalsomotivatedbytheawarenessofanincreasein� theamountofdatabeingcollectedand� theabilitytoprocessdatawhichresultsin� greaterrisksoftheoccurrenceofmishapsand� newandmoredangersofmisuse(e.g.deanonymization)


Dataprotectionisachallengefortheresearchcommunityas

§ AlimitationoftheuseofPIIfortheoriginalpurposeisatoddswiththevisionofdatadrivenscience.

§ Researchersarefacedwithnewdemandstotheirdataavailable,e.g.� openscience� Interdisciplinarycooperation� reproducible science� commodification ofscience

§ Newscenariosforproperusebutalsomisuseresultinanincreasedburdentomaintainadequatedataprotectionstandards.

§ Coredataprotectionprincipleslikedataminimization,strictlimitationofuse,informedconsentareatoddswiththehighhopesrelatedtobigdata.


Repercussionsfor3rdparties

§ ThecollectionandanalysisofPIIcanhaverepercussionsbeyondthegroupofpersonswhosedatearecollected.

§ Theseimplicationsforsecondarygroupscanoccurasaresultvariouscircumstances,e.g.� Geneticdata:containinformationaboutrelatives

� Securitydata:Contactpersonsmaybeassociatedwithsecurityrisk/criminaloffences

� Profiledata:derivesformdatarelatingtocertainindividualsmaybeassociatedwithotherpersonsconsideredbelongingtoasimilar„profilegroup“


Informedconsent

§ Thepracticalmeaningofinformedconsentisstronglydependentontheamountofcomprehensionintendedtobenecessarytoenableanindividualtogivethatinformedconsent.

§ ActualconsenthastobeconsideredrathervagueiftheconsentingPersonhasasuperficialunderstandingonlyoftheimplicationsofhisdecision.

§ StatementsconcerningintendeduseofPIIaretypicallyverycomplex,oftenquitelongandincomprehensibleforthegreatmajorityofpersonswhoagreewiththem.

§ Thus,thereclearlimitationstothepossibilitytorealizeinformationalself-determinationviathistool.


Dataprotectioninan

internationalsetting


MotivationforEUdataprotectionregulation

§ GreatvariationsinprotectionlevelswerepossiblebecauseofthebroadscopelefttomemberstatesbyEUDirectivefrom1995

§ Thisledto„forum-shopping“bybigcompanies=choosingofjurisdictionwithlowestdataprotectionrequirements

§ ResultinginGoogle,Facebook…transferringtheirEuropeanoperationstoIreland

§ Adataprotectionregulationwastocreateamorelevelplayingfield.


Timeline:Harmonizationofdataprotection

1980 OECDDataProtectionPrinciples

1995 Directive ontheprotectionofindividuals withregardtotheprocessing ofpersonal dataandonthefreemovementofsuchdata(95/46/EC)(repealed by2016/679/EU))

1998 NegotiationsonSafeHarborPrivacyPrinciples arestarted

2000 SafeHarborDecision - EuropeanCommunity declaresInternationalSafeHarborPrivacyPrinciples arecompliantwiththeEUDataProtectionDirective(Decision 2000/520)

2015 JudgmentoftheEuropeanCourtofJusticedeclaringinvalid theEUCommissions SafeHarborDecision(CaseC-362/14)

2016 Regulation ontheprotectionofnaturalpersonswithregardtotheprocessing ofpersonaldataandonthefreemovement ofsuchdata,andrepealingDirective95/46/EC (GeneralDataProtectionRegulation)(2016/679/EU)May2016 Regulationtookeffect

Transition period:MemberstateswilladapttheirdataprotectionlawsMay2018 Endoftransitionperiod– regulationcomesintoforce

2016 February: Completionofnegotiations onEU-U.S.PrivacyShieldJuly: AdequacyDecision byEUCommission concerning EU-U.S.PrivacyShield


GeneralDataProtectionRegulationKeyfeatures(1)

§ StrongerEU-wideharmonization– butalotofscopeformemberstates

§ Increasedfines(§ 43,Art.83)� forindividualsuptoEUR300,000� ForcompaniesuptoEUR20,000,000or4%ofannualturnover

§ Obligationtodemonstrateadequateprotection� Thisresponsibilityiswithprincipleinvestigationofaresearchprojectortheheadofaresearch

institution� Incertaincasesadataprotection officerneedstobeappointed

§ Thepositionofthedataprotectionofficershasbeenstrengthened.� Thisincludese.g.involvingdataprotectionofficersalreadyatearlyplanningstagesofbigger

researchprojects



§ Transparencydemandsfordatacontrollershavebeenincreased� Thisincludestheobligationtocommunicateclearlyandinalanguageeasilycomprehensible.� Bythesametoken, informationrightsofpersonswhosePII’sarecollectedhaven

strengthened

� Inordertobeabletofulfiltheinformationobligationsmoremonitoringandreportingmaybenecessary

� Infactthe informationobligationsmayprovetobethehighestdataprotectionhurdleincasesinwhichthePIIareanonymizedasthepersonswhosedataareusehaverighttoknow howexactlytheirdatewereused.Thiswillbedependent onhowthenewdataprotectionregulationwilltransformedintonationallawoftheMemberStates

§ Expansionoftheareaofapplication� The GeneralDataProtectionRegulationalsoappliestoPIIprocessedoutsidetheEUifthisis

doneonbehalforunderresponsibilityofacompanywithalegalbranchinaEUmemberstate.



§ ADataprotectionimpactassessmentisobligatoryincertaincases(Art.35)

§ Theoptionsforbuilding-uplargecollectionsofPIIarelimitedbytheinstructionpersonaldatamaynotbeingmadeavailable“toanindefinitenumberofnaturalpersons”(Art25(2))

§ Theuseofhumangeneticdataposesachallengeasthesecaninprinciplenotbepseudonymizedoranonymized.Atthesametime,manyresearchquestionsinthefieldofgenetics(e.g.personalizedmedicine)canonlybetackledbytheanalysisofaggregationsofgreatmassesofthesedata.Evenifaggregationsofthesedataismadepossiblebasedonappropriateconsentsthechallengeremainstoguaranteeadequatesecuritylevelsandrightsmanagement.


GeneralDataProtectionRegulationResearchprivileges (1)

§ Informedconsent� Lowerstandardforresearchpurposes[recital26]

§ Useforresearchpurposesofpersonaldatawhichwasnotcollectedforthispurpose,includingdatainpublicregisters� Memberstatesmayallowthis. Ifdoingsoresearchpurposes needtobeoneoftheprivileged

uses.[recital50,159,162;Art.5(1)(b)]

§ Permissiontoprocessespeciallysensiblepersonaldatawhichingeneralmaynotbeprocessed� theprohibitionmybeliftedforresearchpurposes[recital52&53]

§ Informationobligationsinrespecttothedatasubjectandotherreportingobligationscanbeloweredresearchpurposes[recital62,156;Art14(5)(b)]


GeneralDataProtectionRegulationResearchprivileges(2)

§ Limitationsconcerningthedurationdataretention� Theselimitationcanbeextendedorliftedforresearchpurposes [Art.5(1)(e)]

§ Rightofdatasubjectstohavedatacorrectedorerased� Thecorrespondingobligationforthedatacontrollercanbeloweredforresearchpurposes

[recital65;Art.17(3)(d)]

§ (international)Datatransfer� Transfersforresearchpurposescanbeprivileged[recital113)


RuleoflawScopefor„practicalsolutions“

§ Compliancewithdataprotectionlawisachallengeonthenationallevelandevenmoresointheinternationallevel.

§ Harmonizationoftherespectivestatutorylawisalongtermprojectthatoftendoesnothelptosolvecurrentproblems.

§ Forgingagreementbetweenstatesestablishingprocessesthateaseobservationofthelawarethereforeacommendableapproach.

§ WhenratingtheUSSafeHarborPrivacyPrinciplesasadequatetheEuropeanCommissiondidnotadequatelyconsiderEUlawincludingtheCharterofFundamentalRightsoftheEuropeanUnion.

§ NowtheEU-U.S.PrivacyShieldistobethenewandbetterpracticalsolution.

§ ThereisgeneralagreementthatthePrivacyShieldisamajorimprovement.

§ TheEuropeandataprotectioncommunitywillsurelytrytohaveprivacyshieldtestedbytheEuropeanCourtofJusticeassoonaspossible.


Thankyouverymuch

foryourattention


Education

Bruch - Security, Solidarity, Science