New document on Data Protection released by The Council Presidency

The new data protection document has some potentials for VPH: it maintains the integrity of patient registries and in terms of access to data should be a significant improvement for researchers visa vie the Parliament position. 

The document introduces many new articles and changes from previous versions. The current position on articles of relevance to VPH (Articles 7, 9, 81, 83) could be interpreted to mean the following:

• The ability of public authorities to gather health data for patient registries have been significantly strengthened. On this note, it could potentially be interpreted that patient registries connected with public authorities will be in any way adversely affected by the current text;
  
• An altered safe guard for data subjects has been added: restricting processing which is supporting measures or decisions which may adversely affect the individual. This is a useful and welcome development, as it allows processing of individual data. 
  
• Pseudonymisation of health data will be required where possible. Provisions are in place to reduce the administrative burdens placed on researchers where they use of pseudonymised data by limited the following rights of the data subjects:
  
• Article 14a – information to be provided where data were not obtained from the data subject; 
• Article 15 – right of access to own data;
• Article 16 – right of rectification;
• Article 17 – right to be forgotten and of erasure; 
• Article 17a – right of individual to restrict processing; 
• Article 18 – right to data portability
• If pseudonymisation of data is not possible eg: genetic data, processing is still possible but researchers will not be able to benefit from being exempt from the above administrative burdens. 
  
• The scope of processing data for health-related purposes (Article 81) has been broadened to include important reasons of public interest (Article 9(1) point g), in addition to health data (Article 9(1) point h). This means that data important for health, which are not derived from the medical practice (e.g. socio-demographic data) can be processed for health-related purposes based on these provisions; 
  
• A remaining question however is what constitutes a “public interest”. Many generous exceptions for processing of health data exist in this text where such processing is done as part of serving a “public interest”. The general theme of the document would suggest that the concept of a public interest is designed to serve public authorities in the processing of data. It is very unlikely that such exceptions or legal protection that is afforded to someone acting in a “public interest” would be extended to anyone not directly connected with the governments or authorities of Member States. 
  
• A researcher therefore would not be able to use data freely on the basis that he/she was doing so to serve a “public interest”. If a private actor could rely on these “public interest” exceptions, it would open the floodgates to much bigger legal problems and we would therefore view a “public interest” to be actions taken by the public authorities of Member States in the pursuit of policy. Member States themselves have however requested clarification on this term. 
  
• Of importance are also the Conclusions of the European Council of 26-27 June 2014 (available here) which sets as objectives the adoption of the Regulation by 2015. This is less ambitious that the autumn Council Conclusions which still considered 2014 as a potential adoption date.