As the European parliament prepares to adopt its plenary position on the proposed new EU data protection regulation, the debate around privacy, health data and medical research has intensified. On the one hand, medical research organisations warn that some of the provisions could have serious repercussions on research. On the other, the public and health bodies are rightly concerned about who is collecting their data, how it is being used and whether it is being passed on to unknown third parties.
One of the core aims of European data protection reform is to give people greater control over how their data is used and by whom. Confidentiality and consent in regard to health data are therefore core principles which MEPs are seeking to safeguard. My group, the Alliance of Liberals and Democrats for Europe (ALDE) is very keen to facilitate improvements in treatment and innovation in healthcare and fully supports the crucial role of medical research and data-sharing in driving and helping to prevent and cure diseases. This is somewhat personal for me as I have a family member with type one diabetes and a link to work on diabetes research.
But we cannot disregard the importance of data protection as a fundamental right. Health and genetic data are highly sensitive, so it is essential to protect the confidentiality, privacy and security of such data and ensure public trust. I strongly regret that the UK government’s care.data plan to upload all health records into a centralised database has been badly managed and fails to garner the necessary trust, with a potentially severe knock-on effect in undermining confidence in research.
The aim of using the impressive resource of the UK’s national health service (NHS) patient data to improve healthcare and medical research is a good idea in principle. However, the entirely unsatisfactory absence of transparency and clarity over the project and its implications has caused an understandable outcry, such that, at a late stage its implementation had to be delayed to try and retrieve the situation. People must have confidence that they can speak frankly and openly to doctors and nurses without fear of where this information will end up.
I indeed have concerns about whether robust safeguards are in place. Being notified by an unaddressed ‘junk mail’ leaflet, which two out of three adults say they have not received, and which says an opt-out is available without offering any prescribed form, is wholly inadequate. Skimping on the preparation has been a false economy and it is no wonder the public is confused and suspicious.
"Thanks to my efforts parliament’s civil liberties, justice and home affairs committee approved the use of a ‘broad consent’ facility rather than the ‘repeat consent’ proposal from the Greens rapporteur"
There needs to be much greater public engagement on these issues, so I am glad that the house of commons health committee has launched an inquiry into care.data. I also welcome the confirmation by Liberal Democrat justice minister Simon Hughes that the UK government plans to extend to NHS bodies the compulsory audit powers of the information commissioner (the UK’s data protection authority) so that there can be public accountability over the use of data in the NHS.
I believe that support for medical research and allowing an individual to be able to choose how this data is used are not mutually exclusive. As a Liberal Democrat, I have been working to ensure that the new EU data protection rules respect both privacy rights and the public interest in the legitimate and secure processing of data for medical research. As lead MEP for the ALDE group in the negotiations on this issue in the parliament, I have sought to achieve the right balance in the legislation.
The right of the individual to choose what happens with their data and how it is used will be protected through the continuing consent requirement. Thanks to my efforts, parliament’s civil liberties, justice and home affairs committee approved the use of a ‘broad consent’ facility rather than the ‘repeat consent’ proposal from the Greens rapporteur, which would be impractical and over-restrictive towards medical research. MEPs also reached agreement that member states may allow exemptions from the consent requirement for research, under strict conditions – including that it serves a high public interest and the data is anonymised, or at least pseudonymised. I would have preferred the possibility of an EU-wide derogation from consent, again under strict conditions, but that was not achievable within the parliament.
The parliament’s text is not perfect, as it represents a compromise between the political groups. But with the council yet to reach its common position, the debate around medical research, health data and privacy is far from over.