Data protection and research in the European Union: a major step forward, with a step back

Published:October 20, 2020DOI:https://doi.org/10.1016/j.annonc.2020.10.472
      After a lengthy process that began in 2012, the General Data Protection Regulation 2016/679 (GDPR) of the European Union (EU) finally came into force on 25 May 2018.

      Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/oj.

      The past 8 years have seen numerous discussions surrounding the GDPR. Although health research is not one of its major focus areas, the GDPR has become a matter of great concern for the research community. After years of intense advocacy, supported by the entire European oncology community, the European Society for Medical Oncology (ESMO) and other co-signing parties found the final text of the GDPR to be a positive improvement over its originally approved version in 2014 by the European Parliament.
      European Parliament
      European Parliament website.
      ESMO welcomed the text’s recognition of the principle of ‘one-time consent’ for retrospective research and biobanking and the principle of ‘no consent’ for population-based registries, two concepts which were heavily advocated for by the oncology community over the years. However, the challenge of interpreting and implementing GDPR across all EU countries persists. In pursuing this goal, an EU body, the European Data Protection Board (EDPB) (which replaced the so called Article 29 Working Party) adopted guidelines, with some interpretations relating to scientific research, which are of major concern to the oncology community.

      European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679. Version 1.1. Adopted May 4, 2020. https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf.

      Certainly, many barriers remain in securing the future of research in the EU under a consistent and well-regulated framework.
      To read this article in full you will need to make a payment
      Subscribe to Annals of Oncology
      Already a print subscriber? Claim online access
      Already an online subscriber? Sign in
      Institutional Access: Sign in to ScienceDirect

      References

      1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/oj.

        • European Parliament
        European Parliament website.
        (Available at:)
        http://www.europarl.europa.eu
        Date: 2020
        Date accessed: February 24, 2020
      2. European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679. Version 1.1. Adopted May 4, 2020. https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf.

        • Casali P.G.
        • European Society for Medical Oncology (ESMO) Switzerland
        Risks of the new EU Data Protection Regulation: an ESMO position paper endorsed by the European oncology community.
        Ann Oncol. 2014; 25: 1458-1461
      3. Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32014R0536.