The GDPR and the research exemption: considerations on the necessary safeguards for research biobanks

TLDR

The GDPR, effective May 2018, sets a high level of personal data protection that can constrain scientific research, yet it offers a two‑level derogation framework requiring technical and organisational safeguards and member‑state law to allow research use. This article reviews soft legal tools, international treaties, and other instruments governing health research data to assess their compatibility with the GDPR and to discuss limits and safeguards for derogations. The authors examined these instruments to identify guidance on safeguards that should accompany any GDPR derogation. The review shows that the GDPR and Article 89 align with many existing instruments but also reveal gaps, highlighting the need for clear safeguards to meet ethical standards.

Abstract

The General Data Protection Regulation (GDPR) came into force in May 2018. The aspiration of providing for a high level of protection to individuals' personal data risked placing considerable constraints on scientific research, which was contrary to various research traditions across the EU. Therefore, along with the set of carefully outlined data subjects' rights, the GDPR provides for a two-level framework to enable derogations from these rights when scientific research is concerned. First, by directly invoking provisions of the GDPR on a condition that safeguards that must include 'technical and organisational measures' are in place and second, through the Member State law. Although these derogations are allowed in the name of scientific research, they can simultaneously be challenging in light of the ethical requirements and well-established standards in biobanking that have been set forth in various research-related soft legal tools, international treaties and other legal instruments. In this article, we review such soft legal tools, international treaties and other legal instruments that regulate the use of health research data. We report on the results of this review, and analyse the rights contained within the GDPR and Article 89 of the GDPR vis-à-vis these instruments. These instruments were also reviewed to provide guidance on possible safeguards that should be followed when implementing any derogations. To conclude, we will offer some commentary on limits of the derogations under the GDPR and appropriate safeguards to ensure compliance with standard ethical requirements.