Data protection and ethics requirements for multisite research with health data: a comparative examination of legislative governance frameworks and the role of data protection technologies†

TLDR

Personalised medicine promises improved health outcomes, yet the need to share patient data across institutions and jurisdictions is constrained by data protection, privacy, and research ethics laws that can impede multisite research. The study compares data‑accessibility provisions in data protection and research ethics laws across seven jurisdictions and proposes solutions to overcome legislative differences. The authors analyse seven jurisdictions—Switzerland, Italy, Spain, the UK, the US, Canada, and Australia—and propose organisational collaborations, data transfer agreements, and technical approaches such as distributed computing, secure multiparty computation, and homomorphic encryption to facilitate cross‑jurisdictional research. The paper finds that consent requirements, anonymisation or pseudonymisation standards, and adequacy of protection across jurisdictions, particularly differences between the EU and other regions, pose significant barriers to data sharing.

Abstract

Abstract Personalised medicine can improve both public and individual health by providing targeted preventative and therapeutic healthcare. However, patient health data must be shared between institutions and across jurisdictions for the benefits of personalised medicine to be realised. Whilst data protection, privacy, and research ethics laws protect patient confidentiality and safety they also may impede multisite research, particularly across jurisdictions. Accordingly, we compare the concept of data accessibility in data protection and research ethics laws across seven jurisdictions. These jurisdictions include Switzerland, Italy, Spain, the United Kingdom (which have implemented the General Data Protection Regulation), the United States, Canada, and Australia. Our paper identifies the requirements for consent, the standards for anonymisation or pseudonymisation, and adequacy of protection between jurisdictions as barriers for sharing. We also identify differences between the European Union and other jurisdictions as a significant barrier for data accessibility in cross jurisdictional multisite research. Our paper concludes by considering solutions to overcome these legislative differences. These solutions include data transfer agreements and organisational collaborations designed to `front load' the process of ethics approval, so that subsequent research protocols are standardised. We also allude to technical solutions, such as distributed computing, secure multiparty computation and homomorphic encryption.