GDPR’s Stance on Biobank Data Sharing

A Critical View On The GDPR Stand On Sharing Biobank Data Within And Outside The EU Presented by: Mrs. Reichel and Mrs. Slokenberga Date: 17 February 2021 EU Gold Standard - Recital 4 GDPR: • - The processing of personal data should be designed to serve mankind Jan Philipp Albrecht, MΕΡ • "It is paramount to understand how the GDPR will change not only the European data protection laws but nothing less than the whole world as we know it." - Giovanni Buttarelli, EDPS • "The General Data Protection Regulation (GDPR) is going to raise the bar for data protection laws around the world." Chapter V GDPR Transfer Of EU Data Overseas - Objective: • - EU data subjects are to be protected wherever their data is processed. Article 44 GDPR: • All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined. - An adequacy decision - Appropriate safeguards, for ex - • Binding corporate rules • Standard data protection clauses • Code of conduct approved by a competent authority, • Contractual clauses approved by competent authority Derogations for exceptional situations Transfer Of Third Country Data Into The EU? - No specific rules - The GDPR is to be applied by controllers in the EU in its entirety - Supervision? "The Gold Standard": a view from Article 89 GDPR Central Features Of The Research Regime - Legal basis - Individual rights - Adequate safeguards Legal Basis - No straightforward equation Article 6(1)+9(2) • Combination estimation: 6x10 • How many of them are relevant to research? 5(?)x3(?) ... 5(?)x8(?) Individual Rights Under Chapter III - - - Direct applicability, Article 89.1 • Article 14.5, right to information • Article 17.3(d) right to be forgotten • Article 21.6, right to object Article 89.2 • Article 15, access rights • Article 16, rectification rights • Article 18, restriction of processing • Article 21, right to object Extraordinary circumstances • It depends. For example:  Can mute the data subject's right to object  Could allow for derogations from arts. 12-22, 34, and 5 How does Article 89.2 GDPR look in different Member States? - Refrained from implementation: • - Partial implementation: • - E.g. Croatia, Germany, Greece, Malta, The Netherlands, Portugal, Sweden E.g. Italy Full implementation: • E.g. Czech Republic, Denmark, Ireland, Latvia Adequate Safeguards - "Processing for ... scientific ... research ... shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject." (Article 89(1) GDPR • Different understanding of "appropriate safeguards" in the same field  Narrow  Broad • Potentially decisive role for "in accordance ..." Can the EU Gold Standard conquer the biomedical world? Legislating For Humanity? - Benvinisti: • "When states 'legislate for humanity' or otherwise form policies that seek global standards, it is rather evident that they should bear in mind the impact of their policies on others, and that they should balance the other's interest against their own". (The future of sovereignty: the nation state in the global governance space, in Research Handbook on Global Administrative Law, Sabino Cassesse (ed), Elgar, 2016, p. 492-3.) GDPR as consumer privacy law - Schwartze: • In short, the world has weighed in, and the EU is being rewarded for its success in the market place of regulatory ideas. (Schwartz, P. M. (2019). Global data privacy: The EU way. New York University Law Review, 94(4), 771-818.) GDPR as biomedical law? - - Traditional safeguards: Informed consent and ethical approval • Based on a common understanding manifested in conventions and soft law • Realized via MTAs and DTA Article 44 GDPR requirement for transfer of EU data • Does "ensuring the GDPR the level of protection” mean upholding the "appropriate safeguards" according to Article 89? GDPR as biomedical law? - Difficult to define a Gold Standard in biomedical law even within the EU - Impossible at the global level? - Golden for EU data subject only? • Import of data to the EU is (usually) fine, export complex • Fairness for researchers in third countries? • Public health justice?