COVID-19: Putting the General Data Protection Regulation to the Test

As the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) continues to spread around the globe, researchers are racing to understand and contain the pandemic, learn how to best treat patients with SARS-CoV-2 infection and the resulting coronavirus disease (COVID-19), and develop a vaccine. The COVID-19 pandemic is also very much a global health issue and requires collaborative, international health research efforts to address it. A valuable source of information for researchers is the large amount of digital health data that are continuously collected by the electronic health record systems of health care organizations. However, such digital health data typically exists in separate systems and researchers in many countries are currently severely hamstrung by the lack of integrated and comprehensive, publicly available, patient-level data regarding COVID-19. They are having to derive answers from limited analyses of small case series, while large amounts of relevant digital health data sits unexamined on hospital servers around the world. This situation has led to calls for a common, multinational, COVID-19 database to be created, pointing to the Medical Information Mart for Intensive Care (MIMIC) database at the Beth Israel Deaconess Medical Center in Boston as a model for publicly sharing deidentified electronic health data [1].

While setting up COVID-19-related databases for research makes obvious sense from a research perspective, there is also currently a broader societal reason why this is a good idea. Indeed, the COVID-19 pandemic has put solidarity into strong focus; many ongoing measures to contain the spread have been described as solidarity practices—that is, as prosocial behaviors to help and/or protect others, or collective resources such as health care systems, that are based on the recognition of a shared interest. Health databases and biobanks have also previously been framed as solidarity-based endeavors, and solidarity-based governance models have been proposed to reflect the prosocial motivation many people have toward such resources, which at the same time avoid some of the burden of the usual restrictive, autonomy-based governance models [2].

As the total deaths from COVID-19 continues to increase globally, the ethical and social imperative to quickly curtail the pandemic is clear. However, this does not negate the need for the use of digital health data to respect data protection regulations and patient privacy and confidentiality [3]. In fact, although the scale of COVID-19 is clearly new, the ethical challenge of balancing confidentiality with public health has been well discussed [4-7].

With the epicenter of the pandemic currently shifting from Europe to the United States, the European Union’s (EU) General Data Protection Regulation (GDPR) will be the key legal framework with regard to using and sharing European digital health data for research purposes [8]. However, concerns persist that the GDPR has made many organizations very risk-averse in terms of data sharing, even if the regulation permits such sharing. Health care organizations focusing on individual risk minimization threaten to undermine COVID-19 research efforts.

The European Data Protection Board has stressed the importance of protecting personal data during the COVID-19 pandemic. However, it has also noted: “Data protection rules (such as GDPR) do not hinder measures taken in the fight against the coronavirus pandemic” [9]. Indeed, article 9(2)(i) of the GDPR explicitly allows the processing of sensitive personal data (including genetic data, biometric data, and data concerning health) if it is “necessary for reasons of public interest in the area of public health.” Recitals 46, 52, 53, and 54 also explicitly acknowledge the need to sometimes process special categories of personal data for reasons of public interest in the area of public health.

Furthermore, article 9(2)(j) sets out a scientific research exemption for the processing of sensitive personal data, which could occur without consent if subject to appropriate safeguards, which may include pseudonymization (deidentification) (see article 89(1)) (Table 1). Researchers and health care organizations wanting to utilize and share patient-level data regarding COVID-19 from data subjects residing in the EU will need to be aware of the following:

• The GDPR applies to any personal data concerning an identified or identifiable natural person, but not to anonymous information. As the GDPR does not distinguish between anonymized and anonymous data, databases collecting identifiable data for research purposes will be excluded from the scope of the GDPR if the data are later rendered anonymized [8,10].
• Pseudonymized data is now recognized as personal data if it could be attributed to a natural person by the use of additional information. Given pseudonymized health data is what health care databases typically use, recognizing pseudonymized data as personal data may result in more bureaucracy, particularly for those countries that currently consider pseudonymized data to fall outside the scope of personal data [8,10].
• The processing of special categories of personal data (“sensitive personal data”), including genetic data, biometric data, and data concerning health, shall be prohibited under the GDPR unless certain conditions applies. Health care databases using pseudonymized sensitive personal data will need to either obtain explicit consent from the data subject or for the data to be processed under the scientific research exemption set out in the GDPR, which could occur without consent if subject to appropriate technical and organizational safeguards [8,10].

In our opinion, there is an ethical obligation to use the GDPR scientific research exemption clause during the COVID-19 pandemic to support global collaborative health research efforts. However, while the provision is there, researchers and research institutions in Europe have been reluctant to use it, likely due to fear of the difficulties that may be caused by their national bodies. In fact, consortia funded in the current H2020 funding scheme by the European Commission have overwhelmingly used other more burdensome legal justifications, such as informed consent, than the research exemption.

This is not sufficient for the current situation. COVID-19 is a real test for the GDPR. There is a strong ethical case that countries use the regulatory leeway the GDPR provides for enabling health data to be used for research purposes and that they support health care organizations and investigators to invoke the research exemption confidently in the context of a global pandemic. Recent research in some European countries also suggests that many people would accept the secondary use of their data for health-related research under the research exemption, based on prosocial motivations such as solidarity [11]. Solidarity is a European value, and here is a chance to exemplify it by using the GDPR regulatory framework in a way that does not hinder but actually fosters solidarity during the COVID-19 pandemic.