European data laws – where privacy meets progress in research

In the 1970s just one in four people with cancer survived for at least 10 years in the UK. Today half do. And research is behind this progress.

Yet, right now, a new law being negotiated by European policy makers in Brussels threatens how researchers across Europe – including our own – do their job.

The Data Protection Regulation looks at how people’s personal data is used across all sectors, from telecoms through to research.

Its impetus comes from a widespread concern that existing rules don’t go far enough in protecting peoples’ personal information, for example when they go online.

Of course, protecting privacy is a priority we all share. And we’ve already expressed serious concerns about what certain parts of this bill might mean for research.

Now, it seems some of these concerns have been heard. Last week, the latest round of changes to the bill emerged, and we’re really pleased with the outcome.

So what’s changed?

Finding a place for research

The European Commission – the institution responsible for drafting new laws in Europe – proposed the legislation back in 2012. This draft was then passed to the European Parliament and the Council of Ministers (made up of EU country representatives) for approval.

The original bill suggested consent should always be given before personal data is used, which makes a lot of sense.

But it also contained a key exemption to protect certain types of research. This was because access to people’s data for research is already very tightly regulated.

Personal data can only be handled by trained researchers who have contractual obligations to keep data safe. And in the UK, ethics committees ensure personal data use is appropriate and secure.

So a carefully worded clause in the EU bill meant researchers weren’t obliged to seek people’s consent, as these safeguards are already in place.

But problems surfaced when the bill went to the European Parliament, where members voted to scrap this exemption.

We weren’t happy.

But, just last week, the Council of Ministers published an update on the European Commission’s proposal. Crucially, they have backed the Commission’s original exemption for research, which is fantastic news. They also emphasised the value of safeguarding research – a very important addition.

We must now ensure the final Regulation strikes the right balance between protecting privacy while allowing vital research to continue.

For this to happen, it’s vital the exemption that protects research is included in the final text.

Sharing data

Getting consent from patients to use their personal data is a vital part of research, and more often than not researchers will seek consent from individuals.

That said, introducing a legal obligation to seek consent could create real problems for research studies.

Let’s take the European Prospective Investigation into Cancer and Nutrition (EPIC), a pan European study that Cancer Research UK part funds, for example.

EPIC is an invaluable study that examines the link between cancer and lifestyle factors, like obesity, and involves half a million people across 10 European countries, all of whom already gave consent when they signed up for the study in the 1990s.

The EPIC data is now a treasure trove for researchers, and is frequently used to make new discoveries. So imagine the cost and time spent tracing all those people to ask for consent, all over again, if researchers wanted to use these data for further research – and the delay it would cause to a study that is ultimately seeking to make life better for all of us.

But it’s not just about the practicalities of carrying out research. In some studies, asking for consent to use data that’s already protected can even skew research findings, undermining the results. This is because the same types of people tend to agree – or refuse – to share their data. And these less representative studies introduce bias which could lead to unreliable conclusions.

What happens next?

Talks between the three EU institutions – the European Commission, European Parliament and Council of Ministers – can now begin to agree on a final version of the Regulation. We anticipate that they will last for some months.

Now is a vital time for research in Europe, and ultimately for the health of people across the continent. If policymakers in Brussels get it right, they could help strike a crucial balance between safeguarding privacy and ensuring that life-saving research on cancer, and other diseases, can continue.

Catherine Guinard is a public affairs manager at Cancer Research UK

• Cancer Research UK is proud to be part of a pan-European digital campaign that aims to inform and influence EU policymakers who are active on the file. Find out more by visiting the website or by following the campaign on Twitter: @datamattersEU.