Julius Center for Health Sciences and Primary Care, University Medical Center Utrecht, Utrecht, The Netherlands.
Eur J Hum Genet. 2024 Jan;32(1):21-30. doi: 10.1038/s41431-023-01471-0. Epub 2023 Oct 17.
It is a common misunderstanding of current European data protection law that when consent is not being used as lawful basis, the processing of personal data is prohibited. Article 9(2)(j) of the European General Data Protection Regulation (GDPR) permits Member States to establish a legal basis in national law that allows for the processing of personal data for scientific research purposes without consent. However, the European legislator has formulated this "research exemption" as an opening clause, rendering the GDPR not specific as to what measures exactly are required to comply with the research exemption. This may have significant implications for both the protection of personal data and the advancement of data-intensive health research. We performed a systematic review of relevant soft law instruments and academic literature to identify what measures are mentioned in those documents. Our analysis resulted in the identification of four overarching themes of suggested measures: organizational measures; technical measures; oversight and review mechanisms; and public engagement and participation. Some of the suggested measures do not substantially contribute to the clarification of the GDPR's "suitable and specific measures" requirement because they remain vague or broad in nature and encompass all types of data processing. However, the themes oversight and review mechanisms and public engagement and participation provide valuable insights which can be put to practice. Nevertheless, further clarification of the measures and safeguards that should be installed when invoking the research exemption remains necessary.
当前，人们普遍对欧洲数据保护法存在误解，即认为在不使用同意作为合法依据的情况下，禁止处理个人数据。《欧盟一般数据保护条例》（GDPR）第 9 条第 2 款第（j）项允许成员国在国家法律中建立合法依据，允许在没有同意的情况下出于科研目的处理个人数据。然而，欧洲立法者将这条“研究豁免”表述为一个开放条款，这使得 GDPR 对于符合研究豁免需要采取哪些具体措施并未作出明确规定。这可能对个人数据保护和以数据为中心的健康研究的发展产生重大影响。我们对相关的软法律文书和学术文献进行了系统的回顾，以确定这些文件中提到了哪些措施。我们的分析确定了四项建议措施的总体主题：组织措施；技术措施；监督和审查机制；以及公众参与。其中一些建议措施并没有实质性地促进 GDPR 对“适当和具体措施”要求的澄清，因为它们仍然模糊或宽泛，涵盖了所有类型的数据处理。然而，监督和审查机制以及公众参与和参与这两个主题提供了有价值的见解，可以付诸实践。然而，在援引研究豁免时，仍有必要进一步澄清应安装的措施和保障措施。
