Search Results
Biobank Oversight and Sanctions Under the General Data Protection Regulation
2021, Hallinan, Dara, Slokenberga, Santa, Tzortzatou, Olga, Reichel, Jane
This contribution offers an insight into the function and problems of the oversight and sanctions mechanisms outlined in the General Data Protection Regulation as they relate to the biobanking context. These mechanisms might be considered as meta-mechanisms—mechanisms relating to, but not consisting of, substantive legal principles—functioning in tandem to ensure biobank compliance with data protection principles. Each of the mechanisms outlines, on paper at least, comprehensive and impressive compliance architecture—both expanding on their capacity in relation to Directive 95/46. Accordingly, each mechanism looks likely to have a significant and lasting impact on biobanks and biobanking. Despite this comprehensiveness, however, the mechanisms are not immune from critique. Problems appear regarding the standard of protection provided for research subject rights, regarding the disproportionate impact on legitimate interests tied up with the biobanking process—particularly genomic research interests—and regarding their practical implementability in biobanking.
Broad consent under the GDPR : an optimistic perspective on a bright future
2020, Hallinan, Dara
Broad consent-the act of gaining one consent for multiple potential future research projects-sits at the core of much current genomic research practice. Since the 25th May 2018, the General Data Protection Regulation (GDPR) has applied as valid law concerning genomic research in the EU and now occupies a dominant position in the legal landscape. Yet, the position of the GDPR concerning broad consent has recently been cause for concern in the genomic research community. Whilst the text of the GDPR apparently supports the practice, recent jurisprudence contains language which is decidedly less positive. This article takes an in-depth look at the situation concerning broad consent under the GDPR and-despite the understandable concern flowing from recent jurisprudence-offers a positive outlook. This positive outlook is argued from three perspectives, each of which is significant in defining the current, and ongoing, legitimacy and utility of broad consent under the GDPR: The principled, the legal technical, and the practical. © 2020 The Author(s).
The genomic data deficit : On the need to inform research subjects of the informational content of their genomic sequence data in consent for genomic research
2020, Hallinan, Dara
Research subject consent plays a significant role in the legitimation of genomic research in Europe – both ethically and legally. One key criterion for any consent to be legitimate is that the research subject is ‘informed’. This criterion implies that the research subject is given all relevant information to allow them to decide whether engaging with a genomic research infrastructure or project would be normatively desirable and whether they wish to accept the risks associated with engagement. This article makes the normative argument that, in order to be truly ‘informed’, the research subject should be provided with information on the informational content of their genomic sequence data. Information should be provided, in the first instance, prior to the initial consent transaction, and should include: information on the fact that genomic sequence data will be collected and processed, information on the types of information which can currently be extracted from sequence data and information on the uncertainties surrounding the types of information which may eventually be extractable from sequence data. Information should also be provided, on an ongoing basis, as relevant and necessary, throughout the research process, and should include: information on novel information which can be extracted from sequence data and information on the novel uses and utility of sequence data. The article argues that current elaborations of ‘informed’ consent fail to adequately address the requirements set out in the normative argument and that this inadequacy constitutes an issue in need of a solution. The article finishes with a set of observations as to the fora best suited to deliver a solution and as to the substantive content of a solution. © 2020 The Authors
Data Protection Impact Assessments in Practice: Experiences from Case Studies
2022, Friedewald, Michael, Schiering, Ina, Martin, Nicholas, Hallinan, Dara, Katsikas, Sokratis, Lambrinoudakis, Costas, Cuppens, Nora, Mylopoulos, John, Kalloniatis, Christos, Meng, Weizhi, Furnell, Steven, Pallas, Frank, Pohle, Jörg, Sasse, M. Angela, Abie, Habtamu, Ranise, Silvio, Verderame, Luca, Cambiaso, Enrico, Vidal, Jorge Maestre, Monge, Marco Antonio Sotelo
In the context of the project A Data Protection Impact Assessment (DPIA) Tool for Practical Use in Companies and Public Administration an operationalization for Data Protection Impact Assessments was developed based on the approach of Forum Privatheit. This operationalization was tested and refined during twelve tests with startups, small- and medium sized enterprises, corporations and public bodies. This paper presents the operationalization and summarizes the experience from the tests.
International transfers of personal data for health research following Schrems II: a problem in need of a solution
2021, Hallinan, Dara, Bernier, Alexander, Cambon-Thomsen, Anne, Crawley, Francis P., Dimitrova, Diana, Bauzer Medeiros, Claudia, Nilsonne, Gustav, Parker, Simon, Pickering, Brian, Rennes, Stéphanie
On 16 July 2020, the Court of Justice of the European Union issued their decision in the Schrems II case concerning Facebook's transfers of personal data from the EU to the US. The decision may have significant effects on the legitimate transfer of personal data for health research purposes from the EU. This article aims: (i) to outline the consequences of the Schrems II decision for the sharing of personal data for health research between the EU and third countries, particularly in the context of the COVID-19 pandemic; and, (ii) to consider certain options available to address the consequences of the decision and to facilitate international data exchange for health research moving forward.
Information Provision for Informed Consent Procedures in Psychological Research Under the General Data Protection Regulation: A Practical Guide
2023, Hallinan, Dara, Boehm, Franziska, Külpmann, Annika Iris, Elson, Malte
Psychological research often involves the collection and processing of personal data from human research participants. The European General Data Protection Regulation (GDPR) applies, as a rule, to psychological research conducted on personal data in the European Economic Area (EEA)—and even, in certain cases, to psychological research conducted on personal data outside the EEA. The GDPR elaborates requirements concerning the forms of information that should be communicated to research participants whenever personal data are collected directly from them. There is a general norm that informed consent should be obtained before psychological research involving the collection of personal data directly from research participants is conducted. The information required to be provided under the GDPR is normally communicated in the context of an informed consent procedure. There is reason to believe, however, that the information required by the GDPR may not always be provided. Our aim in this tutorial is thus to provide general practical guidance to psychological researchers allowing them to understand the forms of information that must be provided to research participants under the GDPR in informed consent procedures.
Data Sharing Under the General Data Protection Regulation: Time to Harmonize Law and Research Ethics?
2021, Vlahou, Antonia, Hallinan, Dara, Apweiler, Rolf, Argiles, Angel, Beige, Joachim, Benigni, Ariela, Bischoff, Rainer, Black, Peter C., Boehm, Franziska, Ceraline, Jocelyn, Chrousos, George P., Delles, Christian, Evenepoel, Pieter, Fridolin, Ivo, Glorieux, Griet, van Gool, Alain J., Heidegger, Isabel, Ioannidis, John P. A., Jankowski, Joachim, Jankowski, Vera, Jeronimo, Carmen, Kamat, Ashish M., Masereeuw, Rosalinde, Mayer, Gert, Mischak, Harald, Ortiz, Alberto, Remuzzi, Giuseppe, Rossing, Peter, Schanstra, Joost P., Schmitz-Draeger, Bernd J., Spasovski, Goce, Staessen, Jan A., Stamatialis, Dimitrios, Stenvinkel, Peter, Wanner, Christoph, Williams, Stephen B., Zannad, Faiez, Zoccali, Carmine, Vanholder, Raymond
The General Data Protection Regulation (GDPR) became binding law in the European Union Member States in 2018, as a step toward harmonizing personal data protection legislation in the European Union. The Regulation governs almost all types of personal data processing, hence, also, those pertaining to biomedical research. The purpose of this article is to highlight the main practical issues related to data and biological sample sharing that biomedical researchers face regularly, and to specify how these are addressed in the context of GDPR, after consulting with ethics/legal experts. We identify areas in which clarifications of the GDPR are needed, particularly those related to consent requirements by study participants. Amendments should target the following: (1) restricting exceptions based on national laws and increasing harmonization, (2) confirming the concept of broad consent, and (3) defining a roadmap for secondary use of data. These changes will be achieved by acknowledged learned societies in the field taking the lead in preparing a document giving guidance for the optimal interpretation of the GDPR, which will be finalized following a period of commenting by a broad multistakeholder audience. In parallel, promoting engagement and education of the public in the relevant issues (such as different consent types or residual risk for re-identification), on both local/national and international levels, is considered critical for advancement. We hope that this article will open this broad discussion involving all major stakeholders, toward optimizing the GDPR and allowing a harmonized transnational research approach.