New data protection rules being proposed for the European Union would make conducting research using data in the EU “impractical”, the Department of Health says.
A proposed General Data Protection Regulation would require researchers to request explicit and time limited consent from citizens for using either identifiable, pseudonymised or linked data.
A report from DH deputy director of research information and intelligence, Peter Knight, to the Informatics Services Commissioning Group, says current UK health legislation means researchers conducting research in the public interest do not have to get consent for access to sensitive personal data in an identifiable form.
If passed, the new EU regulation would “make accessing sensitive personal information difficult”, Knight says, as researchers would need consent from individuals to use not only identifiable, but also pseudonymised or linked data.
“Therefore, conducting research in the EU, using data, would become impractical to do,” he concludes.
The new regulations are not likely to go before the EU parliament until 2015.
“The UK Government, via the Ministry of Justice, is negotiating with member states in Europe and is aware of the impact that the LIBE proposal would have on research,” Kinght’s paper says.
“For example, UK Biobank would need to take explicit and time limited consent for any research project it undertakes, instead of been able to support a range of research purposes as it can now using its existing consenting mechanism.”
Data anonymised at source would not be impacted by the proposed new rules.
The issue is timely because of discussions around the creation of the care.data programme in the UK. This will expand the Hospital Episode Statistics and link them to other healthcare data sets, starting with information extracted from GP practices.
The plan is to make the resulting new Care Episode Statistics available to researchers and the scheme has been backed by 40 UK medical research charities.
However, data-sharing in this form would be incompatible with the proposed new EU regulation because UK patients have not given their explicit consent. Instead, there is an opt-out process in place for patients who do not wish to have their data extracted.