Cancer research put at risk by General Data Protection Regulation? The possible dangers of a data privacy EU mania

Embrace between Viviane Reding, Commissioner responsible for Justice, on the right, and Neelie Kroes, Commissioner in charge of Digital Agenda (EC Audiovisual Services, 1/07/2014)

One of the most important debate topics of the last months in the EU has been data privacy and data protection regulation. Whether it was for a major trade agreement proposal or for the biggest search engine of the world, it makes no difference since all data privacy stakeholders have been always kept busy. Having remained basically static for about two decades, data protection laws in Europe are on the verge of a big, soon-to-be-made review.

“Rapid technological developments and globalization have brought new challenges for the protection of personal data”, the European Parliament states through the official Draft Report of the General Data Protection Regulation (Recital 5), highlighting where lies the question that triggered the “revolution”. “Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. […] Technology has transformed both the economy and social life, and requires improved legal safeguards which will facilitate the free flow of data within the European Union and the transfer to third countries and international organisations, ensuring a high level of the protection of personal data”.

And if this is the European Union’s mission, I think that only just a few could moan about, or not agree with the above. So where is really the debate? Well, everything runs smoothly until the ‘renovation’ knocks the door of a bigger “house”: health. Or – to be precise – research.

Did you see this coming? Researchers around Europe are concerned that a regulation meant to protect cancer patients’ privacy may actually inhibit future progress in cancer research. The proposed EU General Data Protection Regulation specifically states that “explicit and specific patient consent” is needed for researchers to use their data or tissue samples. So, basically, researchers would have to approach patients every single time they need to consult their case or to add their tissue samples to a database, something that many scientists say would “put a halt to many public health research efforts.”

The last comment was part of a bigger statement published on July 25th by ESMO, the European Society for Medical Oncology, leading pan-European association representing medical oncology professionals, which has been so far the most fanatic opponent of the proposed regulation. “Hope for patients facing a life-threatening disease like cancer is based on advances in research,” said Kathy Oliver, Chair of the International Brain Tumour Alliance, through ESMO’s webpage. “And research progress requires access to a wide pool of patient data, even from patients who have since passed away and can no longer provide consent to allow for research that could save lives in the future”.

There’s also space for a proposal, within ESMO’s statement, which gathered the enthusiasms of many scientists and researchers of the continent. ESMO proposes that the text of the EU General Data Protection Regulation includes a ‘one-time consent’ for research, ensuring patients are aware of what they are consenting to, given the possibility to withdraw their consent at any time. “Our proposal achieves the correct balance between the right to privacy and the right to health”, said ESMO President Rolf A. Stahel. “It actually ‘empowers’ patients, allowing them to choose whether to donate their data and tissue for public health research, which has the ultimate goal of finding cures”.

President Stahel addressed the core of the question, I think: “the correct balance between the right to privacy and the right to health”. I recently said that finding the right balance in things is some kind of art and I’m also convinced that “balance” should always sound like “equilibrium”.

What I’m afraid of though is that there might be some kind of data-protection ‘mania’ in the EU recently, which is taking us a bit to the extremes, a bit beyond the scope that was foreseen. People’s privacy protection is something sacred, a value that must be protected and monitored with care, but I believe that handling the matter by considering privacy as the main pillar of the Union could be dangerous. A “privacy-protection-always-wins”-way does not exactly sound like “equilibrium”, I guess.

A brief consideration, as a conclusion: the economic crisis of the past few years has led to deep cuts in funding for scientific research in many European countries, especially in the South. In many areas researchers spend huge amounts of time and energy every day waiting for funds to be unlocked, or simply for approvals to come before they can start with their main activity. This takes the overall European research sector to a general condition of need to be more “fluid” in order to be competitive, and, most of all useful, to the European society and citizens. If research is one of the pillars of this Union – as I am definitely sure it is – then it’s easy to understand that removing obstacles as much as possible threats often sounds like making the difference.

The general consensus at the moment is that the final version of the Regulation will be adopted sometime in 2015 and come into force in 2017. The question remains, however, who is the man that is able to define the exact distance per millimeter between the two extremes in data protection? Who is able define the golden section weighing all the factors that compromise data privacy and research?

The debate will go on and so will the attention of the Sting in this major issue for the European citizen.