Demystifying Schrems II for the cross-border transfer of clinical research data.
Demystifying Schrems II for the cross-border transfer of clinical research data.
复制标题
对临床研究数据的跨境转移的Schrems II神秘化。
DOI：
10.1093/jlb/lsab032
复制
发表时间：
2021-07
影响因子：
3.4
通讯作者：
Bierer BE
中科院分区：
文献类型：
--
作者：
Liss J;Peloquin D;Barnes M;Bierer BE
欧洲联盟法院(CJEU)在其2020年7月的Schrems II裁决中裁定，为了让其他国家的实体从欧洲经济区(EEA)进口个人数据，进口商必须能够提供与欧洲经济区根据其一般数据保护条例提供的“基本上等同”的数据保护。CJEU对美国国家安全情报收集法律阻止总部设在美国的实体提供此类保护表示特别关切。这一决定极大地限制了临床研究数据从EEA到美国的共享。在描述了Schrems II决定的相关方面之后，本文评估了美国国家安全情报收集框架，包括《外国情报监视法案》第702条和12333号行政命令。然后，本文利用欧洲数据保护委员会最近的指导草案来解释实体如何能够采用广泛使用的合同和技术措施，如数据假名，以在临床研究背景下提供“基本上同等”的保护。
The Courts of Justice of the European Union (CJEU) held in its July 2020 Schrems II decision that, in order for entities in other countries to import personal data from the European Economic Area (EEA), the importer must be able to provide data protections ‘essentially equivalent’ to those the EEA offers under its General Data Protection Regulation. The CJEU expressed particular concern that United States’ national security intelligence gathering laws prevent U.S.-based entities from providing such protections. This decision has sharply limited the sharing of clinical research data from the EEA to the United States. After describing the pertinent aspects of the Schrems II decision, this article evaluates U.S. national security intelligence gathering frameworks, including Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333. The article then leverages recent draft guidance from the European Data Protection Board to explain how entities may be able to adopt widely used contractual and technical measures, such as data pseudonymization, to provide ‘essentially equivalent’ protections in the clinical research context.