Reconciling the biomedical data commons and the GDPR: three lessons from the EUCAN ELSI collaboratory.
Reconciling the biomedical data commons and the GDPR: three lessons from the EUCAN ELSI collaboratory.
复制标题
DOI：
10.1038/s41431-023-01403-y
复制
发表时间：
2024-01
期刊：
影响因子：
--
通讯作者：
中科院分区：
文献类型：
--
作者：
欧盟《通用数据保护条例》（GDPR）的生效是法律的承认可执行的信息自决权的分水岭。然而，适用于数据使用的法律的要求的迅速演变有可能超过生物医学数据用户网络应对不断变化的规范的能力。它还可以使负责评估和授权下游数据使用的既定机构丧失合法性，包括研究伦理委员会和机构数据保管人。这些负担对于具有跨国规模的临床和研究网络尤其明显，因为从欧洲经济区向外国际数据传输的法律的合规负担特别高。因此，欧盟的立法机构、法院和监管机构应该实施以下三项法律的变革。首先，数据共享网络中特定行为者的责任应通过合作者之间的责任分配合同加以界定。其次，通过安全的数据处理环境使用数据不应触发GDPR的国际传输条款。第三，使用联合数据分析方法，不允许分析节点或下游用户访问可识别的个人数据作为这些分析的输出的一部分，不应被视为共同所有权的情况，也不应导致不可识别数据的用户被视为控制者或处理者。对GDPR的这些小的澄清或修改将促进临床医生和研究人员之间的生物医学数据交换。
The coming-into-force of the EU General Data Protection Regulation (GDPR) is a watershed moment in the legal recognition of enforceable rights to informational self-determination. The rapid evolution of legal requirements applicable to data use, however, has the potential to outstrip the capabilities of networks of biomedical data users to respond to the shifting norms. It can also delegitimate established institutional bodies that are responsible for assessing and authorising the downstream use of data, including research ethics committees and institutional data custodians. These burdens are especially pronounced for clinical and research networks that are of transnational scale, because the legal compliance burden for outbound international data transfers from the EEA is especially high. Legislatures, courts, and regulators in the EU should therefore implement the following three legal changes. First, the responsibilities of particular actors in a data sharing network should be delimited through the contractual allocation of responsibilities between collaborators. Second, the use of data through secure data processing environments should not trigger the international transfer provisions of the GDPR. Third, the use of federated data analysis methodologies that do not provide analysis nodes or downstream users access to identifiable personal data as part of the outputs of those analyses should not be considered circumstances of joint controllership, nor lead to the users of non-identifiable data to be considered controllers or processors. These small clarifications of, or modifications to, the GDPR would facilitate the exchange of biomedical data amongst clinicians and researchers.
登录
查看更多内容
对临床研究数据的跨境转移的Schrems II神秘化。
影响因子：
3.4
作者：
Liss J;Peloquin D;Barnes M;Bierer BE
通讯作者：
Bierer BE
影响因子：
1.6
作者：
Murtagh, Madeleine J.;Turner, Andrew;Burton, Paul R.
通讯作者：
Burton, Paul R.
影响因子：
12.7
作者：
Myers, Julie;Frieden, Thomas R.;Henning, Kelly J.
通讯作者：
Henning, Kelly J.
影响因子：
3.9
作者：
Devriendt, Thijs;Shabani, Mahsa;Borry, Pascal
通讯作者：
Borry, Pascal
影响因子：
2.1
作者：
Pormeister, Kart
通讯作者：
Pormeister, Kart