On 25 May 2018, the EU General Data Protection Regulation (GDPR) took full effect in law. Its impact on organizations around the world is both immediate and immense. After briefly outlining the nature of data protection law in Europe and the key changes in data protection law under the GDPR, I then offer a basis on which to assess the GDPR’s treatment of: 1) its territorial scope; 2) personal data; 3) conditions for processing “special categories” of personal data, including “genetic data” and “data concerning health”; 4) legal bases for processing personal data, including the role of consent in the research context; 5) processing sensitive data and processing data for scientific research purposes, including derogations from data subject rights afforded under the GDPR when personal data are processed for scientific research purposes; and lastly, 6) two other important considerations, namely the ability to re-use previously collected personal data for research purposes (i.e. secondary use), and international data transfers. This article stresses that the GDPR undeniably represents an improvement from the predecessor legislation – the 1995 EU Data Protection Directive – as it provides both greater regulatory certainty and flexibility for scientific research. At the same time, it remains to be seen whether the new rules will be implemented across Europe in a harmonized way that delivers the clarity and certainty it promises, for researchers and research participants alike. It also remains to be seen whether the new law contributes to fostering cross-European and international trust in organizations that make use of personal data. The GDPR provides a disconcerting degree of latitude for national and EU-level specification in several areas, including scientific research. There is thus a potential for national divergence and regulatory fragmentation, undermining the very purpose of an EU Regulation. Further steps are needed therefore to guide researchers and support staff; improve regulatory harmonization; address a culture of caution relating to regulatory compliance; and enhance responsible data sharing for the purpose of facilitating progress in scientific research and medical discovery. This article, in addition to providing an overview of the GDPR for the uninitiated as it relates to health research, also offers a modest way through some of these sticking points.

/pdf/the-eu-general-data-protection-regulation-implications-for-4lhnrx66tm.pdf

The EU General Data Protection Regulation: Implications for International Scientific Research in the Digital Era:

Observational health research in Europe: understanding the General Data Protection Regulation and underlying debate.

EMBO Reports (2019) e48316

Human genomic data have become an important and rich resource for biomedical and clinical research. At the same time, concerns about the identifiability of genomic data have been central to discussions regarding adequate protection of personal data and privacy. Addressing such concerns is paramount for research and clinical data repositories, as well as for ensuring interoperability of standards across jurisdictions. However, in spite of increased scholarly and policy scrutiny during the past decade, questions remain about when and if genomic data can be truly irreversibly de‐identified.

> … the new law in the EU mandates that data that has been merely pseudonymized is regarded as personal data that falls under its scope, while anonymous data would not be subject to the regulation.

These discussions have acquired renewed salience in Europe after the EU Regulation 2016/679, also known as the General Data Protection Regulation or GDPR (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN), came into effect. At its core, the GDPR mandates a decentralized, context‐specific and risk‐based approach to data protection with emphasis on the accountability of data controllers (Arts. 5(2) and 24) [1]. Additionally, under a so‐called “research exemption”, the GDPR allows for some flexibility for the processing of personal data for scientific research (Art. 9(2)(j)), and it relaxes the stringent requirements for specific consent (Recital 33) and data storage (Art. 5 (1)(e)). Moreover, it allows EU Member States to introduce further provisions for the processing of genetic, biometric, and health‐related data (Art. 9(4)).

The GDPR lists genetic data as “special categories of personal data” or sensitive data (Art. 9), which makes their processing for research purposes (Art. 9(2)(j)) subject to the adoption of adequate organizational and technical safeguards, such as pseudonymization (Art. 89(1)) [1], [2]. Pseudonymization is …

/pdf/re-identifiability-of-genomic-data-and-the-gdpr-assessing-1kswt95qn9.pdf

Re‐identifiability of genomic data and the GDPR: Assessing the re‐identifiability of genomic data in light of the EU General Data Protection Regulation

Although blockchain-based digital services promise trust, accountability, and transparency, multiple paradoxes between blockchains and GDPR have been highlighted in the recent literature. Some of the recent literature also proposed possible solutions to these paradoxes. This article aims to conduct a systematic literature review on GDPR compliant blockchains and synthesize the findings. In particular, the goal was to identify 1) the GDPR articles that have been explored in prior literature; 2) the relevant research domains that have been explored, and 3) the research gaps. Our findings synthesized that the blockchains relevant GDPR articles can be categorized into six major groups, namely data deletion and modification (Article 16, 17, and 18), protection by design by default (Article 25), responsibilities of controllers and processors (Article 24, 26, and 28), consent management (Article 7), data processing principles and lawfulness (Article 5,6 and 12), and territorial scope (Article 3). We also found seven research domains where GDPR compliant blockchains have been discussed, which include IoT, financial data, healthcare, personal identity, online data, information governance, and smart city. From our analysis, we have identified a few key research gaps and present a future research direction.

GDPR Compliant Blockchains–A Systematic Literature Review

From an individual’s perspective, technological advancement has merits and demerits. Video captured by surveillance cameras while a person goes about their daily life may improve their personal safety but the images collected may also represent an invasion of their privacy. Because of the ease of digital information sharing, there exists a need to protect that visual information from illegal utilization by untrusted parties. The European parliament has ratified the General Data Protection Regulation (GDPR), which has been effective since May 2018 with a view to ensuring the privacy of European Union (EU) citizens’ and visitors’ personal data. The regulation has introduced data safeguards through Pseudonymisation, Encryption, and Data protection-by-design. However, the regulation does not assist with technical and implementation procedures, such as video redaction, to establish those safeguards. This paper refers to the GDPR term “personal data” as “visual personal data” and aims to discuss regulatory safeguards of visual privacy, such as reversible protection, from the technological point-of-view. In the context of GDPR, the roles of machine learning (i.e. within computer vision), image processing, cryptography, and blockchain are explored as a way of deploying Data Protection-by-Design solutions for visual surveillance data. The paper surveys the existing market-based data protection solutions and provides suggestions for the development of GDPR-compliant Data Protection-by-Design video surveillance systems. The paper is also relevant for those entities interacting with EU citizens from outside the EU and for those regions not currently covered by such regulation that may soon implement similar provisions.

/pdf/visual-surveillance-within-the-eu-general-data-protection-2j3wjyvutr.pdf

Visual Surveillance Within the EU General Data Protection Regulation: A Technology Perspective

Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK

IntroductionAnalysis of linked health data can generate important, even life-saving, insights into population health. Yet obstacles both legal and organisational in nature can impede this work. 
ApproachWe focus on three UK infrastructures set up to link and share data for research: the Administrative Data Research Network, NHS Digital, and the Secure Anonymised Information Linkage Databank. Bringing an interdisciplinary perspective, we identify key issues underpinning their challenges and successes in linking health data for research.
ResultsWe identify examples of uncertainty surrounding legal powers to share and link data, and around data protection obligations, as well as systemic delays and historic public backlash. These issues require updated official guidance on the relevant law, approaches to linkage which are planned for impact and ongoing utility, greater transparency between data providers and researchers, and engagement with the patient population which is both high-profile and carefully considered. 
ConclusionsHealth data linkage for research presents varied challenges, to which there can be no single solution. Our recommendations would require action from a number of data providers and regulators to be meaningfully advanced. This illustrates the scale and complexity of the challenge of health data linkage, in the UK and beyond: a challenge which our case studies suggest no single organisation can combat alone. Planned programmes of linkage are critical because they allow time for organisations to address these challenges without adversely affecting the feasibility of individual research projects.

/pdf/health-data-linkage-for-uk-public-interest-research-key-29n0dc4hf3.pdf

Health Data Linkage for UK Public Interest Research: Key Obstacles and Solutions.

Researchers and practitioners in the fairness community have highlighted the ethical and legal challenges of using biased datasets in data-driven systems, with algorithmic bias being a major concern. Despite the rapidly growing body of literature on fairness in algorithmic decision-making, there remains a paucity of fairness scholarship on machine learning algorithms for the real-time detection of crime. This contribution presents an approach for fairness-aware machine learning to mitigate the algorithmic bias / discrimination issues posed by the reliance on biased data when building law enforcement technology. Our analysis is based on RWF-2000, which has served as the basis for violent activity recognition tasks in data-driven law enforcement projects. We reveal issues of overrepresentation of minority subjects in violence situations that limit the external validity of the dataset for real-time crime detection systems and propose data augmentation techniques to rebalance the dataset. The experiments on real world data show the potential to create more balanced datasets by synthetically generated samples, thus mitigating bias and discrimination concerns in law enforcement applications.

/pdf/data-augmentation-for-fairness-aware-machine-learning-2wmzmkcr.pdf

Stergios Aidinlis

Papers

Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK

Health Data Linkage for UK Public Interest Research: Key Obstacles and Solutions.

Data augmentation for fairness-aware machine learning: Preventing algorithmic bias in law enforcement systems

Governance of academic research data under the GDPR—lessons from the UK

Balancing Data Subjects’ Rights and Public Interest Research: