Ass. iur. Fritz-Ulli Pieper
Institute for Legal Informatics
Leibniz University Hanover
Linked2Safety Project (FP7-ICT-2011-7 – 5.3)
A NEXT-GENERATION, SECURE LINKED DATA MEDICAL INFORMATION SPACE FOR
SEMANTICALLY-INTERCONNECTING ELECTRONIC HEALTH RECORDS
AND CLINICAL TRIALS SYSTEMS
ADVANCING PATIENTS SAFETY IN CLINICAL RESEARCH
I.
II.
III.
IV.
V.
Introduction
Legal Implications of the Project
European Data Protection Framework
Legal Framework in Linked2Safety
Conclusions
FP7, ICT-2011 – 5.3
Page 2
FP7, ICT-2011 – 5.3
Page 3
• Legal advisors are not the killjoys!
• You have an idea? Great!
• We will try to show you the way through the legal
implications
FP7, ICT-2011 – 5.3
Page 4
FP7, ICT-2011 – 5.3
Page 5
• Medical/health research = information
• Medical diagnosis, procedures, treatments = patient data
• Applicable Data Protection Law? European Level!
• Data Protection Directive 46/95/EC
FP7, ICT-2011 – 5.3
Page 6
• Scope: Personal data, Art. 3 (1), Art. 2 (a) DPD
• any information relating to an identified or identifiable natural person
• account should be taken of all the means likely reasonably to be used to
identify the said person
• Health Data = Sensitive Data, Art. 8 (1)
• Special data deserve special protection
• Special rules for sensitive data
• Processing, Art. 2 (b), Section 7 (Criteria for legitimacy)
• Principles, Art. 6; exemptions, data subject rights, …
FP7, ICT-2011 – 5.3
Page 7
• Processing of health data, Art. 8
• Prohibited, Art. 8 (1)
• Art. 8 (2) „Paragraph 1 shall not apply where…“
• Explicit Consent, Art. 8 (2) (a)
• Necessary for vital interests w/o legal capability, Art. 8 (2) (c)
• Preventive medicine, medical diagnosis, …, Art. 8 (3)
• Art. 8 (4), Recital 34: Exemptions for scientific research
subject to suitable safeguards
FP7, ICT-2011 – 5.3
Page 8
• Three phases: Platform development, testing, exploitation
• Different types of data: Healthdata vs. Linked2Safety data
• includes genetic data – no way to anonymize!
• Actual personal data vs. anonymized data
• Anonymized data won‘t fall under the DP Directive
• Data-cube approach!
FP7, ICT-2011 – 5.3
Page 9
• „Data Privacy Framework“
• Informed Consent (obtained from patients by clinical partners), also
covering ethical background
• Anonymization
• Contractual agreements & organizational structure
• Research exemption
•
•
•
•
Data Governance Framework, Data Governance Mediator
Consent Forms
Data Transfer Agreement, User Agreement
Platform Manager Agreement
FP7, ICT-2011 – 5.3
Page 10
• High-level medical research has to take into account
complex data protection implications
• Changes within new DP Regulation?!
• Data protection princinples must be observed
• Further safeguards should be implemented
• Sound collaboration between medical, technical and legal
stakeholders
FP7, ICT-2011 – 5.3
Page 11
Ass. iur. Fritz-Ulli Pieper
Institute for Legal Informatics, Leibniz University Hanover
Fon: +49 (0)511 762 8282
Fax: +49 (0)511 762 8290
Email: pieper@iri.uni-hannover.de
FP7, ICT-2011 – 5.3
Page 12