GDPR Brief: navigating international data transfers under GDPR — impediments facing US federal science agencies and research universities

22 Oct 2021

The GDPR represents the most progressive measure to protect individual privacy in twenty years, and is rapidly becoming a global baseline, considered by many as model legislation.

The current state-of-play
The GDPR represents the most progressive measure to protect individual privacy in twenty years, and is rapidly becoming a global baseline, considered by many as model legislation. The territorial reach of the regulation demonstrates what has been coined the “Brussels effect:” the capacity of the EU to forge sectoral standards as a condition of market access, which in turn are adopted by international and domestic firms to minimize burdens of pursuing separate compliance requirements. However, as an omnibus regulation, the general principles that apply to banking, private commerce and other forms of processing apply to publicly funded biomedical research, with some conditional exceptions.

Since the GDPR’s enactment in May 2018, the biomedical science community has been caught in a metaphorical crossfire, struggling to find an admissible legal basis for long-term international data transfers.

International data transfers under the GDPR are particularly problematic for US federal agencies such as the National Institutes of Health (NIH), the single largest source of biomedical research support in the world. Presently, there are no international transfer mechanisms readily available to US federal agencies. EU counterparts are not pursuing international agreements or administrative arrangements under Article 46; standard contractual clauses, codes of conduct and certification mechanisms under Article 46 are not feasible for governmental bodies; and there is reluctance to make use of Article 49 derogations, which constitute exceptions to the main rules of data protection law in limited circumstances, in the absence of an adequacy decision or appropriate safeguards.. US public agencies are unable to comply with Article 46 obligations, due to principles of sovereign immunity and statutory conflict. These include provisions specifying indemnification, judicial redress, auditing of data systems by a foreign entity and submitting to the jurisdiction of foreign courts. Article 46 transfer mechanisms have become even less flexible following the increased requirements for international transfers following the Schrems II decision.

The result is a system of distributed analysis: rather than share data in real time, highly productive groups such as the International Genomics of Alzheimer’s Project and others must run identical but isolated analyses, and then pool results using summary meta-analysis. The approach yields data of reduced scientific value, constrains the number of research questions that can be explored, is more costly, and inefficient.

As one stark example, research oncologists at NIH’s Clinical Center were unable to secure European donor samples from an established bone and marrow transplantation network to conduct hematopoietic stem cell transplantation therapy for patients under experimental treatment, for otherwise intractable cancers. The GDPR is not only a data issue per se but can have direct effects on patient care in a research setting.

Possible remedies
Greater interpretive clarity and responsible remedies are needed if the US and EU scientific communities are to pursue large initiatives toward curative treatments, diagnostics, and vaccines. GDPR transfer mechanisms must expand to resolve the unintended consequences on biomedical data sharing and incorporate scientific research as an explicit public interest.

Among available transfer mechanisms, frameworks modeled after Privacy Shield might potentially provide a legal basis for personal data transfer. A second prospect is the development of a bilateral or multilateral international agreement or administrative arrangement for use by US or third country public agencies and their affiliates and EU public bodies. A third would be to craft sector-specific contractual clauses, approved by the Commission, for use when sharing pseudonymous data with non-EU public agencies for scientific research purposes. Each may require augmentation of U.S. privacy legislation, including judicial redress for EU residents whose samples and data are processed in the US, among other safeguards.

A less robust option would be to make fuller use of the Article 49 derogation to the prohibition on international data transfers for transfers necessary for important reasons of public interest (Article 49(1)(d)). Last Fall, NIH concluded its lone data use agreement under the GDPR based on this exemption, resuming a 20-year partnership with the Finnish National Institute of Health and Welfare (THL) to identify susceptibility genes for Type 2 diabetes and associated traits.

An additional supportive measure may be to create a consistent standard of anonymization. The absence of well-defined metrics of identifiability has impeded data sharing due to concerns with non-compliance. Together with agreed standards, innovations in privacy enhancing technologies will reduce concerns that data subjects could be reidentified through linked molecular phenotypic and genotype datasets, inferential analytics, and imputation techniques.

In principle, and with sufficient political will, these seem workable propositions. Although the US and EU systems of data privacy protection evolved independently, they share identical core principles and safeguards enshrined in privacy law. This is reflected in the establishment of cooperative frameworks to protect privacy in the criminal justice context, such as the 2017 EU-U.S. Umbrella Data Protection Agreement. The same agreed principles could be extended to reach a sound legal basis for transatlantic scientific data flows in biomedicine and public health.

(This commentary does not represent an official Federal agency position and intended solely to stimulate discussion.)

Further readings

• Remove obstacles to sharing health data with researchers outside of the European Union, August 2, 2021, published in Nature Medicine
• International Sharing of Personal Health Data for Research, April 8, 2021, published by the European Federation of Academies of Sciences and Humanities (ALLEA), the European Academies’ Science Advisory Council (EASAC), and the Federation of European Academies of Medicine (FEAM)
• How to fix the GDPR’s frustration of global biomedical research, October 2, 2020, published in Science
• Confusion over Europe’s data-protection law is stalling scientific progress, August 25, 2020, published in Nature
• The GDPR and genomic data, May 2020, published by PHG Foundation
• Genomic data sharing in Europe is stumbling-Could a code of conduct prevent its fall?, March 6, 2020, published in EMBO Molecular Medicine
• Disruptive and avoidable: GDPR challenges to secondary research uses of data, March 2, 2020, published in Eur J Hum Genet
• A Preliminary Opinion on Data Protection and Scientific Research, Jan 6, 2020, published by the European Data Protection Supervisor
• GDPR Brief: How can researchers approach international data transfers under the GDPR?, May 6, 2019, published by the Global Alliance for Genomics & Health
• European data law is impeding studies on diabetes and Alzheimer’s, researchers warn, November 20, 2019, published in Science

Relevant GDPR provisions

• Chapter V – Transfers of personal data to third countries or international organisations

Robert Eiss is Senior Global Health Adviser to the Director of the National Institutes of Health (NIH) and Fogarty International Center.

See all previous briefs.

Please note that GDPR Briefs neither constitute nor should be relied upon as legal advice. Briefs represent a consensus position among Forum Members regarding the current understanding of the GDPR and its implications for genomic and health-related research. As such, they are no substitute for legal advice from a licensed practitioner in your jurisdiction.