4 ms·

I was just in a call with somebody who is working in the medical industry on COVID vaccine and he explained to me that GDPR puts many of their efforts in jeopar

I was just in a call with somebody who is working in the medical industry on COVID vaccine and he explained to me that GDPR puts many of their efforts in jeopardy because if any patient issues a deletion request they have to delete the data which is very ward for them. It is interesting to see how legislation can slow down progress.

viraptor 6y ago
What do you mean by puts in jeopardy? So they realistically expect that a large portion of the tested people will request to delete their data? Is there any basis for that? As I understand it's a very uncommon occurrence even in companies people really should be requesting it from.
- StreamBright 6y ago
  It is enough that one requests it if the data system is not prepared for that.
  - elliekelly 6y ago
    Did this anecdotal conversation actually happen? I'm highly skeptical for several reasons. The first being that GDPR's "right to be forgotten"[1] absolutely, unequivocally, without a shadow of doubt would not apply to a patient in a medical trial. Even if the patient withdrew consent for data processing and objected to the continued processing of their data under GDPR they still would not have the right to have the data deleted for several reasons: 1. The data isn't being processed on the data subject's consent alone. It's also being processed because it's necessary to perform a public task which is a legal basis for processing data under GDPR. It's also probably being processed under the "legitimate interests" of a third party (the pharmaceutical company) whose interests in the data, in this case, override the individual's interests in having the data deleted which is another legal basis for processing. So the medical trial has two (of only six) lawful bases for data processing should the patient withdraw consent. Only one lawful basis is necessary. 2. Article 17(3) specifically exempts compliance with the right to be forgotten when data processing is necessary "for reasons of public interest in the area of public health" (paragraph c) OR for record-keeping purposes "in the public interest, scientific or historical research purposes or statistical purposes" (paragraph d). 3. Article 17(1)c and Article 21(1) would allow continued processing of the data due to "compelling legitimate grounds for the processing which override the interests". 4. Article 21(6) would allow continued processing of the data for reasons of public interest. Surely someone in the EU conducting medical research would be well aware that GDPR is not at all a barrier to medical trial data processing. [1]https://gdpr.eu/article-17-right-to-be-forgotten/ https://gdpr.eu/article-17-right-to-be-forgotten/
kolinko 6y ago
it’s not really an issue until it happens often. also, gdpr is about privacy - I don’t think it can be used to remove the data if it’s anonymised. That is - I can ask google to remove the history of what I clicked on their site, but they can still retain info that someone clicked this or that.
- pestaa 6y ago
  Not only that research data can become anonymous, but there can be a valid legal basis to continued handling of personal data, such as fulfilling a contract. There is so much misunderstanding around GDPR, it's frightening.
  - tatersolid 6y ago
    > There is so much misunderstanding around GDPR, it's frightening. That’s because the law is intentionally vague and has uneven enforcement baked into its design. To be clear: I am a privacy advocate and agree that GDPR is not a barrier to medical trials, but it is basically a mess of a regulation. It’s almost as if the legal industry was consulted and wrote it to ensure continuing billions in legal fees from every company in the world.
    - pestaa 6y ago
      What part of it makes you suspect intentional vagueness? There are still technical scenarios for which the law has not been tried, and no consensus exists among experts. Much confusion, in my opinion however, comes from overinterpreting the regulation. The EU certainly has technocratic tendencies, but I firmly believe the spirit of GDPR is at the right place.
lm28469 6y ago
End of 2020 and people still don't know what is GDPR and how it works.... For fuck's sake we have all the knowledge of the world one click away, and these people working in the "medical industry" don't take 5 minutes of their day to learn about laws regulating them ? Don't they have a legal department ? Didn't they get any GDPR training ? They probably spent more time complaining to you than actually researching the issue .... Of course someone in a vaccine trial can't ask for all their records to be deleted. Does anyone really expect the EU law makers to be that dense ? What's next ? You call the police and ask them to delete your criminal records ? ``` However, an organization’s right to process someone’s data might override their right to be forgotten. Here are the reasons cited in the GDPR that trump the right to erasure: - The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority. - The data being processed is necessary for public health purposes and serves in the public interest. - The data being processed is necessary to perform preventative or occupational medicine. This only applies when the data is being processed by a health professional who is subject to a legal obligation of professional secrecy. - The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing. ``` https://gdpr.eu/right-to-be-forgotten/ https://gdpr.eu/right-to-be-forgotten/
- IMTDb 6y ago
  What the law says does not really matter. What matters in the perception of what it says. In the case of medicine, all clinical trials need to go through "Ethics committee". And ethics committees overwhelmingly consider that GDPR and co also applies to medical studies. So your study protocol absolutely has to take it into account. It's not like you can really argue with them - or get ready for months/years of delays. At the end of the day, their job is to protect the institution, so it's less dangerous for them to refuse a valid study than to accept an invalid one. The European union included various narrow and strangely worded "exemptions" from the law, but the damage is done: "Better safe than sorry, just apply GDPR to all data collections".
  - 6y ago

viraptor 6y ago

What do you mean by puts in jeopardy? So they realistically expect that a large portion of the tested people will request to delete their data? Is there any basis for that? As I understand it's a very uncommon occurrence even in companies people really should be requesting it from.

StreamBright 6y ago
It is enough that one requests it if the data system is not prepared for that.
- elliekelly 6y ago
  Did this anecdotal conversation actually happen? I'm highly skeptical for several reasons. The first being that GDPR's "right to be forgotten"[1] absolutely, unequivocally, without a shadow of doubt would not apply to a patient in a medical trial. Even if the patient withdrew consent for data processing and objected to the continued processing of their data under GDPR they still would not have the right to have the data deleted for several reasons: 1. The data isn't being processed on the data subject's consent alone. It's also being processed because it's necessary to perform a public task which is a legal basis for processing data under GDPR. It's also probably being processed under the "legitimate interests" of a third party (the pharmaceutical company) whose interests in the data, in this case, override the individual's interests in having the data deleted which is another legal basis for processing. So the medical trial has two (of only six) lawful bases for data processing should the patient withdraw consent. Only one lawful basis is necessary. 2. Article 17(3) specifically exempts compliance with the right to be forgotten when data processing is necessary "for reasons of public interest in the area of public health" (paragraph c) OR for record-keeping purposes "in the public interest, scientific or historical research purposes or statistical purposes" (paragraph d). 3. Article 17(1)c and Article 21(1) would allow continued processing of the data due to "compelling legitimate grounds for the processing which override the interests". 4. Article 21(6) would allow continued processing of the data for reasons of public interest. Surely someone in the EU conducting medical research would be well aware that GDPR is not at all a barrier to medical trial data processing. [1]https://gdpr.eu/article-17-right-to-be-forgotten/ https://gdpr.eu/article-17-right-to-be-forgotten/

kolinko 6y ago

it’s not really an issue until it happens often. also, gdpr is about privacy - I don’t think it can be used to remove the data if it’s anonymised. That is - I can ask google to remove the history of what I clicked on their site, but they can still retain info that someone clicked this or that.

pestaa 6y ago
Not only that research data can become anonymous, but there can be a valid legal basis to continued handling of personal data, such as fulfilling a contract. There is so much misunderstanding around GDPR, it's frightening.
- tatersolid 6y ago
  > There is so much misunderstanding around GDPR, it's frightening. That’s because the law is intentionally vague and has uneven enforcement baked into its design. To be clear: I am a privacy advocate and agree that GDPR is not a barrier to medical trials, but it is basically a mess of a regulation. It’s almost as if the legal industry was consulted and wrote it to ensure continuing billions in legal fees from every company in the world.
  - pestaa 6y ago
    What part of it makes you suspect intentional vagueness? There are still technical scenarios for which the law has not been tried, and no consensus exists among experts. Much confusion, in my opinion however, comes from overinterpreting the regulation. The EU certainly has technocratic tendencies, but I firmly believe the spirit of GDPR is at the right place.

lm28469 6y ago

End of 2020 and people still don't know what is GDPR and how it works.... For fuck's sake we have all the knowledge of the world one click away, and these people working in the "medical industry" don't take 5 minutes of their day to learn about laws regulating them ? Don't they have a legal department ? Didn't they get any GDPR training ? They probably spent more time complaining to you than actually researching the issue .... Of course someone in a vaccine trial can't ask for all their records to be deleted. Does anyone really expect the EU law makers to be that dense ? What's next ? You call the police and ask them to delete your criminal records ? ``` However, an organization’s right to process someone’s data might override their right to be forgotten. Here are the reasons cited in the GDPR that trump the right to erasure: - The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority. - The data being processed is necessary for public health purposes and serves in the public interest. - The data being processed is necessary to perform preventative or occupational medicine. This only applies when the data is being processed by a health professional who is subject to a legal obligation of professional secrecy. - The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing. ``` https://gdpr.eu/right-to-be-forgotten/ https://gdpr.eu/right-to-be-forgotten/

IMTDb 6y ago
What the law says does not really matter. What matters in the perception of what it says. In the case of medicine, all clinical trials need to go through "Ethics committee". And ethics committees overwhelmingly consider that GDPR and co also applies to medical studies. So your study protocol absolutely has to take it into account. It's not like you can really argue with them - or get ready for months/years of delays. At the end of the day, their job is to protect the institution, so it's less dangerous for them to refuse a valid study than to accept an invalid one. The European union included various narrow and strangely worded "exemptions" from the law, but the damage is done: "Better safe than sorry, just apply GDPR to all data collections".
- 6y ago