Abstract
Genetic data contain sensitive health and non-health-related information about the individuals and their family members. Therefore, adopting adequate privacy safeguards is paramount when processing genetic data for research or clinical purposes. One of the major legal instruments for personal data protection in the EU is the new General Data Protection Regulation (GDPR), which has entered into force in May 2016 and repealed the Directive 95/46/EC, with an ultimate goal of enhancing effectiveness and harmonization of personal data protection in the EU. This paper explores the major provisions of the new Regulation with regard to processing genetic data, and assesses the influence of such provisions on reinforcing the legal safeguards when sharing genetic data for research purposes. The new Regulation attempts to elucidate the scope of personal data, by recognizing pseudonymized data as personal (identifiable) data, and including genetic data in the catalog of special categories of data (sensitive data). Moreover, a set of new rules is laid out in the Regulation for processing personal data under the scientific research exemption. For instance, further use of genetic data for scientific research purposes, without obtaining additional consent will be allowed, if the specific conditions is met. The new Regulation has already fueled concerns among various stakeholders, owing to the challenges that may emerge when implementing the Regulation across the countries. Notably, the provided definition for pseudonymized data has been criticized because it leaves too much room for interpretations, and it might undermine the harmonization of the data protection across the countries.
Similar content being viewed by others
Log in or create a free account to read this content
Gain free access to this article, as well as selected content from this journal and more on nature.com
or
References
Knoppers BM. Framework for responsible sharing of genomic and health-related data. HUGO J. 2014;8:1.
Hayden EC. Geneticists push for global data-sharing: international organization aims to promote exchange and linking of DNA sequences and clinical information. Nature. 2013;498:16–8.
Knoppers BM, Harris JR, Tassé AM, et al. Towards a data sharing Code of Conduct for international genomic research. Genome Med. 2011;3:1.
European Commission. Ethical, Legal and Social Aspects of Genetic Testing: Research, Development and Clinical Applications, 2004. Available online at: https://publications.europa.eu/en/publication-detail/-/publication/2159a3bb-92af-4c6e-ab27-7bb0189773f9
de Paor A. Regulating genetic information—exploring the options in legal theory. Eur J Health Law. 2014;21:425–53.
Beyleveld D, Townend D. When is personal data rendered anonymous? Interpreting recital 26 of Directive 95/46/EC. Med Law Int. 2004;6:73–86.
PHG Foundation. Call for Evidence on the Proposed Data Protection Regulation and Directive: Response from PHG Foundation. Available online at: http://www.phgfoundation.org/documents/291_1331894630.pdf
Beyleveld D. Privacy, confidentiality and data protection. The SAGE handbook of health care ethics. Edited by Ruth Chadwick, Henk Ten Have and Eric Meslin 2011:95-105. DOI: http://dx.doi.org/10.4135/9781446200971.n10
Phillips M, Knoppers BM. The discombobulation of de-identification. Nat Biotechnol 2016;34:1102–3.
Wellcome Trust. Analysis: Research and the General Data Protection Regulation - 2012/0011(COD), 2016. Available online at: https://wellcome.ac.uk/sites/default/files/new-data-protection-regulation-key-clauses-wellcome-jul16.pdf
Article 29 Working Party. Opinion 4/2007 on the concept of PersonalData, 2007.
van Veen E-B. Europe and tissue research: a regulatory patchwork. Diag Histopathol. 2013;19:331–6.
Moraia LB, Kaye J, Tasse AM, et al. A comparative analysis of the requirements for the use of data in biobanks based in Finland, Germany, the Netherlands, Norway and the United Kingdom. Med Law Int. 2015;14(4) 0968533215571956.
Rumbold JMM, Pierscionek B. The Effect of the General Data Protection Regulation on Medical Research. J Med Internet Res 2017;19:e47.
Article 29 Working Party. Advice paper on special categories of data (“sensitive data”), 2011. Available online at: http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/files/2011/2011_04_20_letter_artwp_mme_le_bail_directive_9546ec_annex1_en.pdf
Chassang G. The impact of the EU general data protection regulation on scientific research. Ecancermedicalscience 2017;11:709.
Hallinan D, De Hert P. Brent Mittelstadt, and Luciano FloridiSpringer International Publishing (Cham, Switzerland, 978-3-319-33523-0, 480 pp.) Many have it wrong–samples do contain personal data: the data protection regulation as a superior framework to protect donor interests in biobanking and genomic research. The Ethics of Biomedical Big Data. Springer; 2016. p. 119–37.
Quinn P. The anonymisation of research data—a pyric victory for privacy that should not be pushed too hard by the eu data protection framework? Eur J Health Law. 2016;24:1–21.
Dove ES, Townend D, Knoppers BM. Data protection and consent to biomedical research: a step forward? Lancet. 2014;384:855.
McCall B. European Parliament supports data protection reforms. Lancet. 2014;383:1115.
Di Iorio C, Carinci F, Oderkirk J. Health research and systems’ governance are at risk: should the right to data protection override health? J Med Ethics. 2014;40:488–92.
Article 29 Working Party. Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, 2014. Available online at: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf
Pormeister K. Genetic data and the research exemption: is the GDPR going too far? International Data Privacy Law 2017: 7(2): 137–146.
BBMRI-ERIC. Position Paper on General Data Protection Regulation 2015. Available online at: http://www.bbmri-eric.eu/wp-content/uploads/BBMRI-ERIC-Position-Paper-General-Data-Protection-Regulation-October-2015_rev1_title.pdf
Mascalzoni D, Dove ES, Rubinstein Y, et al. International Charter of principles for sharing bio-specimens and data. Eur J Hum Genet. 2015;23:721–8.
Shabani M, Knoppers BM, Borry P. From the principles of genomic data sharing to the practices of data access committees. EMBO Mol Med. 2015;7:507–9.
Ohm P. Broken promises of privacy: responding to the surprising failure of anonymization. UCLA Law Rev. 2010;57:1701.
Williams G, Pigeot I. Consent and confidentiality in the light of recent demands for data sharing. Biom J. 2016;59:240–50.
Mostert M, Bredenoord AL, Biesaart MC, et al. Big Data in medical research and EU data protection law: challenges to the consent or anonymise approach. Eur J Hum Genet. 2016;24:956–60.
Nuffield Council on Bioethics. The Linking and Use of Biological and Health Data; 2013. Available online at: http://nuffieldbioethics.org/wp-content/uploads/Biological_and_health_data_web.pdf
Acknowledgments
This work is kindly supported by the Interfaculty Council for Development Co-operation (IRO) of the University of Leuven and Research Foundation Flanders (FWO).
Author information
Authors and Affiliations
Corresponding author
Ethics declarations
Competing interests
The authors declare that they have no competing financial interests.
Rights and permissions
About this article
Cite this article
Shabani, M., Borry, P. Rules for processing genetic data for research purposes in view of the new EU General Data Protection Regulation. Eur J Hum Genet 26, 149–156 (2018). https://doi.org/10.1038/s41431-017-0045-7
Received:
Revised:
Accepted:
Published:
Issue date:
DOI: https://doi.org/10.1038/s41431-017-0045-7
This article is cited by
-
Ethical and regulatory requirements for conducting researcher-driven large-scale multinational genetic haematological studies: the INHERENT experience
Health Research Policy and Systems (2025)
-
Qualitative study on ethics in paediatric Systemic Inflammatory Response Syndrome (SIRS) research: perspectives of Turkish legal guardians
BMC Medical Ethics (2025)
-
A GDPR-compliant solution for analysis of large-scale genomics datasets on HPC cloud infrastructure
Journal of Big Data (2025)
-
Re-consent practices in biobanks in Japan: current status and stakeholder perspectives
Journal of Community Genetics (2025)
-
Ethical approval and informed consent in mental health research: a scoping review
AI & SOCIETY (2025)
