Privacy and ‘Big Data’: the European perspective Human Subjects’ Protections in the Digital Age: IRB, Privacy and Big Data Peter Elias, University of Warwick and University College London

Structure of the presentation Historical review of legal approach to privacy The current legal situation – the General Data Protection Regulation (2016?) Promoting cross-national research with ‘Big Data’ – what now needs to be done?

European experience: problems and solutions Develop a harmonized approach to legislation designed to provide individuals and organizations with what has become known as the ‘right to privacy’. Create a research environment (the European Research Area’) in which research interests are promoted via cross-border access to microdata free from legal constraints and other obstacles.

The legal environment (1) The right to privacy. The Council of Europe established The European Convention on Human Rights 1950, including ‘the right to respect for his private and family life, his home and his correspondence’ ‘‘There shall be no interference by a public authority with the exercise of this right except such as in accordance with the law and is necessary in a democratic society in the interest of national security, public safety or the economic well-being of the country, for the protection of disorder or crime, for the protection of health or morals, or the protection of the rights and freedoms of others’ (ECHR: Article 8.2)

The legal environment (2) Automatic processing of personal data. In 1980 the Council of Europe proposed a Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data Trans-border flows of electronic information were permissible, as along as both countries had equivalent legislative protection of data. The Convention came into effect in 1985, but adoption was uneven. EU Data Protection Directive 1995 – all EU countries must demonstrate that they have a legal framework for the protection of electronic data about individuals which meets the requirements of fairness, relevance, consent for reuse, protection and rights of access by data subjects.

The legal environment (3) The EU General Data Protection Regulation (2016?). Major difference from the 1995 Directive – this is a Regulation (supersedes national legislation). Has four key components: Wider scope (applies outside EU to bodies processing data from within EU). Harmonised activities of data protection authorities. Need for consent if data to be processed are not anonymised. Right to be forgotten (personal data to be removed from use if consent is withdrawn).

Implications for research Is consent necessary? Can consent be obtained? If it can be obtained, how durable is it? How will the ‘right to be forgotten’ be implemented? Major threat to the continuation of data linkage studies using ‘Big Data’. Studies most at risk are longitudinal population studies in health and the social sciences.

What now needs to be done? Amendments to the new regulation are required – how will this be achieved? Public support for the use for research of de- identified personal information is now essential. There is need for a coordinated governance structure for all activities associated with access, linking and sharing personal information. More emphasis on ‘data safeguarding’ – safe people, safe projects, safe data, safe outputs.

Solutions – multi agency and multi national Encourages transnational access to data held at national statistical institutes by funding the travel and subsistence costs for researchers and paying any usage charges. Promoting the development of a network of remote access centres. Remote access is provided by various means, including the use of thin client technology, submission of analytical code by and the use of encryption devices. Additional activities (standards development, training workshops, etc.) all of which are designed to promote wider use of European official microdata for research. Promoting access to micro-data held by EU national statistical institutes

Solutions – multi agency and multi national Four Administrative Data Research Centres established in the UK, with secure data settings, remote access and an Administrative Data Service providing links to government administrative data. Partnerships with the national statistical authorities and major government departments. Working to harmonise legislation, metadata, training and access procedures via strong governance arrangements. Research access to and linkage between government administrative datasets

Solutions – multi agency and multi national Access to and linkage between ‘Big Data’ sources can promote a new research agenda in the social and biomedical sciences. Public engagement is critical to the further development of these valuable data resources Research access to and linkage between government administrative datasets