1. ) Linked2Safety Project (FP7-ICT-2011-7 – 5.3 ) A NEXT-GENERATION, SECURE LINKED DATA MEDICAL INFORMATION SPACE FOR SEMANTICALLY-INTERCONNECTING ELECTRONIC HEALTH RECORDS AND CLINICAL TRIALS SYSTEMS ADVANCING PATIENTS SAFETY IN CLINICAL RESEARCH Ass. iur. Fritz-Ulli Pieper Institute for Legal Informatics Leibniz University Hanover

2. FP7, ICT-2011 – 5.3 Page 2  Introduction  Legal Implications of the Project  European Data Protection Framework  Legal Framework in Linked2Safety  Conclusions

3. FP7, ICT-2011 – 5.3 Page 3

4. FP7, ICT-2011 – 5.3 Page 4 Legal advisors are not the killjoys! You have an idea? Great! We will try to show you the way through the legal implications

5. FP7, ICT-2011 – 5.3 Page 5

6. FP7, ICT-2011 – 5.3 Page 6 Medical/health research = information Medical diagnosis, procedures, treatments = patient data Applicable Data Protection Law? European Level! Data Protection Directive 46/95/EC

7. FP7, ICT-2011 – 5.3 Page 7 Scope: Personal data, Art. 3 (1), Art. 2 (a) DPD any information relating to an identified or identifiable natural person account should be taken of all the means likely reasonably to be used to identify the said person Health Data = Sensitive Data, Art. 8 (1) Special data deserve special protection Special rules for sensitive data Processing, Art. 2 (b), Section 7 (Criteria for legitimacy) Principles, Art. 6; exemptions, data subject rights, …

8. FP7, ICT-2011 – 5.3 Page 8 Processing of health data, Art. 8 Prohibited, Art. 8 (1) Art. 8 (2) „Paragraph 1 shall not apply where…“ Explicit Consent, Art. 8 (2) (a) Necessary for vital interests w/o legal capability, Art. 8 (2) (c) Preventive medicine, medical diagnosis, …, Art. 8 (3) Art. 8 (4), Recital 34: Exemptions for scientific research subject to suitable safeguards

9. FP7, ICT-2011 – 5.3 Page 9 Three phases: Platform development, testing, exploitation Different types of data: Healthdata vs. Linked2Safety data includes genetic data – no way to anonymize! Actual personal data vs. anonymized data Anonymized data won‘t fall under the DP Directive Data-cube approach!

10. FP7, ICT-2011 – 5.3 Page 10 „Data Privacy Framework“ Informed Consent (obtained from patients by clinical partners), also covering ethical background Anonymization Contractual agreements & organizational structure Research exemption Data Governance Framework, Data Governance Mediator Consent Forms Data Transfer Agreement, User Agreement Platform Manager Agreement

11. FP7, ICT-2011 – 5.3 Page 11 High-level medical research has to take into account complex data protection implications Changes within new DP Regulation?! Data protection princinples must be observed Further safeguards should be implemented Sound collaboration between medical, technical and legal stakeholders

12. FP7, ICT-2011 – 5.3 Page 12 Ass. iur. Fritz-Ulli Pieper Institute for Legal Informatics, Leibniz University Hanover Fon: +49 (0)511 762 8282 Fax: +49 (0)511 762 8290 Email: pieper@iri.uni-hannover.de