The EU General Data Protection Regulation: Implications for International Scientific Research in the Digital Era - Dove, Edward S. (The Journal of law, medicine & ethics, 2018)
On May 25, 2018, the General Data Protection Regulation (GDPR)1 took full legal effect across the European Union (EU) and, subsequently, the European Economic Area (EEA),2 which together comprises 31 countries. Its impact on organizations in both Europe and around the world is immense. The GDPR is a massive (99 articles over 88 pages and 55,000 words), complex, omnibus data protection law that provides a comprehensive legal framework for the protection of Europeans' personal data, as well as for the promotion of responsible data processing for a range of legitimate purposes. It overhauls the ways in which organizations collect, use, and share personal data. It does so largely by recognizing that rapid developments in digital technology have increased the scale, scope, and speed at which personal data are collected, used, and distributed, thereby necessitating a stronger legal framework that enhances the rights of “data subjects.” At first glance, one might consider the GDPR to be a Europe-centric law of little global consequence, not to mention — as some British “Brexiteers” would have it — another example of bumbling Brussels bureaucracy. On the contrary, the territorial scope of the GDPR follows the data that it protects and therefore has direct bearing on the activities of organizations based in countries around the world. It has direct impact on the conduct of biomedical research, given that much of this research relies on the use of individually-identifiable information. It is also, all things considered, a well-drafted piece of legislation that raises the standards of data protection globally.Non-EU entities in the health research sector, such as the Secretary's Advisory Committee on Human Research Protections (SACHRP) in the United States, have raised alarm bells about the GDPR's impact on scientific research. In their words: “The application of GDPR requirements to human subjects research has alarmed many in our national research community, as the GDPR appears not [sic] have taken into account adequately the nature, process and demands of scientific and medical research.”3 In this article, I dispute such claims. I do so by describing and analyzing the implications of the GDPR for international scientific research that involves the processing of participants' personal data. Such research includes bio-banking, genomic research, rare disease research, and clinical trials — all of which make increasing use of artificial intelligence, Big Data-driven cross-sectoral data mining and sharing, cloud computing, biotechnology, nanotechnology, and seamless global data flows across multiple countries.