Out-Law News 3 min. read

Albrecht's proposed health data research processing restrictions near-identical to EDRi lobby papers


A civil rights group's proposals on the EU's data protection reforms are almost identical to the provisions an MEP has recommended be introduced to restrict the freedom of member states to set their own rules relating to the processing of sensitive health data for research purposes.

Out-Law.com has analysed the changes MEP Jan-Philipp Albrecht has proposed be made to the European Commission's draft Data Protection Regulation and cross-referenced them against the terms included in papers published by the European Digital Rights (EDRi) campaign group. A number of Albrecht's proposals mirror the EDRi's.

Recently the Europe v Facebook privacy group said that proposals submitted by business groups including Amazon, eBay and the American Chamber of Commerce had been incorporated by MEPs into amendments those MEPs have suggested by made to the Commission's proposed reforms.

Last month Albrecht published a report (215-page / 751KB PDF) that contained amendments he would like to see made to the Data Protection Regulation http://www.out-law.com/en/articles/2012/january-/tougher-requirements-for-obtaining-consent-unveiled-in-data-protection-proposals/ that the Commission has proposed be introduced to replace the near-20 year old Data Protection Directive that is currently in force.

Albrecht is the rapporteur to the European Parliament's Civil Liberties, Justice and Home Affairs (LIBE) Committee. LIBE is leading the Parliament's scrutiny of the reforms and is due in April to vote on a draft legislative text to represent the Parliament's views in negotiations with the Council of Ministers on the data protection reforms.

Under the Commission's plans a new single data protection regime would apply across the EU and beyond to organisations that process the personal data of EU citizens. However, the Regulation, if introduced, would provide member states with an element of freedom to draw up their own rules concerning personal data processing in specific settings, including where it concerns health and where processing is for historical, statistical and scientific research purposes.

However, in his report Albrecht outlined draft amendments that would place greater restrictions on the freedom of member states to draw up their own rules in those contexts than has been outlined by the Commission.

Albrecht said that personal data concerning health should not be processed at all in certain cases where the purposes of that processing can be achieved without the processing taking place. In addition he said health data should generally only be able to be processed for the purposes of historical, statistical or scientific research where individuals have consented to such processing.

It would be legitimate for processing in the context of research to take place without consent, according to Albrecht's proposals, under certain conditions. The research would have to serve an "exceptionally high public interest", generally involve anonymised data from which individuals could not be re-identifiable, whilst the processing could only go ahead if regulators had given their prior approval.

The terms of Albrecht's amendments are almost identical to amendments the European Digital Rights (EDRi) group have outlined that they would like to be made to the Commission's draft Regulation.

Albrecht also appears to have adopted the EDRi's proposals, published on the protectmydata.eu website, in relation to other elements of the data protection reforms.

Albrecht's proposed definition of 'profiling' – "any form of automated processing of personal data intended to evaluate certain personal aspects relating to a natural person or to analyse or predict in particular that natural person’s performance at work, economic situation, location, health, personal preferences, reliability or behaviour " – is, but for a single word, phrased the same as the proposed definition outlined by EDRi.

Proposed rules relating to profiling, which Albrecht has sought to alter from the Commission's draft, also bear similarities to the terms used by EDRi.

Out-Law.com has also identified identical terms used between Albrecht's proposals relating to court proceedings and views expressed by EDRi on the issue. Both Albrecht and the EDRi back provisions which could allow consumer groups to bring legal action against businesses over claimed breaches of the Regulation. There are also similarities between the terms both have used in relation to data subjects' right to compensation – both think that compensation should be potential remedy, where other qualifying criteria is met, where individuals suffer a non-monetary loss as a result of actions by organisations.

Further similarities exist between Albrecht's proposals and those outlined by the EDRi on the provisions affecting personal data transfers to third countries, rules on data protection by design and by default and on the terms that dictate what information organisations would have to provide individuals with about their processing activities under a new EU data protection framework.

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.