David Erdos, a member of LML and incoming Deputy Director of CIPIL, has been engaged in a variety of activities during 2016-17 which have been aimed at ensuring that all types of academic research are effectively safeguarded when the new General Data Protection Regulation (GDPR) comes into force in May 2018. Much of this work has focused on the governance of humanities and social science scholarship, a wide-ranging area that can include certain types of health and medical humanities research. Other aspects of David’s work have specifically focused on the appropriate regulation of biomedical research within data protection.
Summary of Activities during 2016-17
In November 2016, David posted slides exploring the regulation of biomedical research under European data protection including an analysis of existing laws, Data Protection Authority (DPA) legal interpretations and DPA enforcement activity combined with some pointers to how things might and should evolve in the era of the GDPR. He also presented on “Reconciling Humanities and Social Science Research with Data Protection” at a workshop held at the University of Hong Kong. The slides from this are available here.
In February 2017, David presented more generally on the interface between data protection and University research at a JISC Workshop on the GDPR held at the University of Leeds.
In May 2017, he also helped with the drafting of a joint British Academy/ESRC submission on the British Government’s Call for Views on the implementation of the GDPR in the UK which specifically focused on issues arising for humanities and social science research.
Finally, in June 2017, David spoke on a similar theme at a Full Fabric Workshop on The Impact of the GDPR in Higher Education which took place at Imperial College London as part of London EdTech week. He also spoke and took part in a CSaP Policy Workshop on ʻTransforming consent – legal and ethical aspectsʼ held at Trinity Hall Cambridge, which looked at changing the technical, legal and social context for the mobilisation of the use of personal data in medical research including, in particular, the coming impact of the GDPR.
Need to Look Beyond the ʻResearchʼ Derogations
These various interventions have emphasised that both policy makers in Government and policy stakeholders - including within the Universities themselves – need to look beyond the specific ʻresearchʼ derogations set out in Article 89 of the GDPR when seeking to balance rights and interests in this area. Whilst Article 89 does grant certain derogations which recognise the role that research plays in knowledge production of all kinds, these are quite limited in nature. This reflects the fact that Article 89 can be claimed even by certain forms of purely economically-motivated, commercial research. In contrast, academic biomedical research furthers “important objectives of general public interest” as well as constituting the exercise of the freedom of sciences as set out in the EU Charter (Article 13). It therefore can and should benefit from further derogations under the Restrictions clause of the GDPR (Article 23). Finally, through its concept of “academic … expression” as set out in Article 85 (2), the GDPR recognises that humanities and most forms of social research must benefit from wide-ranging derogations “as necessary to reconcile the right to protection of personal data with the freedom of expression and information”. These derogations should mirror the existing protections for journalistic, literary and artistic purposes which are similarly safeguarded in Article 85 (2).