No open-access location is known for this record yet.
No open-access location is known for this record yet.
Key Points Controllers are the primary bearers of obligations under data protection law. The factual test for controllership is who decides on the purpose and essential means of processing. Essential means include the types of data, the categories of data subjects, the parties having access to data, and the length of data retention. Joint control arises where two or more parties determine the purpose and essential means of processing through a common decision or converging decisions. Roles are assigned to specific processing operations, and so may differ along complex processing chains. Where personal, usually pseudonymized, data from health research or health care are shared for scientific purposes, it is often unclear how to divide up the processing chain, or what General Data Protection Regulation roles apply. This is a persistent roadblock for establishing cross-border research consortia and accelerating data-driven scientific discovery. We argue that a data user (research organization) will normally be the sole controller for a research project accessing personal data from one or more data providers (hospital or research organization), because the data user independently determines the purposes and means of the associated processing. Data providers will not normally be a controller unless they actively participate in the design of the research project or impose benefit-sharing requirements. A data provider granting access to data in its own secure computing environment will normally act as a processor on behalf of the data user. A key aspect of European Union (EU) data protection law is ensuring all parties dealing with personal data have clearly assigned legal roles, and by extension, responsibilities. Key roles defined by the EU General Data Protection Regulation (GDPR)1 include controllers, joint controllers, processors, and third parties. An organization’s role determines the scope of its legal responsibilities towards data subjects, and in cross-border scenarios, which national law implementing the GDPR applies, including extensions and derogations. Assigning roles remains challenging in network scenarios where multiple organizations are involved in processing data for different purposes. One such difficult case is research networks that share pseudonymized genomic and health-related data from patients or research participants for scientific research purposes.2 In the context of health and biomedical research, data sharing is the practice of making data generated as part of health care or research projects available to (other) researchers for research purposes. Scientific data sharing involves two primary actors: data providers who make data available (eg, hospitals or research organizations responsible for scientific cohorts), and data users conducting studies (ie, researchers organizations hosting data analysts).3 During the Covid-19 pandemic, for example, researchers required rapid access to healthcare data on patients to study factors influencing the transmission and severity of disease. Here, hospitals acted as data providers, sharing data that they collected for the diagnosis and treatment of patients for research activities, without necessarily engaging in the research themselves. Recipient research institutions acted as data users, analysing the data as part of research projects. Organizations in scientific data sharing networks face significant uncertainty over roles. This uncertainty can delay, complicate or even block sharing data. Guidance and literature addressing the GDPR and health research have largely overlooked this issue. This article aims to address this gap by outlining a systematic and principled approach to assigning roles in health research data sharing networks. This approach is also relevant to large research consortia.4 Timely clarification of GDPR roles for data sharing is also needed beyond health research, in light of the draft EU Data Governance Act5 and complementary draft EU Data Act.6 The Data Governance Act establishes a transversal framework to stimulate the sharing and re-use of personal data (and other forms of sensitive data) held by public authorities and beyond. The Data Governance Act has received criticism from data protection authorities about a lack of clarification over the GDPR roles of data sharing actors.7 We begin by reviewing the applicable legislation, case law, interpretive guidance, and literature debates about assigning (joint) controllership to complex processing chains (‘Applicable law and interpretive guidance’ section). Next, we apply the legal tests to a generic health research data sharing network (‘Who is the controller for a research project that accesses personal data?’ section). We then consider how certain contextual factors—such as benefit sharing and technical security arrangements—influence roles (‘Contextual factors where data providers may qualify as joint controllers for the research project’ section). Finally, we consider if the legal framework provides predictability as well as complete and effective protection for data subjects (‘Discussion’ section). The roles of ‘controller’, ‘processor’, ‘joint controller’, along with the concept of ‘third party’ are key to the application of the GDPR, as they determine who is responsible for protecting personal data and how data subjects may exercise their rights. Definitions are provided in Box 1. The assignment of roles has important consequences for organizational responsibility and liability for damages. Controllers are accountable to ensure respect for GDPR principles and for demonstrating compliance. This accountability cannot be delegated. Processors have more limited statutory obligations, namely that they must only process data according to the documented instructions of the controller. GDPR roles are autonomous concepts, meaning they are to be interpreted according to EU data protection law. Interpretation of these concepts is ultimately determined by the Court of Justice of the European Union (CJEU). Shortly after the GDPR entered into force, the CJEU rendered a series of rulings clarifying the scope and implications of (joint) controllership,8 discussed below. In addition, the European Data Protection Board (EDPB) has adopted guidance clarifying the definitions and obligations of controller and processor.9 EDPB guidelines are not binding as a matter of law, but they reflect a common position and understanding that EU data protection authorities agree to apply in a consistent way.10 Box 2 describes the test applied by the EDPB to determine GDPR roles. These guidelines largely codify key CJEU case law. Box 1. Key roles under the GDPR Controller ‘means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data’.a Processor ‘means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller’.b A processor is a separate entity from the controller, bound by the controller’s instructions, processing personal data for the controller’s benefit.c Joint controllership arises where two or more entities jointly participate in determining both the purposes and means of processing.d This may be through a common decision, or through converging, complementary decisions determining the purposes and means of processing, where the processing is inseparable/inextricable.e Mutual benefit may be indicative of controllership, but is not determinative.f Third Party ‘means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data’.g aArt 4(7) GDPR. b Art 4(8) GDPR. c Guidelines on the Concepts of Controller and Processor (n 9) paras 76–79. d Art 26(1) GDPR. e Guidelines on the Concepts of Controller and Processor (n 9) 3. f Ibid para 60. g Art 4(10) GDPR. Box 2. EDPB criteria for GDPR roles Adapted from EDPB Guidelines 07/2020, Version 2.0, Annex I. Flowchart for applying the concepts of controller, processor and joint controllers in practice. To determine a controller, the relevant questions are - Are you appointed as controller according to a legal act for the processing in question? (explicit legal competence), or - Is the processing necessary in order to carry out a task for which you are responsible according to a legal act? (implicit legal competence), or - Do you decide [as a matter of fact]: ○ the purpose or purposes that the data will be processed for? ○ which personal data that shall be collected and processed? ○ which categories of individuals that the processed data will refer to? ○ whether the processed data shall be disclosed and to whom? and ○ for how long the personal data will be stored? Additional qualifiers that may help the identification of a controller include the following: - Do you obtain a benefit from, or have an interest in, the processing (other than the mere payment for services received from another controller)? - Can the processing activities be considered as naturally attached to the role or activities of your entity (eg, due to roles or which responsibilities from a data protection of - you the processing of personal data to an to process the personal data on your - Do you have complete in how the personal data is processed? - the processing refer to your with the data subjects as a - Do you process the personal data for another purposes and in with its documented instructions (ie, you not have a purpose of your own for the - Do you not your own purpose in the processing other than your own interest to - another your processing activities in order to ensure that you with instructions and of - Are you a by a joint controllership - Are you and another or parties jointly involved in determining the purposes and means of the Joint - more than one have a over whether and how the processing by a common decision or by converging decisions that other and are necessary for the processing because they have a on the of the purposes and Joint control ○ the processing be without both ○ Is the processing by (ie, ○ Is a benefit from the processing a Guidelines on the Concepts of Controller and Processor (n 9) paras Where the EDPB criteria for controller are benefit from the processing is indicative of joint A mere benefit from a is not considered by the EDPB to be a joint controller, where the not have an own purpose that to the processing. GDPR on control over processing, not control over personal data are for an to qualify as a legal natural and and We on this where roles are determined by an The EDPB key questions for the is this processing that the processing for a and who a on the purpose and means of the This is factual and than determined by the of the entity or a in a is to the data protection of purpose The EDPB a essential means are determined by the and means may be determined by a Essential means include the of personal data the of the processing, the categories of and the categories of data subjects data are The of these essential means is by the purpose of processing. means include security EDPB and legal literature specific to health largely on GDPR such as uncertainty over what personal data pseudonymized the scope of the scope of the scientific research well as associated and data and the lack of it to complex processing chains and data sharing in this the EDPB has such as legal in cross-border and The EDPB has guidance on other under guidance, such as or an legal to The EDPB and legal literature have not in the of applying GDPR roles in scientific data sharing defined research projects. We must on case law, guidance, and literature addressing complex processing chains in other Key questions include what over the purpose and means of processing, and how to divide up the processing different to the CJEU and a controller is a with over the purposes and means of This test aims to ensure effective and protection of the data In the CJEU that a a a joint controller by to on the of and to personal data and for and the not process personal data, it the processing by by establishing the for its own In the CJEU that an a joint controller with it a on its to on and to their the and making and processing to not process the data, for the processing, or direct from In the Court determined that the jointly responsible for by in which it and even it required that the of a controller, even controllers on the of processing, and of and of these the CJEU has adopted a which the scope of joint controllership according to of data processing in complex processing This approach is to the scope of responsibility of a (joint) controller only to the of data processing in which the controller as determining the means and may be involved different of a processing chain, to different In the only joint controller for the data and by In the controllership limited to the and by transmission to The in the of the General in the is that are responsible for one is The EDPB that processing chains must be on a the processing of personal data may be into processing for which be considered to determine the purpose and means the other a or of processing may also for the in which case it is that the processing involves one or more joint In other it is that the different processing of the as as of may have a different it is necessary to whether these processing not be considered as a of a joint purpose jointly defined the purposes of processing is key to up the processing chain, to if processing be or as part of a The of processing activities cannot be for the of parties involved in processing. it must ensure the effective and complete protection of data criticism has the approach on from complex networks of data and we the for in controllers to an of responsibilities in that The approach is to lack predictability and and to to responsibility and In the we to apply and the approach in the context of health In a on purpose can ensure and chains of sole controllers can effective as long as they their obligations, due and to ensure data subjects are to exercise their we data sharing in the health research context involves data providers, such as that make pseudonymized health data and data users, such as research conducting a research is to that a data user is normally a controller for its research project in The data user determines purpose by the research to be In determining the to the research the data user also determines essential including the categories of data subjects and types of data to and the to The data user may also with necessary and providers necessary and (eg, and the data also to agree to This is all to research that are by the data and may be or for the data own uncertainty the role of data providers in the research the data provider not normally determine the research or uncertainty from the that the data provider decide whether or not to This be to determine if the processing in the research project the in who processing data for joint the approach not be access not clearly determine whether or not the processing if a data provider access to a the may a and on with the processing. In where the data user decides not to the processing will not the data provider not have an own purpose the access decision or a these decisions to be by The data providers impose through data not determine the purpose or essential means of processing. they are to ensure data sharing not to a of data protection principles or other requirements. These include to only process data for the purpose of the research to access to authorized and to technical and organizational to with data and to of data to a These not to determine purpose or they are on ensuring the research is in with data protection We that the data user is normally the sole controller for the research This of the processing not effective and complete protection of the data In health research pseudonymized data, is joint controllership and a of sole In the data provider and user have to responsibilities by In the data provider to be the data to to exercise because the provider is the only to the The data user in case to agree to in the exercise of these rights. are by of the establishing in is a data authority, a body with authority to researchers access to health and data held by also data from the relevant or and data in a secure the legislation, researchers must all essential means of their projects and are considered This that the is sole controller for the research can be in the European also a access to health care data under the This describes the research as a controller for In the Data Protection Act of that researchers processing personal data for scientific research are the data controllers also where they not the data In this an is required to a for this processing. Data providers are more to qualify as joint controllers in two where they benefit in certain from the of a research and where they access to data in a secure processing Mutual benefit is an of joint Where a data provider the to share certain from the of the it is more to be considered a joint controller for the research even where the data provider not or participate in the of the research The common direct benefit of scientific research is for scientific through or on scientific A data provider may impose and associated that of by the user for the data This may from a in or to on scientific for data and sharing not have a to the purposes of processing in the case of a mere is to in joint is not as a benefit as the of benefit that joint control in in usually direct in, and accountability the research This is required from a research in the research the data provider as a joint controller. may not direct so this alone may not be in research is a that the data provider is a joint controller for the research This is to the case where the the to a benefit from An can be in the of a of and associated health data from patients with and A of to stimulate and and through and to health research data, that generated will be by and on behalf of the The is to to act as a for The of in this may be of joint are to to joint control where they are such as where that the of from research projects with a meaning access decisions are not on the A third of benefit of research is data A data provider as a of access that that are in a that their scientific be for The a of data and such a in its data and of data from or An of data be to or of the of An of data be data or data according to or These activities can the scientific of the data not for the specific research project but also for A to data to the data provider that the data provider is a joint controller in the research this may on In the data provider benefit from having more data to re-use for its own scientific purposes or to more users and associated scientific access or This be to or even the data provider has an own purpose to its data from the research In other the purpose of may be and may be more for the benefit of the user or the scientific such as to ensure the and of the research data are often only certain projects will data. This the data user decides on the purposes and and the data provider only to benefit if the decides to an important for scientific data sharing is the of These are a of that to the of data without the to and the required Data providers to data to users may to access data in a secure processing for example, is to researchers access to health and data collected from its own secure computing environment provides access to the data a secure provided or by may be also an to research are not they are from the the of Data providers may even decide to data from users, only forms of access where a can only a research or The data provider the data and only certain to the such as or
Loading…
Imported from OpenAlex (CC0) — nothing here is generated.