What will changes to Europe’s data protection laws mean for medical research?

Posted on February 7, 2012 by


The Ministry of Justice are calling for our views on Europe’s plans for new legislation covering data protection. Changes to EU data protection laws may have implications for medical research in the UK as they will govern how patient data can be handled. Patient data is a valuable resource for health research (for more on how it is used go here). The Ministry of Justice want to hear from us by 6 March 2012, and this information will inform the UK government’s position as they start discussing what the new legislation will look like.


The current EU data protection laws were agreed in 1995. Since then the way our data is collected, accessed and used has changed dramatically and the legislation needs updating to reflect that.

The European Commission published its proposals for new legislation covering data protection on 25 January 2012; a regulation setting out a general EU framework for data protection and a Directive  on protecting personal data processed for the purposes of prevention, detection, investigation or prosecution of criminal offences and related judicial activities.

Directives and regulations are slightly different. Once adopted, a directive must be transposed in each members state’s law but they can decide how they do that. Regulations come into force right across the EU immediately. Or as it’s technically put in the treaty on the functioning of the European Union,

A regulation shall have general application. It shall be binding in its entirety and directly applicable in all Member States.
A directive shall be binding, as to the result to be achieved, upon each Member State to which it is addressed, but shall leave to the national authorities the choice of form and methods.

What do the proposals mean for health research?

These proposals cover the use of all data, not just data used for research. We need to look carefully at what is proposed and whether any of this will have an impact on research.

The call for evidence published today flags up a few changes which may have implications for the use of data in health research:

  • The Commission’s proposals include a revised definition of personal data,which now explicitly includes genetic data. This means a far broader range of information may now be subject to data protection rules.
  • The rules around consent have been changed, to provide clarity around the circumstances in which it can be a valid legal basis for data processing as well as requiring consent to be explicit.

What next?

Now that the proposals have been published, medical research funders are looking at the proposals in detail to see what the implications are for the use of data in research. This call for evidence offers a good opportunity to feed some of those concerns in to the government before they begin discussing the planned regulation.

Posted in: Policy