Article 8, on "the processing of special categories of data," holds a number of provisions that could be problematic for health research.
¶ 1. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.
¶ 2. Paragraph 1 shall not apply where... the data subject has given his explicit consent to the processing of those data... [or where some special circumstances, listed, apply].
¶ 3. Paragraph 1 shall not apply where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy.
¶ 4. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority.
What kinds of health research will be defined as being within the scope of "preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services"? (A systematic check should be made against categories of health research such as those described in Chapter 3 of this Report.)
Will governments realize the importance in health research of taking into account factors relating to "ethnic origin" and "health and sex life"? Surely they should. Much essential public- health research is conducted with the very purpose of aiding subpopulations. Because many health factors are related to origin, research often selects groups by such criteria as ethnic origin to study specific afflictions, causes, or interventions. In pharmaceutical risk and efficacy studies, regulators rightly mandate that ethnic and sexual factors be taken account of. Genetics, dietary habits relating to ethnic background, sexual contacts and practices, and other factors strongly determine how health phenomena differ among people.
How broadly will "substantial public interest" be construed? Possibilities are mentioned in the Directive for a variety of national exemptions and derogations; but exemptions will not be recognized unless Member States positively enact them into their national laws. E.U. leaders have been saying publicly that not many "public interest" exemptions should be expected, but that, rather, safeguards should be emphasized.
Who—for instance, epidemiological analysts performing processing tasks in database research—will be considered to be "health professionals" or others "subject to an equivalent obligation of secrecy"? Presumably analysts can be positioned under responsible "data controllers."
Article 6 requires that personally identifiable data must be "collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes." But, no doubt to the relief of many researchers, it goes on to state:
¶ 1(b). Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards.