European Scientists Fear Data Protection Overreach

Raising the drumbeat of alarm before a final European Parliament ruling later this year, a coalition of the continent’s research organizations have made explicit their opposition to new rules that they say would impede social science and medical research.

Using personal data, the coalition wrote, “social science research has demonstrated the link between unemployment and health; linked smoking in pregnancy to child birth weight; and identified the long-term socio-economic benefits to children who are breastfed.”

If the amendments to legislation passed in 1995 are enacted, according to an open letter (PDF here) from the group, “there would be dire consequences for European research and the value it can bring to government, the economy and society at large.” The letter was signed by 28 individual scientists and national research bodies of 10 nations: Belgium, the Czech Republic, Germany, France, Ireland, Norway, Portugal, Slovakia, Slovenia, and Sweden and hosted by the non-profit Science Europe.

The parliament’s proposed rules have been simmering for almost two years, and predate the current “right to be forgotten” court decision. Instead, the parliament cites “concerns about US surveillance activities” as having been the biggest spur toward getting the protections into law. Last October members of the European Parliament in the civil liberties committee passed the overhaul, and in March plenary vote the full parliament endorsed the committee’s test, sending the bill to the member states to review and accept. The parliament hopes to have the laws approved by the end of this year.

The legislation is indeed a major overhaul of Europe’s data protection laws, with hundreds of amendments. The researchers are only citing two that concern them; those are listed below.

According to the legislators, the new proposal cleans up a jumble of national rules with a single, unified set of rules “which aims to put people in control of their personal data, build trust in social media and online shopping and upgrade the protection of data processed by police and judicial authorities.” And while the intent of most of the many changes do seem focused on preventing personal data from falling into rapacious commercial interests or overzealous security agencies, earning generally nods of approval from free expression advocates, the actual language could lead to collateral damage, according to the scientists.

The examples above are based on large population cohorts where participants have given broad consent for data about them to be linked from different sources. Researchers running these cohorts maintain contact with participants over years to build these data sets. The European Parliament’s proposed amendments could make this ongoing contact difficult or impossible by excluding identifiable data from the research exemption, despite the fact that participants agreed to contribute their data,and that the research is conducted subject to ethical approval and strict confidentiality safeguards.In addition, research using socio-economic datasets that include health data is likely to be subject to even stricter controls due to other provisions Parliament have introduced for “data concerning health.”

Since “robust, well-tested, protocols are in place,” the coalition’s letter concludes, an exception for bona fide academic and medical research should be carved out.

The offending proposed changes

Amendment 81

Original:

(119)  Penalties should be imposed to any person, whether governed by private or public law, who fails to comply with this Regulation. Member States should ensure that the penalties should be effective, proportionate and dissuasive and should take all measures to implement the penalties.

Amended:

(119)  Penalties should be imposed to any person, whether governed by private or public law, who fails to comply with this Regulation. Member States should ensure that the penalties should be effective, proportionate and dissuasive and should take all measures to implement the penalties. The rules on penalties should be subject to appropriate procedural safeguards in conformity with the general principles of Union law and the Charter of Fundamental Rights, including those concerning the right to an effective judicial remedy, due process and the principle of ne bis in idem.

Amendment 83

Original:

(121)  The processing of personal data solely for journalistic purposes, or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this Regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression, and notably the right to receive and impart information, as guaranteed in particular by Article 11 of the Charter of Fundamental Rights of the European Union. This should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries. Therefore, Member States should adopt legislative measures, which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights. Such exemptions and derogations should be adopted by the Member States on general principles, on the rights of the data subject, on controller and processor, on the transfer of data to third countries or international organisations, on the independent supervisory authorities and on co-operation and consistency. This should not, however, lead Member States to lay down exemptions from the other provisions of this Regulation. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly. Therefore, Member States should classify activities as ‘journalistic’ for the purpose of the exemptions and derogations to be laid down under this Regulation if the object of these activities is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them. They should not be limited to media undertakings and may be undertaken for profit-making or for non-profit making purposes.

Amended:

(121)  Whenever necessary, exemptions or derogations from the requirements of certain provisions of this Regulation for the processing of personal data should be provided for in order to reconcile the right to the protection of personal data with the right to freedom of expression, and notably the right to receive and impart information, as guaranteed in particular by Article 11 of the Charter of Fundamental Rights of the European Union. Therefore, Member States should adopt legislative measures, which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights. Such exemptions and derogations should be adopted by the Member States on general principles, on the rights of the data subject, on controller and processor, on the transfer of data to third countries or international organisations, on the independent supervisory authorities, on co-operation and consistency and on specific data processing situations . This should not, however, lead Member States to lay down exemptions from the other provisions of this Regulation. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom broadly to cover all activities which aim at the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them, also taking into account technological development. They should not be limited to media undertakings and may be undertaken for profit-making or for non-profit making purposes.