Health Data in Data-driven Research: Processing under the GDPR’s Scientific Research Exemption

Sammanfattning

The digitalization of the healthcare sector has resulted in an increasing source of health data, enabling the implementation of artificial intelligence (AI) in healthcare. There is great optimism that AI will have a significant impact on all areas of healthcare. The processing of health data is generally prohibited by the General Data Protection Regulation (GDPR). However, article 9(2)(j) GDPR provides for an exemption when the processing is carried out for sci-entific research purposes. The scientific research regime in the GDPR further includes exceptions from principles and obligations and allows for derogations from several data subjects’ rights. The scope of the scientific research exemption is not entirely clear, as the GDPR does not contain a binding definition of “scientific research purposes” and as rules may vary by Member State. The thesis examines the legal impact of the GDPR in relation to Swedish companies engaging in data-driven research, by asking to what extent Swedish companies can claim the scientific research exemption in Article 9(2)(j) GDPR when processing health data. In Swedish law, ethical review pursuant to the Swedish Ethical Review Act is required to process health data under the scientific research exemption. Therefore, the relationship between “scientific research purposes” in the GDPR and “research” as defined in the Ethical Review Act is examined. The thesis concludes that neither the GDPR nor the Ethical Review Act preclude private entities or activities that are undertaken with a commercial interest. As the definition of research in the Ethical Review Act focuses on the acquirement of new knowledge and the theoretical and/or practical value of research, the thesis argues that the definition sets forth a higher threshold of what constitutes research than the GDPR. Companies that are primarily driven by commercial interests might have difficulties clarifying the scientific value of their activities. A disadvantage is that the definition of research in the Ethical Review Act and its territorial scope do not align with that of the GDPR, creating a fragmented legal framework within the EU. Secondly, the thesis asks how the scientific research regime and its implementation in Swedish law balance the interests of data subjects against the interests of controllers, and how this balance might affect data-driven research. It concludes that the scientific research regime appears at first sight to shift the balance of interests significantly in favor of the controller. However, it is often required that the provisions' application would render impossible or seriously impair the achievement of scientific research, thereby narrowing the scope of the framework. The thesis highlights Sweden’s passive stance in terms of legislation, for example by refraining from introducing the possibility to derogate from certain rights of the data subject. While this may adversely affect the flexibility of companies engaging in data-driven research, the biggest challenge is to overcome the conflict between the GDPR and research involving substantial amounts of personal data.