Mind the gap with Europe. Why public interest cannot be a good reason to perform observational and epidemiological research?

Abstract

The consequences of the Italian privacy legislation, that represents a very restrictive implementation of the general European regulation on data protection, have mainly been felt at the level of observational research. In this field is not always possible to obtain the consent of subjects, and as for retrospective studies, it is not currently clear which is the correct regulatory procedure to follow. This uncertainty in the law’s implementation has given way to multiple interpretations, making it difficult to obtain a homogeneous path in Italy. However, it is possible that the observation point has been totally wrong so far and that it would be more correct to choose a different legal bases than consent, both to preserve scientific progress and collective ethics, without losing the protection of the subject. This approach, which has already been followed by other European countries, could bring us closer to the rest of Europe and allow us to competitively participate in community projects that we are often cut off from.

The consent of the subject to undergo treatment is the prerequisite of legitimacy of the action of the physician. The free choice to receive interventions is protected by the Constitution and the law.^1,2 Consent must be free, aware, and informed and can be withdrawn at any time. In case of intervention without consent, the doctor (regardless of the outcome of the intervention) can incur claims for damages and, in certain cases, also criminal liability.

This assumption is even more important regarding experimental treatment; in this context, informed consent is defined as ‘a subject's free and voluntary expression of his or her willingness to participate in a particular clinical trial, after having been informed of all aspects of the clinical trial that are relevant to the subject's decision to participate or, in case of minors and of incapacitated subjects, an authorisation or agreement from their legally designated representative to include them in the clinical trial.’ ³

The sensitivity of all the phases that constitute the process - because it is a process - of informed consent in clinical trials is such that specific guidelines have recently been formulated and issued. ⁴

Over time, especially since the entry into force of the General Data Protection Regulation (GDPR), ⁵ the authorisation to process personal data has become increasingly important in addition to informed consent.

Informed consent is one of the conditions of lawfulness of the processing, listed by art. 6 of the GDPR, and represents the main right of control to authorize the processing and to withdraw it - once accepted - at any time without encountering prejudice.

Art. 4 of the GDPR defines consent as: ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.’^1,5

The consent must therefore be informed, specific, free, unequivocal. The principle of transparency, which requires the use of clear, simple language, understandable to a lay person and easily accessible, appears to be an essential and indispensable element for making consensus effective.

The impact of GDPR on research

Since its implementation, the GDPR has been the subject of intense debate in the scientific community, which has expressed concern about the possible negative impacts of the new standard on scientific progress. Cancer research groups strongly argued that GDPR should protect the privacy of patient data without compromising clinical, translational, and epidemiological research.^6-8

Moreover, some aspects of the GDPR were immediately unclear and therefore susceptible to interpretation. There are, for example, many areas of overlap between the GDPR and the European Clinical Trial Regulation 536/2014, and there is no official indication of which of the two rules, in case of overlap, must prevail. Therefore, in October 2018 the Council of the European Union submitted to the European Data Protection Committee a request for advice ⁹ on unclear aspects of the GDPR. A consultation that resulted in the publication of a question-and-answer document ¹⁰ which, however, has again left additional space for interpretation and a substantial discrepancy in interpretation and implementation in Member States. ¹¹

One of the major criticisms by researchers to the European regulation regarding privacy concerns the obligation to report in a very detailed manner, in the policy and consent, the types of analysis and research to be conducted. The impossibility of opting ab initio for the statement ‘future research’ is something that goes against the rhythm of scientific research, which should be the fastest possible not always allowing the definition of a specific purpose.

The addition of a new type of analysis, although dictated by intrinsic needs for the development of new technologies, would require the collection of a new consensus by the parties involved, with organizational and ethical consequences often challenging, such as the collection of data belonging to deceased patients.

It is a shared opinion that the onerous requirements of the GDPR add nothing more to the protection of individual patients' rights, but rather unnecessarily complicate the implementation of research that would contribute to scientific progress and the well-being of the population. All this making it extremely complex to balance individual and collective ethics. ¹²

This issue becomes incredibly apparent when talking about studies other than interventional studies, for which no one will ever want to go beyond the proper consent of data subject, such as when we refer to observational/epidemiological research that can be considered with a mere secondary use of data. ¹³

The Italian vision of data privacy in research

Italy, with the Legislative Decree 101/2108, ¹⁴ is the country that gave the most restrictive interpretation of the GDPR, ignoring some of the premises, such as recital 33.

In an initial phase, the Italian supervisory authority had opted for a more flexible implementation, ¹⁵ allowing universities and research centres to easily process data for scientific purposes. In cases of logistical and/or ethical difficulties the secondary use of data was allowed to proceed, in the absence of consent of the interested subject, provided that the Ethics Committee agreed.

This first interpretation was then amended by the final law, providing for the direct processing of data for the purpose of scientific research only if this approach is justified by a national or European Union law or by official indications from the competent authorities. In all other cases that are characterized by the impossibility of obtaining consent (for example in the case of a deceased population) it is mandatory to obtain a previous authorization of the Data Protection Authority, which is expressed with a process characterized by ‘silence – rejection’.

The publication of the final decree in 2018 and all the multiple interpretations provided by different experts compared to the two articles related to research (article 110 and 110bis) has given rise to different assessments by the different Italian Ethical Committees (EC) and Data Protection Officers (DPO). The result was a sharp distinction between those who considered, in the presence of an adequate Data Protection Impact Assessment (DPIA) and subject to a favourable opinion from the EC, to be able to proceed to the secondary use of the data even in the absence of consent of the data subject, and those who have considered the prior authorization by the Data Protection Authority mandatory from the beginning. This latter view seems to prevail considering the last opinions expressed by the same supervisory authority.

This heterogeneity becomes unmanageable in the case of multicentric projects and in the presence of a typology of clinical centres (the Research Institutes Hospitals - IRCCS) that, considering its intrinsic mission, appear to be able to act in derogation from the regulation. A current of thought holds that this type of institute, having as its mission not only the care of patients but also research, should not consider the use of clinical data for research purposes a secondary treatment. This would differentiate them from “traditional” hospitals, which, being responsible only for treatment, would have to ask the patients' consent for each new data processing.

Certainly, the regulatory framework is complex, composed of multiple predictions not always well coordinated with each other, however this should not justify the paralysis of retrospective observational research that is, in fact, happening.

Moreover, it seems unrealistic, given the number of projects of an observational nature, that the Italian privacy supervisory authority will have enough time for an assessment if the ‘restrictive’ view of the law prevails.

Are we sure we have looked at the problem from the right point of view? European perspectives

The problems of interpretation and the negative repercussions of the privacy legislation described above almost exclusively affect the sphere of observational research, since the interventional, being of a prospective nature, does not raise the issue of the collection of consent, both for participation and data processing.

In general, changing the point of view from a purely methodological sphere to that of data processing, observational research - especially retrospective research - would rather be configured as ‘secondary use’. In fact, they are going to process data already recorded or being recorded in medical records, collected for a diagnostic and/or therapeutic (primary purpose). Furthermore, this approach would be in line with the European Data Protection Board and with what is expressly stated in Regulation 536/2014. The latter, in fact, through the premise 29 formalizes the concept of ‘one time consent’: ‘It is appropriate that universities and other research institutions, under certain circumstances that are in accordance with the applicable law on data protection, be able to collect data from clinical trials to be used for future scientific research, for example for medical, natural, or social sciences research purposes. In order to collect data for such purposes it is necessary that the subject gives consent to use his or her data outside the protocol of the clinical trial and has the right to withdraw that consent at any time’. ³

From this assumption, perhaps the correct legal basis for this type of research may not be the informed consent of the data subject as much as the legitimate interest or even more - in a much more "idealistic" sense of research, especially a non-profit one - the public interest.

Obviously, this change of vision would not eliminate the responsibilities of the data controller, first of all to provide, where possible and with every effort, adequate information to patients and to implement all the guaranteed measures with regard to data management.

The identification of an alternative legal basis would also find support in the recent note of the National Coordination Centre of Ethics Committees ¹⁶ as well as the experience of other Member States of the European Union. In Spain, for example, for observational research the consent of participants is not required in cases authorised by the Ethics Committee, such as the high social impact of the project, the existence of minimal risks to the rights of subjects and in cases where the exclusion of subjects who cannot give consent could represent a serious prejudice to the study. An important methodological bias that the Italian legislation has not taken into consideration. Unique, reasonable, additional request: in the case of analysis of biological samples consent is required from family members. ¹⁷

A very similar approach is that of the Scandinavian countries, which have opted for the public interest as the legal basis for processing unless explicitly opposed.

Obviously, in order to use the public interest as a legal basis, Italy would have to promulgate a national law classifying scientific research as a public interest. For this reason it is essential that public opinion is sensitized on the topic and that the scientific community finds a channel of dialogue with decision makers.

An alternative, if it turns out to be so difficult to detach from the idea of consent, would be to fully embrace the idea of one-time consent of Regulation 536/2014: allow patients, at the time of access to institutions for their treatment path, to generally consent to the future (and secondary) use of that data for research purposes. Possibly with the obligation for the hospitals administration to make visible, through their website, all current research streams in order to respect the patient’s right not to consent to the further processing of data for some particular types of projects. This way, however, should be open to all the institutions involved in research, not just the IRCCS, as it happens to date.

If the researcher’s opinion could be physiologically influenced by the desire for research to proceed without delay, it would be very interesting to know what the real perception of patients regarding the topic of privacy is in such a delicate area. Would they be more willing to be contacted several times over time to provide specific consents for individual occasions or would they rather be willing to, in a sense, donate their data to science, enjoying in many cases a right to oblivion that has been talked about so much recently?

It is the experience of many researchers that most of their patients consent to their clinical data being used for future research whose results may be of benefit to themselves or to other patients. So, the question is: if the patient agrees to donate their clinical data for research, why does the law hinder him? The principle of self-determination should prevail.