Purpose definition as a crucial step for determining the legal basis under the GDPR: implications for scientific research

The General Data Protection Regulation (GDPR) of the European Union, which became applicable in 2018, contains a new accountability principle. Under this principle, controllers (ie parties determining the purposes and the means of the processing of personal data) are responsible for ensuring and demonstrating the overall compliance with the GDPR. However, interpretive uncertainties of the GDPR mean that controllers must exercise considerable judgement in designing and implementing an appropriate compliance strategy, making GDPR compliance both complex and resource-intensive. In this article, we provide conceptual clarity around GDPR compliance with respect to one core aspect of the law: the determination and relevance of the purpose of personal data processing. We derive from the GDPR's text concrete requirements for purpose specification, which we subsequently apply to the area of secondary use of personal data for scientific research. We offer guidance for correctly specifying purposes of data processing under different research scenarios. To illustrate the practical necessity of purpose specification for GDPR compliance, we then show how our proposed approach can enable controllers to meet their compliance obligations, using the example of the overarching GDPR principle of lawfulness to highlight the relevance of purpose specification for the identification of a suitable legal basis.

Digital Online Patient Informed Consent for Anesthesia before Elective Surgery-Recent Practice in Europe

BACKGROUND

Digitalization in the health system is a topic that is rapidly gaining popularity, and not only because of the current pandemic. As in many areas of daily life, digitalization is becoming increasingly important in the medical field amid the exponential rise in the use of computers and smartphones. This opens up new possibilities for optimizing patient education in the context of anesthesia. The main aim of this study was to assess the implementation of remote consent in Europe.

METHODS

An online survey entitled "Digital online Patient Informed Consent for Anesthesia before Elective Surgery. Recent practice in Europe," with a total of 27 questions, was sent by the European Society of Anesthesiology and Intensive Care (ESAIC) to their members in 47 European countries. To assess the effect of the economy on digitalization and legal status with regard to anesthesia consent, data were stratified based on gross domestic product per capita (GDPPC).

RESULTS

In total, 23.1% and 37.2% of the 930 participants indicated that it was possible to obtain consent online or via telephone, respectively. This observation was more often reported in countries with high GDPPC levels than in countries with low GDPPC levels. Furthermore, 27.3% of the responses for simple anesthesia, 18.7% of the responses for complex anesthesia, and 32.2% of the responses for repeated anesthesia indicated that remote consent was in accordance with the law, and this was especially prevalent in countries with high GDPPC. Concerning the timing of consent, patients were informed at least one day before in 67.1% of cases for simple procedures and in 85.2% of cases for complex procedures.

CONCLUSION

Even European countries with high GDPPC use remote informed consent only in a minority of cases, and most of the time for repeated anesthetic procedures. This might reflect the inconsistent legal situation and inhomogeneous medical technical structures across Europe.

How to address data privacy concerns when using social media data in conservation science

Social media data are being increasingly used in conservation science to study human-nature interactions. User-generated content, such as images, video, text, and audio, and the associated metadata can be used to assess such interactions. A number of social media platforms provide free access to user-generated social media content. However, similar to any research involving people, scientific investigations based on social media data require compliance with highest standards of data privacy and data protection, even when data are publicly available. Should social media data be misused, the risks to individual users' privacy and well-being can be substantial. We investigated the legal basis for using social media data while ensuring data subjects' rights through a case study based on the European Union's General Data Protection Regulation. The risks associated with using social media data in research include accidental and purposeful misidentification that has the potential to cause psychological or physical harm to an identified person. To collect, store, protect, share, and manage social media data in a way that prevents potential risks to users involved, one should minimize data, anonymize data, and follow strict data management procedure. Risk-based approaches, such as a data privacy impact assessment, can be used to identify and minimize privacy risks to social media users, to demonstrate accountability and to comply with data protection legislation. We recommend that conservation scientists carefully consider our recommendations in devising their research objectives so as to facilitate responsible use of social media data in conservation science research, for example, in conservation culturomics and investigations of illegal wildlife trade online.

The right to traditional, complementary, and alternative health care

BACKGROUND

State parties to human rights conventions and declarations are often faced with the seemingly contradictory problem of having an obligation to protect people from harmful practices while also having an obligation to enable access to culturally appropriate effective healing. As people increasingly migrate across the globe, previous distinctions between 'traditional' and 'complementary and alternative medicine' practices are being transcended. There are connections across transnational healing pathways that link local, national, and global movements of people and knowledge.

OBJECTIVE

This paper contributes to the development of the concept and practice of the right to health in all its forms, exploring the right to traditional, complementary, and alternative health (R2TCAH) across different contexts.

DESIGN

The paper draws on four settings - England, South Africa, Kenya, and Jordan - and is based on key informant interviews and a literature review undertaken in 2010, and updated in 2013. The paper begins by reviewing the international legal context for the right to health. It then considers legal and professional regulations from the global north and south.

RESULTS

Additional research is needed to establish the legal basis, compare regulatory frameworks, and explore patient and provider perspectives of regulation. This leads to being able to make recommendations on how to balance protection from harm and the obligation to ensure culturally appropriate services. Such an exploration must also challenge Western theories of human rights. Key concepts, such as individual harm, consent, and respect of the autonomy of the individual already established and recognised in international health law, could be adopted in the development of a template for future comparative research.

CONCLUSIONS

Exploration of the normative content of the right to health in all its forms will contribute to supporting traditional, complementary, and alternative health service users and providers in terms of access to information, non-discrimination, clarification of state obligations, and accountability.