A very restrictive interpretation of GDPR threatens Denmark's status as a research nation. It is a serious issue and has been for a long time. We must find a way to reduce the bureaucracy without sacrificing data security. We lack a national guideline that explains how the data protection legislation should be interpreted and complied with in practice. And we need it urgently.

2021.08.11 | Line Rønn

 

By Jørgen Frøkiær, Rikke Leth-Larsen, Jesper Hastrup Svendsen, Sten Rasmussen and Kirsten Ohm Kyvik. Department of Clinical Medicine, Aarhus University; Department of Regional Health Research, University of Southern Denmark; Department of Clinical Medicine, University of Copenhagen; Department of Clinical Medicine, Aalborg University; Department of Clinical Research, University of Southern Denmark.

In the spring, no less than four ministers jointly presented the government's new strategy for Danish life science at a press conference. The long-awaited publication was full of ambition to make Denmark a leader in health innovation by creating an even better framework for research, thus  benefiting growth and welfare.

We agree that strong Danish health research can ensure the best possible treatment for patients and benefit both the welfare state, Danish companies and the Danish economy. But if the life science strategy initiative is to succeed, we must do something about the overriding challenges which are all rooted in different and contradictory interpretations of the General Data Protection Regulation and the European data protection reform in general (GDPR). The desire for data security has ended up in a bureaucracy that has become so massive that it is without comparison the biggest problem for Danish research – and the issue ought to have been resolved long ago.

Let us begin by making clear that we must, of course, take good care of data about and the legal rights of our citizens in an increasingly digital world – we all agree on this. And to stay abreast of developments, we must regularly discuss and update the rules for how we share, analyse and store personal information. But protecting health data and research for the benefit of mankind must not become antithetical.

The interpretation of the GDPR threatens Denmark's international collaboration and status as a research nation. We experience that Denmark interprets the GDPR more restrictively than other countries on many fronts – and that we are over-implementing it.

The terrible truth is that large research projects come to a halt, millions from foundations must be repaid, PhD projects are cancelled, and both national and international collaborations come to nothing because of extremely long legal procedures. This negatively impacts the research and thus the patients who need new and better treatments for e.g. cancer, heart disease or viral infections.

Run into a brick wall

Throughout the research environments, we encounter a great deal of frustration over the barriers that prevent universities and hospitals from utilising Denmark's research and development potential. There are many different issues here, but we will make do with outlining two of the main ones: Both clinical research and register-based research are, each in their own way, trapped in the bureaucratic jungle of data management.

In clinical research, the situation is often one where the researcher has both financing and agreements with colleagues across regions or countries in place – but it is here that the project runs into a brick wall. Everything grinds to a halt because lawyers at universities and in the regions are uncertain and disagree about how they should interpret the rules on data collaboration and data sharing.

The legal offices can spend up to a year writing back and forth on even simple dataflows, and they discuss data liability both internally and across the organisation. A ground-breaking research project involving stakeholders from around the country can be killed off because lawyers disagree about which documents are required to support the exchange of e.g. data on patients’ blood pressure. We and our researchers experience that something which is possible in one region is not possible in another, and all the while the research projects are halted – leading to huge delays. Some are simply cancelled.

It is important to clarify that we fully understand that the contract lawyers are doing their job. They are bound by a desire to comply with the legal regulations when they spend many months discussing whether the parties in a project are data processors or data controllers. But we lack a national guideline explaining to the lawyers how the data protection legislation should be interpreted and complied with in practice. And we need it urgently.

Allow either the Danish Data Protection Agency or the Ministry of Justice to sit down with a group of research-based, interdisciplinary experts: Specialist lawyers in personal data and contracts, statisticians, medical doctors, anthropologists and data management experts – and maybe a couple of decision-makers from the Ministry of Higher Education and Science and the Ministry of Industry, Business and Financial Affairs – and reach an agreement on how we in Denmark should interpret the European general data protection regulation, so we take into account both data security, citizen rights and the research that the state wishes to promote.

Provide a setup with clear national guidelines and standard agreements on a shared, approved level of security that can be used across the country when hospitals, universities, regions and companies collaborate. This would significantly reduce the time spent on legal case processing and provide more important research in less time and for less money. 

Impacting Denmark's international recognition

We have the same wishes for register-based research, which runs into completely different data-related obstacles. Register-based research suffers from one of the most important core principles of the GDPR, namely the principle of data minimisation, which in practice restricts researcher access to citizens' data as much as possible.

This is a problem for a small country like Denmark, because our unique opportunities for population studies are one of the things that place us at the top of the international research hierarchy. If a group of people have worked with asbestos when they were thirty years old, we are able, as one of the few in the world, to see how they are doing when they reach sixty. Register-based research combined with biological material has also proved valuable – not least during the Covid-19 pandemic. Danish register-based research has utilised biobanks to create unique knowledge and help save lives.

However, access to registers for researchers has been hamstrung, and it takes a long time to get access to data – if this is even possible. In particular, access to direct individually identifiable data is limited, and it is therefore virtually impossible to conduct research with small patient groups and difficult to conduct research into rare diseases.

Before beginning register-based research, the researcher must pre-specify all of the requested data and submit the application to e.g. the Danish Health Data Authority, Statens Serum Institut or Statistics Denmark. Processing of the application can easily take as long as a year, so it is not unusual for a third of a three-year PhD project to be used on applying and waiting for data access.

This is detrimental to the possibility of attracting funding, and it is fairly ruinous for Denmark's reputation and global partnerships, when we again and again must abandon gaining access to the datasets on which outlined projects are based. The consequence is that the good ideas, the big collaborations with business and industry, and the ground-breaking research go to other countries.

Within register-based research we dream of having one independent joint research service that collects data from all the authorities with responsibility for registers, including the registers at Statistics Denmark, which are very important for research. This would provide secure and flexible access for the research institutions, a ceiling on the case processing time, and safeguard the individual citizen's privacy and integrity.

Wasted time, money and opportunities 

In recent years, the data-related challenges have thrown up numerous frustrated editorials, op-eds, etc.. But it has not yet been possible to make enough noise to get the responsible politicians to start listening – and acting.

One exception is Covid-19-related research. At the beginning of the pandemic, the authorities removed the bureaucratic obstacles and created a fast track where virtually everything could be done quickly and efficiently. Unfortunately, this also impacted the case processing of all other research, which is stuck in a queue indefinitely. Imagine if we could generalise and maintain the flexible Covid-19 guidelines for future use.

When four ministers are able to present the ambitions contained in the Danish strategy for life science, there must also be a couple of them who can take political responsibility for removing the biggest obstacle to it. We desperately need action, because at the moment patients and society are missing out on new treatments and increased export. We waste time, money and opportunities, while the lawyers arm wrestle.

With the strategy for life science, the government will elevate Denmark to a leading international position in the development of the healthcare of the future. We have talented minds, excellent data and good ideas, but when the law is an obstacle to research and quality assurance, then Denmark falls further down the ladder. This leads to a poorer healthcare system and a smaller life science industry than we could have had.

 

This chronicle was published in Altinget on August 11 2021 (link in Danish)