Good news: Finally there is light at the end of the tunnel for GDPR rules in health research

If there is one thing that can keep health science researchers awake at night, it is surely the four letters G-D-P-R.

In recent years, challenging legal issues with data processing have increasingly gotten in the way of Danish health research.

For this reason, Department Head at the Department of Clinical Medicine Jørgen Frøkiær was in August 2021 a signatory to an article in the Danish news media Altinget under the heading ”Ledere af kliniske institutter: GDPR-bureaukrati truer Danmarks status som forskningsnation” (Heads of clinical medicine departments: GDPR bureaucracy threatens Denmark’s status as a research nation). Together with the heads of Denmark's three other clinical medicine departments, he explained how both national and international research collaborations come to a standstill due to contradictory interpretations of the Danish Data Protection Act and the European General Data Protection Regulation (GDPR).

The article was read very carefully at Christiansborg. This gave rise to the Danish Parliamentary Committee on Education and Research questioning the Minister of Justice and the Danish Parliamentary Health Committee doing likewise with the Minister for Health.

As a result, the Danish Data Protection Agency has now entered into a dialogue with the Ministry of Health to formulate new advisory texts on research and health data. In addition, the Ministry of Justice has set up a cross-ministerial working group – including the Ministry of Health, the Ministry of Higher Education and Science, the Ministry of Interior and Housing, and the Danish Data Protection Agency, which will look into the legislation in the research area.

This news was well received by Department Head Jørgen Frøkiær:

"It's gratifying that our article has, it seems, borne fruit, and that both the politicians and the government agencies now recognise the need to adjust the legislation and rules. The current situation is untenable, and these problems have major consequences for many of the research areas in which Denmark has enjoyed a leading position internationally," he says.

Jørgen Frøkiær adds that clinical research which is based on external funding and agreements with colleagues across regions and countries, has long suffered under very difficult conditions:

"Many projects come to a standstill due to uncertainty about how the data protection rules should be interpreted. So it’s high time that something is done about this. I’m pleased that work has now begun on this, and that it hopefully lead to us getting some rules that not only work on paper, but also in practice," he says.

We all share the same goal

The Department of Clinical Medicine is not alone here, as the interpretation of data legislation creates difficult conditions for researchers across all of the health science departments.

This is why action is also being taken in the Danish Management Forum for Medical Health Research, which is a collaboration between the five regions and the four health science faculties. In November 2021, as acting dean, Vice-dean for Research Hans Erik Bøtker took part in a meeting where the challenges were discussed in a new working group with the aim of resolving the legal barriers experienced by health science researchers.

The group will, among other things, prepare guidelines to be used in connection with the students' access to researcher data and ensure a common interpretation of the interplay between GDPR rules and other legislation.

Both the Danish regions and the universities are very aware that there is doubt about the interpretation of the legislation in the field of research and that this creates barriers to health research, says Hans Erik Bøtker. But he points out that the success of the working group depends on senior management in the regions and universities ensuring the right managerial anchoring of the working group’s results.

And he would like to see a more visible coordination between the working group and the initiatives being carried out within the Danish Data Protection Agency, for example.

Nevertheless, he is optimistic.

"We all share the same goal – to see a uniform interpretation of the Data Protection Act and the GDPR. I choose to have a realistic expectation that clear guidelines will solve the problem. That is, of course, provided that everyone complies with them."

A brief history

11 August 2021: Department Head at the Department of Clinical Medicine Jørgen Frøkiær together with the heads of Denmark’s three clinical medicine departments writes an article in the Danish news media Altinget under the heading ”Ledere af kliniske institutter: GDPR-bureaukrati truer Danmarks status som forskningsnation” (Heads of clinical departments: GDPR bureaucracy threatens Denmark’s status as a research nation). The article explains how both national and international research collaborations come to a standstill due to contradictory interpretations of the Danish Data Protection Act and the European General Data Protection Regulation (GDPR).

12 August 2021: The Danish Parliament's health committee introduces question no. 1554 for the Minister of Health: "Will the minister address the concerns raised in the article ”Ledere af kliniske institutter: GDPR-bureaukrati truer Danmarks status som forskningsnation” (Heads of clinical departments: GDPR bureaucracy threatens Denmark’s status as a research nation) from Altinget on 11 August 2021? The question was asked at the request of Stinus Lindgreen (Danish Social Liberal Party).

9 September 2021: Minister for Health Magnus Heunicke replies to question 1554. The reply states that the Ministry of Health has now entered into a collaboration with the Danish Data Protection Agency on a number of guideline texts with a view to more specific and targeted guidance for the research area.

19 November 2021: Acting Dean Hans Erik Bøtker participates in a meeting of the Danish Management Forum for Medical Health Research. The forum discusses work on a new legal working group for health science research, which aims to resolve the legal barriers experienced by the researchers. The chairmanship is shared between the Dean of Health Lars Hvilsted Rasmussen (Alborg University) and Medical Director Kim Brixen (Odense University Hospital). The working group aims to help ensure uniform interpretation among the regions and the universities of current legislation and, thus, a clarification of the framework for the common working position. Dean Anne-Mette Hvas has now joined the Management forum for Medical Health Research, which follows the group's work closely.

10 December 2021: The Danish Parliament's Committee on Education and Research introduces question no. 50: What are the minister's comments to the clinical department heads’ appeal in Altinget on 23 August 2021, where they predict that "major research projects will stop, millions will have to be returned to the foundations etc.", because the interpretation of the GDPR and the wish for data security have become a monster that "is without comparison the biggest problem for Danish research", including the life science initiative and register-based research?" The question was asked at the request of Bertel Haarder (Danish Liberal Party).

21 December 2021: Minister of Justice Nick Hækkerup replies to question 50. The reply states that "it is considered appropriate to review the overall legislation in the area. Therefore, an initiative will be taken to establish an inter-ministerial working group that can look at the legislation in the area with the involvement of the Danish Data Protection Agency, among others."

13. January 2022: Altinget follows up with the article Nye retningslinjer for forskeres brug af data trækker ud: ”Det haster voldsomt med at finde en løsning" (New guidelines for researchers’ use of data is dragging on; “Finding a solution is very urgent”) which, among other things, includes interviews with Department Head Jørgen Frøkiær and Professor, Department Chair in Clinical Epidemiology at Aarhus University Henrik Toft Sørensen. 

January 2022: The Ministry of Justice begins the first meetings in a new cross-ministerial working group (with the Ministry of Health, the Ministry of Higher Education and Science, the Ministry of Interior and Housing, and the Danish Data Protection Agency), which is charged with looking into the legislation in the research area. The meetings of the new working group will likely have significance for the Danish Data Protection Agency's ongoing work with guidelines in the area.

In addition, a number of other initiatives are also underway. These include the Danish Comprehensive Cancer Center’s (DCCC) board appointing a cross-regional group of legal experts in 2020, with the objective of ensuring a common interpretation among the regions and universities regarding the rules for how to place responsibility for data in a research project. As part of its work, the group has looked at the question of when research collaborations should be based on a data processing agreement, and when collaborations should be based on a collaboration agreement between joint controllers. The group is expected to conclude its work in January 2022.