Applying GDPR roles and responsibilities to scientific data sharing

Key Points Controllers are the primary bearers of obligations under data protection law. The factual test for controllership is who decides on the purpose and essential means of processing. Essential means include the types of data, the categories of data subjects, the parties having access to data, and the length of data retention. Joint control arises where two or more parties determine the purpose and essential means of processing through a common decision or converging decisions. Roles are assigned to specific processing operations, and so may differ along complex processing chains. Where personal, usually pseudonymized, data from health research or health care are shared for scientific purposes, it is often unclear how to divide up the processing chain, or what General Data Protection Regulation roles apply. This is a persistent roadblock for establishing cross-border research consortia and accelerating data-driven scientific discovery. We argue that a data user (research organization) will normally be the sole controller for a research project accessing personal data from one or more data providers (hospital or research organization), because the data user independently determines the purposes and means of the associated processing. Data providers will not normally be a controller unless they actively participate in the design of the research project or impose benefit-sharing requirements. A data provider granting access to data in its own secure computing environment will normally act as a processor on behalf of the data user. A key aspect of European Union (EU) data protection law is ensuring all parties dealing with personal data have clearly assigned legal roles, and by extension, responsibilities. Key roles defined by the EU General Data Protection Regulation (GDPR)1 include controllers, joint controllers, processors, and third parties. An organization’s role determines the scope of its legal responsibilities towards data subjects, and in cross-border scenarios, which national law implementing the GDPR applies, including extensions and derogations. Assigning roles remains challenging in network scenarios where multiple organizations are involved in processing data for different purposes. One such difficult case is research networks that share pseudonymized genomic and health-related data from patients or research participants for scientific research purposes.2 In the context of health and biomedical research, data sharing is the practice of making data generated as part of health care or research projects available to (other) researchers for research purposes. Scientific data sharing involves two primary actors: data providers who make data available (eg, hospitals or research organizations responsible for scientific cohorts), and data users conducting studies (ie, researchers organizations hosting data analysts).3 During the Covid-19 pandemic, for example, researchers required rapid access to healthcare data on patients to study factors influencing the transmission and severity of disease. Here, hospitals acted as data providers, sharing data that they collected for the diagnosis and treatment of patients for research activities, without necessarily engaging in the research themselves. Recipient research institutions acted as data users, analysing the data as part of research projects. Organizations in scientific data sharing networks face significant uncertainty over roles. This uncertainty can delay, complicate or even block sharing data. Guidance and literature addressing the GDPR and health research have largely overlooked this issue. This article aims to address this gap by outlining a systematic and principled approach to assigning roles in health research data sharing networks. This approach is also relevant to large research consortia.4 Timely clarification of GDPR roles for data sharing is also needed beyond health research, in light of the draft EU Data Governance Act5 and complementary draft EU Data Act.6 The Data Governance Act establishes a transversal framework to stimulate the sharing and re-use of personal data (and other forms of sensitive data) held by public authorities and beyond. The Data Governance Act has received criticism from data protection authorities about a lack of clarification over the GDPR roles of data sharing actors.7 We begin by reviewing the applicable legislation, case law, interpretive guidance, and literature debates about assigning (joint) controllership to complex processing chains (‘Applicable law and interpretive guidance’ section). Next, we apply the legal tests to a generic health research data sharing network (‘Who is the controller for a research project that accesses personal data?’ section). We then consider how certain contextual factors—such as benefit sharing and technical security arrangements—influence roles (‘Contextual factors where data providers may qualify as joint controllers for the research project’ section). Finally, we consider if the legal framework provides predictability as well as complete and effective protection for data subjects (‘Discussion’ section). The roles of ‘controller’, ‘processor’, ‘joint controller’, along with the concept of ‘third party’ are key to the application of the GDPR, as they determine who is responsible for protecting personal data and how data subjects may exercise their rights. Definitions are provided in Box 1. The assignment of roles has important consequences for organizational responsibility and liability for damages. Controllers are accountable to ensure respect for GDPR principles and for demonstrating compliance. This accountability cannot be delegated. Processors have more limited statutory obligations, namely that they must only process data according to the documented instructions of the controller. GDPR roles are autonomous concepts, meaning they are to be interpreted according to EU data protection law. Interpretation of these concepts is ultimately determined by the Court of Justice of the European Union (CJEU). Shortly after the GDPR entered into force, the CJEU rendered a series of rulings clarifying the scope and implications of (joint) controllership,8 discussed below. In addition, the European Data Protection Board (EDPB) has adopted guidance clarifying the definitions and obligations of controller and processor.9 EDPB guidelines are not binding as a matter of law, but they reflect a common position and understanding that EU data protection authorities agree to apply in a consistent way.10 Box 2 describes the test applied by the EDPB to determine GDPR roles. These guidelines largely codify key CJEU case law. Box 1. Key roles under the GDPR Controller ‘means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data’.a Processor ‘means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller’.b A processor is a separate entity from the controller, bound by the controller’s instructions, processing personal data for the controller’s benefit.c Joint controllership arises where two or more entities jointly participate in determining both the purposes and means of processing.d This may be through a common decision, or through converging, complementary decisions determining the purposes and means of processing, where the processing is inseparable/inextricable.e Mutual benefit may be indicative of controllership, but is not determinative.f Third Party ‘means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data’.g aArt 4(7) GDPR. b Art 4(8) GDPR. c Guidelines on the Concepts of Controller and Processor (n 9) paras 76–79. d Art 26(1) GDPR. e Guidelines on the Concepts of Controller and Processor (n 9) 3. f Ibid para 60. g Art 4(10) GDPR. Box 2. EDPB criteria for GDPR roles Adapted from EDPB Guidelines 07/2020, Version 2.0, Annex I. Flowchart for applying the concepts of controller, processor and joint controllers in practice. To determine a controller, the relevant questions are - Are you appointed as controller according to a legal act for the processing in question? (explicit legal competence), or - Is the processing necessary in order to carry out a task for which you are responsible according to a legal act? (implicit legal competence), or - Do you decide [as a matter of fact]: ○ the purpose or purposes that the data will be processed for? ○ which personal data that shall be collected and processed? ○ which categories of individuals that the processed data will refer to? ○ whether the processed data shall be disclosed and to whom? and ○ for how long the personal data will be stored? Additional qualifiers that may help the identification of a controller include the following: - Do you obtain a benefit from, or have an interest in, the processing (other than the mere payment for services received from another controller)? - Can the processing activities be considered as naturally attached to the role or activities of your entity (eg, due to roles or which responsibilities from a data protection of - you the processing of personal data to an to process the personal data on your - Do you have complete in how the personal data is processed? - the processing refer to your with the data subjects as a - Do you process the personal data for another purposes and in with its documented instructions (ie, you not have a purpose of your own for the - Do you not your own purpose in the processing other than your own interest to - another your processing activities in order to ensure that you with instructions and of - Are you a by a joint controllership - Are you and another or parties jointly involved in determining the purposes and means of the Joint - more than one have a over whether and how the processing by a common decision or by converging decisions that other and are necessary for the processing because they have a on the of the purposes and Joint control ○ the processing be without both ○ Is the processing by (ie, ○ Is a benefit from the processing a Guidelines on the Concepts of Controller and Processor (n 9) paras Where the EDPB criteria for controller are benefit from the processing is indicative of joint A mere benefit from a is not considered by the EDPB to be a joint controller, where the not have an own purpose that to the processing. GDPR on control over processing, not control over personal data are for an to qualify as a legal natural and and We on this where roles are determined by an The EDPB key questions for the is this processing that the processing for a and who a on the purpose and means of the This is factual and than determined by the of the entity or a in a is to the data protection of purpose The EDPB a essential means are determined by the and means may be determined by a Essential means include the of personal data the of the processing, the categories of and the categories of data subjects data are The of these essential means is by the purpose of processing. means include security EDPB and legal literature specific to health largely on GDPR such as uncertainty over what personal data pseudonymized the scope of the scope of the scientific research well as associated and data and the lack of it to complex processing chains and data sharing in this the EDPB has such as legal in cross-border and The EDPB has guidance on other under guidance, such as or an legal to The EDPB and legal literature have not in the of applying GDPR roles in scientific data sharing defined research projects. We must on case law, guidance, and literature addressing complex processing chains in other Key questions include what over the purpose and means of processing, and how to divide up the processing different to the CJEU and a controller is a with over the purposes and means of This test aims to ensure effective and protection of the data In the CJEU that a a a joint controller by to on the of and to personal data and for and the not process personal data, it the processing by by establishing the for its own In the CJEU that an a joint controller with it a on its to on and to their the and making and processing to not process the data, for the processing, or direct from In the Court determined that the jointly responsible for by in which it and even it required that the of a controller, even controllers on the of processing, and of and of these the CJEU has adopted a which the scope of joint controllership according to of data processing in complex processing This approach is to the scope of responsibility of a (joint) controller only to the of data processing in which the controller as determining the means and may be involved different of a processing chain, to different In the only joint controller for the data and by In the controllership limited to the and by transmission to The in the of the General in the is that are responsible for one is The EDPB that processing chains must be on a the processing of personal data may be into processing for which be considered to determine the purpose and means the other a or of processing may also for the in which case it is that the processing involves one or more joint In other it is that the different processing of the as as of may have a different it is necessary to whether these processing not be considered as a of a joint purpose jointly defined the purposes of processing is key to up the processing chain, to if processing be or as part of a The of processing activities cannot be for the of parties involved in processing. it must ensure the effective and complete protection of data criticism has the approach on from complex networks of data and we the for in controllers to an of responsibilities in that The approach is to lack predictability and and to to responsibility and In the we to apply and the approach in the context of health In a on purpose can ensure and chains of sole controllers can effective as long as they their obligations, due and to ensure data subjects are to exercise their we data sharing in the health research context involves data providers, such as that make pseudonymized health data and data users, such as research conducting a research is to that a data user is normally a controller for its research project in The data user determines purpose by the research to be In determining the to the research the data user also determines essential including the categories of data subjects and types of data to and the to The data user may also with necessary and providers necessary and (eg, and the data also to agree to This is all to research that are by the data and may be or for the data own uncertainty the role of data providers in the research the data provider not normally determine the research or uncertainty from the that the data provider decide whether or not to This be to determine if the processing in the research project the in who processing data for joint the approach not be access not clearly determine whether or not the processing if a data provider access to a the may a and on with the processing. In where the data user decides not to the processing will not the data provider not have an own purpose the access decision or a these decisions to be by The data providers impose through data not determine the purpose or essential means of processing. they are to ensure data sharing not to a of data protection principles or other requirements. These include to only process data for the purpose of the research to access to authorized and to technical and organizational to with data and to of data to a These not to determine purpose or they are on ensuring the research is in with data protection We that the data user is normally the sole controller for the research This of the processing not effective and complete protection of the data In health research pseudonymized data, is joint controllership and a of sole In the data provider and user have to responsibilities by In the data provider to be the data to to exercise because the provider is the only to the The data user in case to agree to in the exercise of these rights. are by of the establishing in is a data authority, a body with authority to researchers access to health and data held by also data from the relevant or and data in a secure the legislation, researchers must all essential means of their projects and are considered This that the is sole controller for the research can be in the European also a access to health care data under the This describes the research as a controller for In the Data Protection Act of that researchers processing personal data for scientific research are the data controllers also where they not the data In this an is required to a for this processing. Data providers are more to qualify as joint controllers in two where they benefit in certain from the of a research and where they access to data in a secure processing Mutual benefit is an of joint Where a data provider the to share certain from the of the it is more to be considered a joint controller for the research even where the data provider not or participate in the of the research The common direct benefit of scientific research is for scientific through or on scientific A data provider may impose and associated that of by the user for the data This may from a in or to on scientific for data and sharing not have a to the purposes of processing in the case of a mere is to in joint is not as a benefit as the of benefit that joint control in in usually direct in, and accountability the research This is required from a research in the research the data provider as a joint controller. may not direct so this alone may not be in research is a that the data provider is a joint controller for the research This is to the case where the the to a benefit from An can be in the of a of and associated health data from patients with and A of to stimulate and and through and to health research data, that generated will be by and on behalf of the The is to to act as a for The of in this may be of joint are to to joint control where they are such as where that the of from research projects with a meaning access decisions are not on the A third of benefit of research is data A data provider as a of access that that are in a that their scientific be for The a of data and such a in its data and of data from or An of data be to or of the of An of data be data or data according to or These activities can the scientific of the data not for the specific research project but also for A to data to the data provider that the data provider is a joint controller in the research this may on In the data provider benefit from having more data to re-use for its own scientific purposes or to more users and associated scientific access or This be to or even the data provider has an own purpose to its data from the research In other the purpose of may be and may be more for the benefit of the user or the scientific such as to ensure the and of the research data are often only certain projects will data. This the data user decides on the purposes and and the data provider only to benefit if the decides to an important for scientific data sharing is the of These are a of that to the of data without the to and the required Data providers to data to users may to access data in a secure processing for example, is to researchers access to health and data collected from its own secure computing environment provides access to the data a secure provided or by may be also an to research are not they are from the the of Data providers may even decide to data from users, only forms of access where a can only a research or The data provider the data and only certain to the such as or for example, provides on behalf of for activities access is for scientific A may to with a of defined can the to be and the is to and the the and the with the the data GDPR role if it access to data in its secure processing The data provider provides data, but processes the data as part of the research The data provider also the and This means the data provider is a processor for the research where the data provider the available and determines the security in the computing this is not to joint The of or and security are of means that may be determined by the factors will determine controllership, such as in the design of the research project or benefit-sharing This with on access for research purposes. a research project in the secure computing the accessing is as controller. role is as the which it is considered to be a We have the criteria for assigning roles of data controller and data processor, and have how these criteria are to apply to different data sharing is that the data user normally determines the purpose and means of processing in the research project independently from data and is the sole controller for the research This is not to be by the of a access that the data provider will act as a an cannot its role in scientific data sharing data providers have agency to design their data sharing in that to a assignment of roles under the GDPR. A data provider that to the obligations associated with a joint controller for a research project be to in the research and for data users to share or data. scientific organizations and joint controllership the scientific data sharing to ensure are in data In are to have in the protection by the significant protection is where the controllers for their GDPR chains of sole controllers have obligations to and other the accountability a data provider must only share data with data users who their to with data protection Data providers also impose or other on data users to ensure their compliance. that data will not be to exercise their are also limited in scientific data sharing Data users only pseudonymized data are not to data subjects with the exercise of their and are from data unless they from the data or data The data provider necessarily remains the of for data subjects in scientific data sharing The data provider has an to an with to data subjects to exercise their this is a only applying to the to and a matter of and it is well the of scientific data sharing networks to chains and to responsibilities towards data are also that a approach is to may to and organizations over how to divide up the of processing, what roles to and what to In roles can be and applied in scientific data sharing by on specific processing and the purpose A of sole controllers may in be to than joint Joint controllers must their responsibilities in a in in data subjects to exercise their and in responsibilities can be uncertainty remains over the scope of legal (joint) controllers and involved in processing face joint and liability for or from of the The GDPR provides a from joint liability to who can it responsibility all for the This significant uncertainty for joint controllers over the scope of their In where control is limited to a of processing, the controller is and the of responsibility are clearly roles of data processor and controller in the context of scientific data sharing is a significant The approach data sharing networks to roles for specific processing This must and the of data subjects to exercise their or for damages. that a research access to data from one or more data providers will normally be the sole controller for the processing involved in the research data not joint controllership for a data Data providers may joint controllers for the research project where they are actively involved in the design of the research or where they in or data from the research The data provider granting access will be a processor for data and The is to the sole controller for the research on case law and EDPB largely by the roles assigned in data sharing This approach can effective and complete protection of the data in scientific data sharing as long as all parties involved and their GDPR is needed to more complex such as where scientific data act as data providers and data users, and where a of and are the of the of organizations involved in processing and the of their will only has on the sharing of genomic and health-related data for research purposes, it for data sharing The Data Governance Act also that data users be provided access to personal data in secure processing an of how a to secure processing may role clarifying the roles of in data sharing networks is an essential to the to more from personal data all without the protection of data is the controller for a research project accessing personal and or to data. This by from the European research and of and by the and project of by and are of the an under the Act and by as a of the of