Informed consent and the new EU regulation on data protection

Principles for data protection play a crucial role in a large part of medical and public health science, especially for epidemiological research. Since the Helsinki Declaration (http://history.nih.gov/research/downloads/helsinki.pdf), the informed consent rule is often taken as the starting point for research. Informed consent is also the starting point in the current Directive for Data Protection in the EU and in the text for a new European Regulation. It seems to follow the reasoning that research involving sensitive data—all medical data are considered sensitive—cannot be done without informed consent. However, in practice large collections exist of medical data that are collected for other purposes, e.g., medical data that are collected during routine care. Research based on such data cannot be based on a specific informed consent for logistic and cost reasons. This would preclude the use of such data for research although all would agree that these data sources ‘hide’ incredibly important information of value in treatment and prevention of present and future diseases. Medicine has a long tradition of learning from practice. When a doctor treats a patient, she or he will learn something in doing so which may help the next patient. In the past this was merely communicated to some colleagues, or in a paper describing one or a few patients. The use of large databases with the collective experience of patients and their doctors is nothing but an extension of this age-old learning process in medicine. It permits medicine to correct itself, based on past experience. In a sense, it is a kind of quality monitoring of medical activities. Collected evidence from routine practice is especially valuable, for example, to learn about adverse effects of treatments. If the informed consent principle prevails, use of valuable information to the benefit of the next patient will be hampered. Of course, well-meaning exemptions will be made. Researchers might work on exemptions that will allow such use under certain rather strict conditions, administered very differently by owners of these collected data. Time has come to change and rethink. People who use existing data to learn about mistakes in medical treatment, or to identify hazards related to our environment or political decisions, are not doing anything wrong. Moreover, there is ample evidence that the public supports such use of data; patients are happy to know that their experience might serve others. Our main ethical concern should be with not ‘permitting to use these existing data sources’—especially since use of these data can be done without risk of harm, and without risk of unwanted disclosure of personal information. The purpose of this type of research is to learn about causes operating in populations by summarizing information from thousands of people, presenting results as statistics—showing for example risk related to use of contraceptives, social inequalities in health, benefits of cancer prevention, epidemics of ADHD and so on. Data protection laws have been interpreted differently in many countries. One reason is that severe misuse of personal data has been done by governments or other third parties in the past—actually not by researchers. For that reason the best repository of medical data sources would be research departments and not governmental institutions, and they should in principle be open for all research based on good quality protocols as evaluated by an independent committee. In such a system, data could be used in research also without specific informed consent and the use of these data should be encouraged. Patients do expect us to provide the best possible service we can. They expect us to detect hazards when they are important. Informed consent plays a key role in the Helsinki Declaration dealing with randomized trials—which are fine, but it is a different situation, not concerning learning from the things that happen in medical practice, but subjecting patients to something new. Most people would agree that if you enter a research project that involves a risk, you should know about this and have the opportunity to opt out. In like manner, one might argue to leave open an ‘opting out’ possibility for the use of patient information—i.e., to be ‘forgotten’ in future research based on routine data. This could be administered without ruining the core information that these data sources provide. We suggest that the EU take out the research part of the new regulation if they need to go on with their time schedule for the new law. It is unacceptable that an important part of medical research has to be based upon exemptions in the legal text. Too many opportunities to improve the health of the populations might be lost—and the populations in Europe will carry the cost. It is as important to protect people as to protect data.