GDPR [Neurosurgery Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== GDPR ======

General Data Protection Regulation' ([[GDPR]]) which has come into force on 25 May 2018. 

There is an inherent tension between critical care research and data protection. Because of their condition it is not possible to ask for the patients' informed consent to be enrolled in observational research at the point of admission to the hospital. Often this is not possible at a later moment either. Yet informed consent is the baseline to be enrolled in research with personal data and exceptions must be allowed for by national legislation. This was the case under Directive 95/96/EC and will be the case under the General Data Protection Regulation (GDPR, Regulation 2016/679 EU) which will replace the Directive from 25 May 2018 onwards. Though being a Regulation and therefore directly applicable in the Member States, the long debate about the research exceptions in the GDPR left many aspects of observational research including the exception to the informed consent principle, mainly to the Member States. It may be assumed that most Member States will leave their present state of the law intact in this respect as that was part of the political compromise. We compared existing national privacy legislation from the perspective of critical care research and found great variation. Although this may not impede the collection of emergency and critical care research with data without prior informed consent in countries which are more responsive to such research, it might be a challenge to exchange such data from the national nodes in European wide research collaboration. We make a case that countries which are not responsive to such research should adapt their legislation in the interests of future critical care patients
((Timmers M, Van Veen EB, Maas AIR, Kompanje EJO. Will the Eu Data Protection
Regulation 2016/679 Inhibit Critical Care Research? Med Law Rev. 2019 Feb
1;27(1):59-78. doi: 10.1093/medlaw/fwy023. PubMed PMID: 29788147.
)).
----

A general overview of the European and national legal framework (relevant data protection and privacy legislation) applying to quality-of-care registries is provided. One of the main rules is that non-anonymous patient data may, in principle, not be used for research without the patient's informed consent. When patient data are solely and strictly used for quality control and improvement, this rule does not apply. None of the described registries (NHR, SWEDEHEART, and NICOR) currently ask specific informed consent of patients before using their data in the registry, but they do carry out medical data research. Application of the GDPR implies that personal data may only be used for medical data research after informing patients and obtaining their explicit consent
((Wierda E, Eindhoven DC, Schalij MJ, Borleffs CJW, Amoroso G, van Veghel D,
Mitchell CR, de Mol BAJM, Hirsch A, Ploem MC. Privacy of patient data in
quality-of-care registries in cardiology and cardiothoracic surgery: the impact
of the new general data protection regulation EU-law. Eur Heart J Qual Care Clin 
Outcomes. 2018 Oct 1;4(4):239-245. doi: 10.1093/ehjqcco/qcy034. Review. PubMed
PMID: 30060178.
)).