COVID-19: Who’s Afraid of Data Sharing?

Public health emergencies create a new context in which societies must balance competing priorities. Indeed, as a liberal society with individual rights at heart, we are confronting questions regarding how to further our collective, shared interests in fighting the global pandemic. Public health emergencies give the State distinct powers foreseen in laws adopted long ago by free and democratic societies. Yet these powers generally provide for dealing with only the most immediate of concerns, such as public order.

Within this pandemic, we also have a unique opportunity to further develop and frame the often neglected human rights to: science and its benefits, health, and non-discrimination in health services. These rights are more important than ever in our current situation. Giving effect to the ideas embedded in these rights requires not only research, but also access to already existing public health research data, genetic data and to environmental and socio-demographic data, to say nothing of emerging COVID-19 clinical data. Whose data is it? What purpose should or can it serve? How to respect both individual and collective interests?

During a pandemic – a global health crisis – the sharing of individual data for the public good is indispensable. Viruses and other pathogens recognize no borders and neither should our health data. The OECD’s 2017 Recommendation on Health Data Governance already emphasized the need for greater international collaboration and health data sharing. The ethical imperative to ensure coordination and collaboration has only intensified. To this end, the Wellcome Trust has called upon the scientific community to ensure that data and research related to the COVID-19 pandemic are shared rapidly and openly.

Andrea Jelinek, the chair of the European Data Protection Board, has issued a statement saying that data protection rules do not impede responses to the pandemic. To this end, European data protection rules foresee the ability to collect and share data for the purposes of public health, and for the purposes of an individual’s vital interests. Certain rights that individuals have with respect to personal data may also be curtailed in these unprecedented circumstances, thus allowing data use for public health needs with minimal disruption. Despite this, data sharing may still not happen as freely as needed where international collaboration is needed. European privacy law’s emphasis on protecting data, regardless where in the world data is located, means that the protections must be ensured except in very specific circumstances. For example, an individual patient’s vital interests are not viewed as being furthered where data about that individual are transferred internationally for general biomedical research not expected to immediately benefit the individual patient. Nevertheless, there is generally a recognition of the necessity of a flexible approach to the balancing of rights and interests in current circumstances.

But what then of Canada? Here, the provincial patchwork of data protection laws and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) have perhaps unwittingly created barriers for direct data access. An example of this is when infectious and respiratory disease researchers have difficulties accessing securely coded individual health data‒including that held by the public health agencies themselves! Moreover, while British Columbia has temporarily allowed health care bodies to transfer data outside of Canada for certain COVID-related purposes, this does not extend clearly to ongoing research. Preserving privacy protections in cross-border data flows is essential, yet one wonders if such prohibitions are misguided by not providing flexible transfer mechanisms for data transfers to countries with equivalent or more robust data protection standards.

In these times more than ever, we must turn to the balancing of interests that privacy and data protection law requires. In this vein, the Office of the Privacy Commissioner of Canada has indicated its commitment to a “flexible and contextual approach” that also protects the privacy of Canadians. Both federal and provincial privacy laws have the idea of balancing at their core, such as those that call for the public interest in conducting research to exceed the public interest in protecting privacy. In our current circumstances, it is difficult to not see the scales tipping in favour of disclosure of personal health information for invaluable research.

The federal government’s plan to “modernize” PIPEDA will be a milestone for domestic and international research collaboration. Given the federal government’s emphasis on notions of consent and of control in their Digital Charter, we hope that they will not forget about how changes to data processing consent may affect the availability of personal data for research purposes. In this vein, there is much inspiration to be drawn from European data protection principles that recognize broad consent as suitable for processing personal data for research purposes.

Now is the time for big ideas that not only help us make it through today and tomorrow, but that also lay the foundation for a more sharing society once the pandemic ends. The establishment of the new Quebec COVID Biobank signals a commitment to the pursuit of knowledge by facilitating partnerships for research on a national and international scale. As the past weeks have shown, now is a time of citizenship and of solidarity. Indeed, it is only by working together that we can all move forward.