Protecting Privacy While Optimizing the Use of (Health)Data: The Importance of Measures and Safeguards.

Abstract

The possibilities for collecting, storing, and processing of (personal) data have increased significantly over the last decades. It has been argued that an increasing demand for health data will define the future of health research (Ballantyne and Schaefer 2020). But despite the many benefits, at the same time, people are apprehensive about the loss of control, security risks and potential misuse of their data (Street et al. 2021). This has sparked a lively debate among scholars, politicians, policy makers and the public, about the significance of privacy protection and how to cope with the implications of a digitalized world. According to Pyrrho, Cambraia, and de Vasconcelos, the privacy-debate is overly framed as a battle between the individual interest and the collective interest, which in their opinion is too simplistic. Since governments have the power to prevent data from being used for discriminatory or unfair purposes, the authors refer to regulatory proposals as “the best solution available” (Pyrrho, Cambraia, and de Vasconcelos 2022). What they do not recognize is that the European legislator has been working on this solution for decades. The right to privacy (in European law referred to as the right to respect for private life) as well as the right to personal data protection have been acknowledged as fundamental rights and have been adopted into European legislation. Both rights aim to protect similar values. They strive to provide individuals with a personal sphere in which they can think freely and shape their opinions (European Union Agency for Fundamental Rights and Council of Europe 2018). Nevertheless, the two rights possess different characteristics and should be regarded as separate rights. The “classic” right to respect for private life was originally intended as a negative right, which prohibits interference of public authorities with the private lives of individuals. However, the more “modern” right to data protection is formulated as a predominantly positive obligation, which requires the EU and its Member States to take affirmative measures for the protection of personal data (Mostert et al., 2018). In recent years, the European legislator has been trying to adopt legislation equipped for a world in which digital technology has become a central part of people’s lives. This has resulted in a modernized version of Convention 108 for the protection of individuals with regard to the processing of personal data, and the introduction of—inter alia—the General Data Protection Regulation (GDPR). The recently proposed Artificial Intelligence Act (AI Act) and the proposed Data Governance Act will complement the landscape of EU legal acts. All of these (proposed) acts contain provisions safeguarding the right to respect for private life and the right to personal data protection. European data protection legislation is built around several key principles. It requires that the processing of data is lawful, fair, and transparent. In addition, the principles of purpose limitation, data minimization, data accuracy, storage limitation, data security, and accountability must be respected (European Union Agency for Fundamental Rights and Council of Europe 2018). But the data protection legislation also