Mostert, Menno

Smit, Julie-Anne R

van Delden, Johannes J M

Utrecht University Repository

Full Terms & Conditions of access and use can be found athttps://www.tandfonline.com/action/journalInformation?journalCode=uajb20The American Journal of BioethicsISSN: (Print) (Online) Journal homepage: www.tandfonline.com/journals/uajb20Protecting Privacy While Optimizing the Use of(Health)Data: The Importance of Measures andSafeguardsJulie-Anne R. Smit, Menno Mostert & Johannes J. M. van DeldenTo cite this article: Julie-Anne R. Smit, Menno Mostert & Johannes J. M. van Delden(2022) Protecting Privacy While Optimizing the Use of (Health)Data: The Importanceof Measures and Safeguards , The American Journal of Bioethics, 22:7, 79-81, DOI:10.1080/15265161.2022.2075973To link to this article:  https://doi.org/10.1080/15265161.2022.2075973© 2022 The Author(s). Published withlicnese by Taylor & Francis Group, LLCPublished online: 23 Jun 2022.Submit your article to this journal Article views: 1398View related articles View Crossmark dataCiting articles: 1 View citing articles THE AMERICAN JOURNAL OF BIOETHICS2022, VOL. 22, NO. 7, 79–81https://doi.org/10.1080/15265161.2022.2075973OPEN PEER COMMENTARIESProtecting Privacy While Optimizing the Use of (Health)Data: The Importanceof Measures and SafeguardsJulie-Anne R. Smit, Menno Mostert, and Johannes J. M. van DeldenUniversity Medical Centre UtrechtThe possibilities for collecting, storing, and processingof (personal) data have increased significantly over thelast decades. It has been argued that an increasingdemand for health data will define the future of healthresearch (Ballantyne and Schaefer 2020). But despitethe many benefits, at the same time, people are appre-hensive about the loss of control, security risks andpotential misuse of their data (Street et al. 2021). Thishas sparked a lively debate among scholars, politi-cians, policy makers and the public, about the signifi-cance of privacy protection and how to cope with theimplications of a digitalized world.According to Pyrrho, Cambraia, and deVasconcelos, the privacy-debate is overly framed as abattle between the individual interest and the collect-ive interest, which in their opinion is too simplistic.Since governments have the power to prevent datafrom being used for discriminatory or unfair pur-poses, the authors refer to regulatory proposals as “thebest solution available” (Pyrrho, Cambraia, and deVasconcelos 2022). What they do not recognize is thatthe European legislator has been working on this solu-tion for decades.The right to privacy (in European law referred toas the right to respect for private life) as well as theright to personal data protection have been acknowl-edged as fundamental rights and have been adoptedinto European legislation. Both rights aim to protectsimilar values. They strive to provide individuals witha personal sphere in which they can think freely andshape their opinions (European Union Agency forFundamental Rights and Council of Europe 2018).Nevertheless, the two rights possess different char-acteristics and should be regarded as separate rights.The “classic” right to respect for private life was ori-ginally intended as a negative right, which prohibitsinterference of public authorities with the private livesof individuals. However, the more “modern” right todata protection is formulated as a predominantly posi-tive obligation, which requires the EU and itsMember States to take affirmative measures for theprotection of personal data (Mostert et al., 2018).In recent years, the European legislator has beentrying to adopt legislation equipped for a world inwhich digital technology has become a central part ofpeople’s lives. This has resulted in a modernized ver-sion of Convention 108 for the protection of individu-als with regard to the processing of personal data, andthe introduction of—inter alia—the General DataProtection Regulation (GDPR). The recently proposedArtificial Intelligence Act (AI Act) and the proposedData Governance Act will complement the landscapeof EU legal acts. All of these (proposed) acts containprovisions safeguarding the right to respect for privatelife and the right to personal data protection.European data protection legislation is built aroundseveral key principles. It requires that the processingof data is lawful, fair, and transparent. In addition, theprinciples of purpose limitation, data minimization,data accuracy, storage limitation, data security, andaccountability must be respected (European UnionAgency for Fundamental Rights and Council ofEurope 2018). But the data protection legislation alsoCONTACT Julie-Anne R. Smit j.a.r.smit-14@umcutrecht.nl Department of Medical Humanities, Julius Center for Health Sciences and Primary Care,University Medical Center Utrecht, 3508 GA Utrecht, The Netherlands. 2022 The Author(s). Published with licnese by Taylor & Francis Group, LLCThis is an Open Access article distributed under the terms of the Creative Commons Attribution-NonCommercial-NoDerivatives License (http://creativecommons.org/licenses/by-nc-nd/4.0/), which permits non-commercial re-use, distribution, and reproduction in any medium, provided the original work is properly cited, and is not altered, transformed,or built upon in any way.THE AMERICAN JOURNAL OF BIOETHICS 79contains provisions regarding lawful limitations andjustified interferences. The European legislator hasacknowledged that the right to respect for private lifeand the right to data protection are not absolute, thatthey must be considered in relation to their functionin society and be balanced against other fundamen-tal rights.An example of this balancing can be found in art-icle 9 of the GDPR, which in its first paragraph pro-hibits the processing of special categories of personaldata (such as biometric data and health data). Thesecond paragraph, however, provides for exemptionsto this prohibition. Article 9(2)(j) of the GDPR forinstance, states that the prohibition does not apply ifthe processing is necessary for scientific research pur-poses. When invoking this exemption, it is required to“provide for suitable and specific measures to safeguardthe fundamental rights and interests of thedata subject.”As stated in recital 6 of the GDPR, the Europeanlegislator aims to “further facilitate the free flow of per-sonal data [… ], while ensuring a high level of the pro-tection of personal data.” Thus, the rationale is thatfundamental rights must be protected, but there aresituations in which these rights can be justly interferedwith. Interferences should be limited as much as pos-sible by implementing additional measures and safe-guards. Examples of such additional measures andsafeguards mentioned in the GDPR are pseudonym-ization and data minimization.The ideology of “shaping an EU cyberspace basedon EU values” (EDPS 2016) is laudable, but puttingthe ideology into practice has been a complex task.For instance, a recent assessment by the EuropeanCommission on the Member States’ rules on healthdata in light of the GDPR, showed that the margin ofappreciation that has been granted to the MemberStates and which provides them with discretionarypowers for the implementation of specific provisions,has caused fragmentation in data protection legisla-tion, standards and guidelines throughout the EU.And because of these differences in implementationand interpretation of the GDPR—e.g. in the area ofscientific research—data exchange between MemberStates and/or EU bodies for research purposes hasproven to be challenging (EC 2021).Alternatively, the proposed AI Act is receivingcriticism for not providing adequate protection forfundamental rights and failing to secure legally trust-worthy AI (Smuha et al. 2021). Even though accord-ing to the European Commission, building anecosystem of trust is one of the policy objectives“which should give citizens the confidence to take upAI applications and give companies and public organ-izations the legal certainty to innovate using AI”(EC 2020).The collecting, storing, and processing of (personal)data has become part of almost every aspect of peo-ple’s lives. Putting these technical developments to ahalt–if at all desirable–is impossible. The EuropeanCommission has stated that “Europe’s current andfuture sustainable economic growth and societal well-being increasingly draws on value created by data”(EC 2020). At the same time, in their article, Pyrrho,Cambraia, and de Vasconcelos warn that the conver-sion of data into economic value is a threat to privacy(i.a.). Consent as well as anonymization are men-tioned by the authors as possible means for the pro-tection of privacy. But—together with many otherscholars—they acknowledge that those means are notalways attainable nor sufficient (Pyrrho, Cambraia,and de Vasconcelos 2022).Essentially, the European legislator wants to haveits cake and eat it too; it wants to optimize the use of(personal) data while safeguarding privacy. The aim isto create a culture in which effectuating data sharingand protecting privacy do not exclude each other butcan exist simultaneously. Even when it has becomeapparent that due to rapid technical developments,some of the “traditional” safeguards such as obtainingconsent and anonymizing data are becoming moreand more unattainable.This will have to be resolved with the adaptation ofother types of measures and safeguards. Examplesmentioned by the Council of Europe are: performingrisk assessments, implementing a by design approachand providing education on the implications of theuse of information and personal data (COE 2017).Measures and safeguards could furthermore include:oversight by ethics committees or data access commit-tees, engaging the public and enhancing transparency.Since the field is fast evolving, continuous researchshould be performed on what the appropriate meas-ures and safeguards are, parallel to the technical andsocietal developments. Deciding how exactly thesemeasures and safeguards should be implemented isnot necessarily a task for the EU legislator. There isroom for the Member States, professional groups, or(international) stakeholder collaborations to adapt softlaw instruments, such as guidelines or codes of con-duct, to effectuate implementation.Ultimately, the success of the European ideologywill be determined by the shaping of the measuresand safeguards.80 OPEN PEER COMMENTARIESFUNDINGFunding for the work featured in this article was providedby HealthHolland, also known as Stichting LSH-TKI.REFERENCESBallantyne, A., and G. O. Schaefer. 2020. Public interest inhealth data research: Laying out the conceptual ground-work. Journal of Medical Ethics 46 (9):610–6. doi:10.1136/medethics-2020-106152.COE 2017. Council of Europe, Consultative Committee ofthe Convention for the protection of individuals withregard to automatic processing of personal data (T-PD),Guidelines on the protection of individuals with regardto the processing of personal data in a world of Big Data,Strasbourg, 23 January 2017,T-PD(2017)01.EC 2020. European Commission (EC), White Paper onArtificial Intelligence - A European approach to excel-lence and trust, Brussels, 19.2.2020 COM(2020) 65 final.EC 2021. European Commission (EC), DG Health andFood Safety, Assessment of the EU Member States’ ruleson health data in the light of GDPR, Specific ContractNo SC 2019 70 02 in the context of the SingleFramework Contract Chafea/2018/Health/03, PublicationsOffice of the European Union, 2021. doi:10.2818/546193.EDPS 2016. European Data Protection Supervisor (EDPS),Opinion 8/2016, EDPS Opinion on coherent enforcementof fundamental rights in the age of big data, 23September 2016.European Union Agency for Fundamental Rights andCouncil of Europe 2018. European Union Agency forFundamental Rights and Council of Europe. Handbookon European data protection law (2018 edition).Publications Office of the European Union, 2018. doi:10.2811/343461.Mostert, M.,. A. L. Bredenoord, B. van der Slootb, andJ. J. M. van Delden. 2018. From privacy to data protec-tion in the EU: Implications for Big Data health research.European Journal of Health Law 25 (1):43–55. doi:10.1163/15718093-12460346.Pyrrho, M., L. Cambraia, and V. F. de Vasconcelos. 2022.Privacy and health practices in the digital age. TheAmerican Journal of Bioethics 22 (7):50–59. doi:10.1080/15265161.2022.2040648.Smuha, N. A., E. Ahmed-Rengers, A. Harkens, W. Li, J.MacLaren, R. Piselli, and K. Yeung, How the EU CanAchieve Legally Trustworthy AI: A Response to theEuropean Commission’ Proposal for an ArtificialIntelligence Act (August 5, 2021). Available at SSRN:https://ssrn.com/abstract=3899991 or http://dx.doi.org/10.2139/ssrn.3899991Street, J., B. Fabrianesi, C. Adams, F. Flack, M. Smith, S. M.Carter, S. Lybrand, A. Brown, S. Joyner, J. Mullan, et al.2021. Sharing administrative health data with privateindustry: A report on two citizens’ juries. HealthExpectations: An International Journal of PublicParticipation in Health Care and Health Policy 24 (4):1337–48. doi:10.1111/hex.13268.THE AMERICAN JOURNAL OF BIOETHICS2022, VOL. 22, NO. 7, 81–83https://doi.org/10.1080/15265161.2022.2087789OPEN PEER COMMENTARIESDisproof of Concept: Resolving Ethical Dilemmas Using AlgorithmsBryan Pilkingtona,b and Charles BinkleybaSeton Hall University; bHackensack Meridian HealthAllowing algorithms to guide or determine decision-making in ethically complex situations, and eventuallysatisfying the need for good clinical ethics consult-ation work, is a philosophically interesting but wrong-headed endeavor. The fundamental flaw in thisapproach to ethical decision-making is the assumptionthat ethical dilemmas are resolved by the judgment ofethics committees and validated by professional ethi-cists rather than through patient-centered processes.This flawed assumption leads to three issues which,taken together, are sufficient to reject the proposal.First, an incorrect algorithmic assumption is made,leading to the system being trained on, and validatedby, the wrong agents. Second, the account of the pro-fessional ethicist that underlies the argument for AI’srole in ethically complex situations is misguided.Third, the related assumption, which appears to impli-citly motivate the proposal, that medical ethicalCONTACT Bryan Pilkington bryan.pilkington@shu.edu Interprofessional Health Sciences and Health Administration, Seton Hall University, 123Metro Boulevard Nutley, NJ 07110, USA, or Department of Medical Sciences, Hackensack Meridian School of Medicine, 340 Kingsland Street, Nutley, NJ07110, USA. 2022 Taylor & Francis Group, LLCTHE AMERICAN JOURNAL OF BIOETHICS 81

Protecting Privacy While Optimizing the Use of (Health)Data: The Importance of Measures and Safeguards

https://dspace.library.uu.nl/bitstream/1874/454630/1/Protecting_Privacy_While_Optimizing_the_Use_of_Health_Data_The_Importance_of_Measures_and_Safeguards.pdf

Protecting Privacy While Optimizing the Use of (Health)Data: The Importance of Measures and Safeguards

Abstract

Similar works

Full text

Available Versions

Utrecht University Repository