Data Classification

The GDPR governs the processing of personal data. In the context of health and human genetic data processing, determining when data are personal data is of fundamental importance and, at the same time, a challenge.

As portrayed in the subentry on ‘Data Protection Main Principles’, the intrinsic nature and characteristics of human genetic data raise complex challenges not only for data classification but also for the interpretation and application of data protection principles and rules as a whole.

Concerning the processing of human genetic data within the clinical, health and pharmaceutical ecosystems, including for research purposes, it becomes increasingly harder to underpin when genomic data is to be considered personal data. As technical and scientific developments unfold, the analysis of human genetic data becomes increasingly specialized and complex, which may result in the segmentation of human genetic data to an extent which may hinder the task of classifying it as genetic information, health information and personal or non-personal data.

Furthermore, human genetic data is often pseudonymised or processed through automated means which seek to take out the personal or identifiable elements of such data. Very often, such measures do not ensure the irreversible anonymisation of personal data given the subsistence of a link, albeit indirect, with the data subject to whom such data concerns.   

At the same time, genomic data may be seen as inherently identifying personal data (even in cases where there are no further links to or impacts on the data subject) since these are, in themselves, elements which inextricably integrate part of a person’s identity.

Moreover, another challenge is the interpretation of the concept of human genetic data as defined in the law. The scientific and legal ambiguities associated with this particular kind of data, as well as the current tendency for legal fragmentation and the lack of a homogenous approach, jeopardize a tangible definition. This generates risks and threats related to the existing data protection principles and requirements, as well as the disruption of the potential for specific regulations, guidelines or best practices on the processing of human genetic data across the EU.

Although the concepts of genetic and health data may overlap, genetic data may provide insight into a data subject’s future health condition. Additionally, genetic data may unveil information concerning groups of individuals (such as family). This also brings about intricacies in the application of data protection principles and provisions as most legal frameworks take an individualistic approach to data protection rights.

Any processing of personal data must comply with the GDPR, deemed to be the most stringent law on data protection in the world. When the data at stake are sensitive data - such as health and genetic data – the process becomes even more complicated, for a start because two cumulative legal grounds must be met to guarantee the lawfulness of the data processing: a general legal ground for every kind of personal data processing, set forth in Article 6(1) of the GDPR, and a specific legal ground, required only for sensitive data, established in Article 9(2) of the GDPR.

Failure to comply with the norms of the GDPR might involve heavy administrative fines. Article 83 GDPR provides for two tiers of fines: the less severe ones can go up to €10 million, or in the case of an undertaking, up to 2% of the worldwide annual revenue from the preceding financial year, whichever amount is higher (Article 83(4) GDPR); whereas the most severe infringement can result in a fine up to €20 million, or in the case of an undertaking, up to 4% of the  worldwide  annual revenue from the preceding financial year, whichever amount is higher (Article 83(5) GDPR). In addition, the data controllers and/or data processors that, due to the infringement of the GDPR, caused material or non-material damages to a natural person, might be asked to pay compensation for damages, as per Article 82 of the GDPR. 

The GDPR does not exclude the provision of criminal penalties for its violation, as provided for in the national laws of Member States.

A way to avoid being ruled by the GDPR - and thus to avoid its severe sanctions – is to operate with anonymised data instead. However, full anonymisation is extremely difficult to reach, as even the smallest detail can reveal the natural person’s identity.[2] The challenges posed by anonymization are especially stringent in regard to health data and genetic data. It has been said that anonymisation is impossible to achieve, as it is always possible to reverse the process and identify the data subject. This is especially true for genetic data, which are related to core identifying features of the human person.

GDPR’s Recital 34 extends the definition of genetic data to a general concept, which not only includes chromosomal, DNA or RNA analysis, but all other types of analysis that enable the obtainment of equivalent information. Thus, although it may be suggested that (i) not all genetic information is genetic data; (ii) not all genetic information is personal data; (iii) a genetic sample is not personal data until it enables the drawing of conclusions through analysis and data production; as well as that (iv) data resulting from the analysis of genetic data may only constitute personal data to the extent such genetic data is associated to an identifiable person; the definition of personal data included in the GDPR is broad to the extent that encompasses any identification by reference to factors specific to the genetic identity of an individual, independently of the means of analysis at stake.

Consequently, the practical effect of such interpretation leads us to the conclusion that the processing of human genetic data (which includes core genetic markers uniquely related to a person), as well as the results stemming from such processing, will most likely constitute personal data. Moreover, the processing of certain special categories of personal data, in particular genetic data,  must comply with Article 9 of the GDPR.

Additionally, all results stemming from the analysis of genetic data which are linked to a specific biological sample are usually personal data, even if the results themselves are not unique to the individual, because the sample is by its nature specific to an individual and provides the link back to his/her specific genetic identity.

Nevertheless, it should be noted that in some cases genetic data may not constitute personal data. Suppose, for instance, anonymised information (for instance, genetic testing results) that may no longer, in any circumstance, be associated with a specific person, provided that there are no further records of genetic identity nor any other identifier. However, as seen, this scenario is not common in practical terms.

In a 2021 document, the European Data Protection Board (EDPB) recognised the fallibility of anonymisation techniques regarding genetic data and recommended data controllers always treat those data as if they were personal data, even when allegedly anonymised: "The EDPB points out that the possibility to anonymise genetic data remains an unresolved issue. As yet, it remains open to be demonstrated whether any combination of technical and organisational means can be effectively employed to remove genetic information from the material scope of the GDPR (...) it is strongly advised that such genetic data is treated as personal data and that the processing thereof is conducted with the implementation of appropriate technical and organisational measures to ensure compliance with the Regulation" [3]

[2] Finck, M., & Pallas, F. They who must not be identified—distinguishing personal from non-personal data under the GDPR. International Data Privacy Law, 10(1), 11-36, 2020.

[3] European data Protection Board, EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, 2 February, 2021, https://edpb.europa.eu/sites/default/files/files/file1/edpb_replyec_questionnaireresearch_final.pdf?fbclid=IwAR1Vq9hjGYWjgfRHZdT6K326uQCEWHqaSdppoBHBVrm0rcUCSr7vIAh4PLU

The European Commission has already made note that there is an enormous volume of data not being used in the EU (eventually due to limitations imposed by the GDPR and the fear of violation of its demands), which has resulted in huge financial losses and undermined our technological development. The EHDS Regulation Proposal aims to respond to these needs, creating a more flexible regime to operate with electronic health data. Contrary to the GDPR - which strongly restricts the use, reuse and sharing of personal data - the EHDS Regulation Proposal aims to boost all these activities. One of its promising norms is Article 34, which sets out the requirements for secondary uses of these data by the data users, pursuant to a data permit to be issued by the health data access bodies (data access request targeting multiple data holders), (Article 49 EHDS Regulation Proposal), or by the data holder itself (data access request to one single data holder in one single Member State). (Articles 45-46 EHDS Regulation Proposal)

Another possible way to engage in data processing without being bound by the demanding criteria imposed by the GDPR is to use synthetic data, that is, data that are produced by artificial intelligence.[4] Some experts claim that synthetic data are not personal data and, as such, are not ruled by the GDPR.[5] However, this assessment is still open to discussion. In a press release from the European Data Protection Supervisor,[6] it is said that synthetic data may allow the identification of the individuals to whom the data used to create such synthetic data refer. If this is demonstrated correct, synthetic data must still be considered personal data.

[4] Synthetic Data - What Is It and What You Need to Know About It, Hyperight, Feb. 22, 2022

[5] What Privacy Officers Need to Know About Synthetic Data, WireWheel, July 13, 2021

[6] Synthetic Data | European Data Protection Supervisor

Before initiating any data processing involving personal data, the data controller must guarantee that its organization complies with the principles of data protection by design and by default (Article 25 of the GDPR). This previous assessment might prevent future lawsuits for failure to provide adequate protection to the personal data being processed. Amongst the technical safeguards to be taken, note the procedures for automatically classifying personal data, forms of pseudonymization and encryption of data, and technical cybersecurity measures.

The appointment of a Data Protection Officer (DPO) is always recommended, to ensure that the data processing complies with the GDPR. However, in some scenarios it is mandatory: whenever the organization processes sensitive data on a large scale; or, for all other types of personal data, whenever the processing involves large scale, regular and systematic monitoring of individuals (Article 37 of the GDPR).

Each data processing activity requires a proper legal ground to be considered lawful, as required by Article 5(1)(a), which must be found in Article 6(1) of the GDPR. The data controller must analyse which one of the situations listed in Article 6(1) is more adequate in light of the particular circumstances.

Consent might be the more intuitive option (Article 6(1)(a) of the GDPR), but in fact, it is extremely difficult to meet the demanding conditions laid down for consent as a legal ground: it must be informed, voluntary, specific and expressed by a clear affirmative action. Therefore, consent cannot be presumed by mere behaviours, such as accepting a previously ticket box (it must be ‘opt in’ and not ‘opt out’).

When personal data are also sensitive data, an additional legal ground is required, to be found in Article 9(2) of the GDPR. There is no absolute coincidence between the legal grounds provided for in Article 6 and Article 9 of the GDPR, which makes the search for a double legal ground a complex task.

A Data Protection Impact Assessment (DPIA) must be carried out whenever the data controller uses new technologies, whose characteristics make them suitable to negatively interfere with the rights and freedoms of natural persons (Article 35(1) of the GDPR). This is especially the case when the data processing involves automated processing, including profiling; massive processing of sensitive data (as listed in Article 9(1) of the GDPR); or systematic and extensible monitoring of publicly accessible areas (Article 35(3) of the GDPR).

This would certainly be the case of a biotechnology company offering genetic tests directly to consumers in order to assess and predict health risks or, similarly, a healthcare provider or hospital processing patients’ genetic and health data through the hospital information system.

Among other triggers, the processing of genetic human data often relates to sensitive data or data of a highly personal nature, as well as data concerning vulnerable data subjects and/or data processed on a large-scale. Stakeholders ought to bear in mind that, whenever these factors are applicable, a DPIA should be undertaken.

In some cases, the data controller will be required to maintain records of the processing activities (Article 30 of the GDPR):

1. When the company has more than 250 employees;
2. When the processing might involve risk to the rights and freedoms of data subjects;
3. When data processing is not occasional (to be ‘not occasional is not the same as ‘to be systematic’); or
4. When the processing involves sensitive data (in the sense of Article 9(1) of the GDPR) and/or data about criminal convictions and criminal offences (as per Article 10 of the GDPR).

Any personal data processing is subject to the control, and eventual prior assessment, of national (and in some countries also regional) data protection authorities, called ‘supervisory authorities’ under the GDPR. These authorities, in turn, work in close cooperation with the European Data Protection Board, which oversees the uniform application of the GDPR within the EU.

The EHDS Regulation Proposal will bring two new regulators: the National Health Data Access Bodies and the European Health Data Space Board.

Published: 14/03/2023

Updated: 01/07/2024

Authors: 

Vera Lúcia Raposo, Associate Professor, NOVA School of Law - NOVA University of Lisbon; FutureHealthlaw / WhatNext.Law

and Tomás de Brito Paulo, LL.M Law & Technology at Tilburg University, Tilburg, the Netherlands; Associate at Vieira de Almeida & Associados, Lisbon, Portugal

Reviewed by:

 Aurélie Mahalatchimy, EuroGCT WP4 Convenor, UMR 7318 DICE CERIC, Aix-Marseille University, CNRS, Aix-en-Provence- France