Maximizing the GDPR potential for data transfers: first in Europe

Abstract

During the pandemic, rapid international data sharing was key to finding medical solutions. Legal derogations made some pandemic data transfers possible.1 However, non-pandemic medical research, including cancer research, follows regular legal rules, and these rules currently create data transfer stalls, delaying medical advancements.1

Data transfers from the European Union (EU) to federal institutions in the United Stated (US) for medical research are currently impeded for legal reasons.2, 3, 4 Transfers to most of the US private sector can proceed provided appropriate safeguards are in place, but presently, US cloud providers such as Amazon Web Services, Google Cloud, and Microsoft Azure that provide large-scale, advanced data processing solutions can often not be used.5

Legal challenges therefore affect clinical trials when 1) the pharmaceutical company uses a US subcontractor providing a cloud-based analysis platform, and/or 2) legally mandated information including safety data must be reported to regulatory authorities such as the US Food and Drug Administration (FDA).

In the following, we describe the use of a very narrow safety valve derogation in the EU General Data Protection Regulation (GDPR) 2016/679 to enable such transfers. The Norwegian Data Protection Authority (DPA) concurred with our use of this legal option. To our knowledge, this is the first time-use of this derogation in Europe.