My Lords, I shall speak also to my Amendments 14 and 111. Perhaps I may first thank the Minister and his team, who kindly agreed to see me and others to discuss what amendments I might have following my Second Reading speech. I am not sure that we resolved any issues, but I at least thank him for his courtesy and hope that, after today, we will resolve those issues.
I will speak first to Amendments 12 and 14. I beg the Committee’s indulgence for taking slightly more time than your Lordships might expect for a group of amendments, partly because I think this is the only time we are dealing with the major sector issues—the sector being the universities and other research institutions on which we are about to rely a lot for our economic growth; I will come to that. I am supported enthusiastically by the Wellcome Trust, the MRC, Cancer Research UK, the AMRC, the Sanger Institute, the Academy of Medical Sciences, the ESRC and many others. They are extremely anxious that what we do with the Bill does not in any way counter their ability to use data for productive research—and I do mean productive research. I declare an interest: I am a fellow of the Academy of Medical Sciences and of the Royal Society of Edinburgh, and I have a strong association with Dundee University. I cannot miss the opportunity to say that last week Dundee University was ranked number one globally for science innovation, beating every university in the United States. That is a fantastic achievement in science research. It beat all the so-called elite universities in England that we hear about, as well.
Clause 7 sets out a legal basis for processing personal data in the public interest. This reflects article 6(1)(e) of the GDPR. It is incredibly important to get the clause right as it will be the only legal gateway available for many research purposes. Why is this the case? Most research purposes rely on informed consent as a legal basis for processing. Consent is the basis of article 6(1)(a) of the GDPR. However, GDPR-compliant consent for the use of personal data is not always a feasible option as a legal basis. Consent is often important in the interests of fairness and transparency but will not be the appropriate legal basis for much research.
I will highlight two relevant sets of circumstances to illustrate why public interest is a necessary legal basis for many valuable research purposes. The first is where consent is not possible. There are a number of situations in which it is problematic to seek consent. Seeking consent may be impracticable where health data have been collected in the past and the time and expense seeking and approaching individuals for consent would be prohibitive. It may compromise effective population coverage; for example, requiring consent has been shown to have a negative impact on the quality of data for cancer registries. It may cause distress or harm in situations where patients may be inconvenienced or upset by being contacted for their consent to use their data for a research project, even if they do not subsequently object to the research going ahead; for example, contacting people about a study examining unexplained child deaths could cause serious distress. It may lead to bias because of self-selection bias among data subjects when asked a question. It may prevent studies large enough to produce meaningful results because the cost of seeking consent across a large number of people can be very high.
I will give one or two examples pertaining to the five issues that I have described. A study of more than 40,000 people demonstrated a highly significant association between the use of minor tranquillisers such as Diazepam and the risk of serious road traffic accidents. This was done through linking prescriptions issued by GPs and
data on hospital admissions and deaths. By the way, this study had considerable implications for the safety of patients prescribed Diazepam, and their treatment, and of course also for other road users, but would not have been possible if data could not be processed on a consent basis. A study of the incidence of breast cancer in women was used to show that affluent women have a higher incidence than socially deprived women, but that socially deprived women had poorer survival statistics. This study used identifiable data without consent; it used hospital and GP records to look at a number of factors involved in cancer treatment.
Access to patient records also helps researchers to identify suitable participants to be invited to take part in studies. This is essential for evaluating new medicines, technologies and interventions for the prevention, diagnosis and treatment of disease. For example, in my own field, when the UK collaborative trial of ovarian cancer screening was set up to investigate different ovarian cancer screening methods, 1.2 million patients were invited to take part by post, leading to 200,000 women consenting to take part. It is a world-renowned study whose results have benefited the whole world. If consent were the only available legal basis, that recruitment strategy would not have been possible as these women had not given consent to the initial contact. Of the 1.2 million women contacted, only 32 women raised any concerns about being contacted.
These are just some of the many examples of vital research that, although very much in the public interest, cannot be done on the basis of consent. The research community has developed a system of robust and proportionate safeguards for these situations, to ensure that research on important topics can be undertaken using personal data where consent is not possible while protecting the research subjects. The use of personal data in these circumstances is controlled through safeguards. Studies using health data are reviewed by the Health Research Authority’s confidentiality advisory group; they must also receive a positive opinion from a research ethics committee to be eligible. The use of this data must be considered to be in the public interest, so we have safeguards.
In this country, we also have the benefit of a National Data Guardian for health and social care—a position I very much hope will be placed on a statutory footing through a Private Member’s Bill that is progressing through the other place. This guardian’s role is to protect patients’ rights and interests over data about them, within and beyond health and care services. The reason for this exposition into the governance of personal data in health research is to illustrate that the UK has a robust, well-established system of safeguards and oversight for processing personal data in the public interest when it comes to health and medical research.
I turn to the second issue: where consent cannot meet GDPR standards. Even with the most rigorous standards and through engagement with participants, consent may not meet the new, stricter standards specified by the GDPR as a basis for processing under article 6(a). The working party of EU data protection regulators—the article 29 working party—produced an opinion in 2011 on the definition of consent that ran to 38 pages. It is not a straightforward legal basis
for researchers to use. Furthermore, data collected for research purposes often has significant value beyond the limited, original purpose of its collection. Research can proceed in unanticipated ways, with different teams using the data and processing it in such a way that the data subjects could not feasibly be informed at the outset of the full extent of how their data could be used, for what purposes or by whom.
My own unit started collecting data in 1958, before I even started as a junior doctor, and carried on collecting information manually for over 50 years. The consent we had from the pregnant women who had had babies was that we wanted to use the data to improve the services. Subsequently, 45 years later this was the only data available—in this country or worldwide—to prove that the intrauterine environment and the effect on that environment produces adult diseases. That is now well established. That information would never have been available if we did not have that data. We are proud that we have collected it.
Another example is UK Biobank. It relies on broad consent where the participants give consent for pseudonymised data to be used for a variety of research studies under certain conditions. This broad consent approach is approved by an ethics committee and reduces the burden on participants because they do not need to be contacted for consent for each new study. I have no doubt that my noble friend Lady Manningham-Buller will have something to say about this as she is the chairman of the Wellcome Trust, which is the holder of the data.
9 pm
UK Biobank is a major national and international health resource with the aim of improving the prevention, diagnosis and treatment of a wide range of serious and life-threatening diseases. UK Biobank recruited 500,000 people across the country to take part in the project. Some Members of this House might well have been contacted. Participants have provided measurements, blood, urine and saliva samples for future analysis and detailed information about themselves and agreed to have their health followed. Genetic and imaging data is now also being collected. It is a resource unique in the world. No one else will have data for 500,000 people.
Even with a broad-ranging and detailed consent process, the nature of the resource is such that the data will be used in ways that cannot yet be foreseen. It might even be used when some of the subjects are long gone. It will also be made available to bona fide researchers from all over the world. It would be prohibitively burdensome to researchers and, more importantly, to the participants if each and every use of personal data required a re-consent process. The research would grind to a halt.
Let me now express my support for the GDPR. It clearly supports alternatives to consent for research and makes clear provisions for it, with safeguards. A significant Europe-wide advocacy campaign, “Data saves lives”, which had widespread support from patient groups, strongly made the case for this during the passage of the GDPR. This coalition lobbied the European Parliament for these provisions for research.
Patient groups understand the value of and support medical research that cannot reach the high bar of GDPR-compliant consent. The UK Government were also instrumental in securing this outcome for the GDPR though shaping the position of the Council of Ministers. For these reasons, the Bill has to contain an alternative legal basis to consent for such research purposes.
My amendment, Amendment 12, seeks to ensure that the functions listed in Clause 7(a) to (d) are not read as exhaustive. I recognise that the Explanatory Notes state this much, but this goes against the general principle of interpretation of a UK statute that where a law lists specific items general statements then apply only to the same kind of items. This suggests that public interest should be interpreted as a narrow concept confined to public and judicial administration. Amendment 12 overrides the general principle of interpretation to ensure unequivocally that public interest can be interpreted more broadly than the narrow list of functions implies.
Amendment 14 builds on this provision by seeking regulations to provide further clarification regarding what the Government consider to be tasks in the public interest. This would allow scope to provide much greater clarity for public bodies without placing an undue burden on the Bill to provide this much-needed detail. The Government have strongly advocated the potential of data to drive better public services, better health and a stronger economy, for example through the Digital Economy Act and the recent publication of the life sciences industrial strategy, without which the economy will suffer. It would be a great irony if this push to better realise and unlock the value of data held and controlled by public bodies were to come unstuck as a result of data protection law in setting out clearly enough which organisations could process personal data in the public interest, or what types of processing legitimately fall under this category.
I know I have been talking for a long time, but I still have to deal with Amendment 111, which is mostly about safeguards where the other two were about the public interest. Amendment 111 concerns Clause 18 and the provisional safeguards where special categories of personal data are being processed. Clause 18 has a dual role in the Bill. It serves to set out the criteria under which research purposes are exempt from the usual data subjects’ rights set out in Part 6 of Schedule 2. This reflects the safeguarding role of Section 33 in the current Data Protection Act. However, Clause 18 also sets out the requirements for processing special categories of personal data under paragraph 4 of Part 1 of Schedule 1. This gives effect to the GDPR article 89(1) safeguards that legitimise the processing under article 9(2)(j).
Under the Data Protection Act as it stands, medical research often uses “medical purposes”, which includes medical research, for special category processing. This allows medical research as a legal basis with no need for additional safeguards. Under the GDPR, however, “medical purposes” no longer includes medical research. This means that, for research purposes that do not fall within the provision of healthcare, the only legal route for processing special categories of personal data will require fulfilling the demands of Clause 18.
The subsection of concern is Clause 18(2), which reads:
“Such processing does not satisfy the requirement in Article 89(1) of the GDPR … if … it is carried out for the purposes of measures or decisions with respect to a particular data subject”.
Most research purposes will be unaffected by this provision. However, interventional research studies such as clinical trials inherently involve processing data in order to make decisions with respect to particular data subjects as part of the research protocol.
Interventional research is vital to investigate the following: risks and causes—how genetics, lifestyle and other factors can increase people’s risk of disease; prevention—trialling drugs or lifestyle changes to reduce risk; diagnosis—developing new tests or scans for disease; safety—establishing whether a potential new treatment is safe for patients and at what dosage; treatments—investigating new drugs or combinations of drugs and new ways of giving treatment, and whether these are effective; and controlling the symptoms of disease or side-effects of medication—testing new drugs or complementary therapies. All these activities necessitate the processing of special categories of personal data, such as health data, to make decisions about that data subject in terms of their participation in a recent study.
The clause is well intentioned, seeking to protect the rights of data subjects when data about them is being processed in such a way that it will have a direct impact on them. This is laudable. However, for interventional research it is not a workable provision. In all cases of interventional research, data subjects will undergo an informed-consent process and so will be aware of how data about them are being processed for the purposes of the study. All such studies are also subject to approval from the relevant ethics committee, such as those approved by the Health Research Authority. While consent is sought in these cases, it will not necessarily be feasible for this to meet the standards of GDPR consent, as I have already explained.
Clinical trials are a vital part of health research and the life sciences industry. More than 650,000 people in the UK participated in such studies in the past year alone, with over 2,000 studies supported by the National Institute for Health Research. It therefore cannot be understated how important it will be to ensure that such trials have a firm legal footing on which to process personal data.
My amendment would enable interventional research to work around the provisions of Clause 18, while ensuring that robust safeguards are in place. My amendment would permit studies that have been approved by a relevant ethics body to substitute the requirements of Clause 18(2) with ethics committee approval, so that interventional research continues to have access to an appropriate legal issue, through paragraph 4 in Part 1 of Schedule 1.
A legal precedent for requiring ethics committee approval has been set in legislation, in paragraph 4 of Schedule 2 to the Psychoactive Substances Act 2016, which exempts “approved scientific research” from the prohibitions on the use of psychoactive substances set out in the Act, and defines a “relevant ethics review body”. The same definition would, I believe, be suitable for the purposes of this amendment. I beg to move.