The challenges of sharing data in the EU
Bigpicture’s ambition is to accelerate computational pathology by creating a repository of 3 million whole slide images that can be used by AI researchers and the creation of algorithms. One of the crucial aspects of realizing this, is the collection and sharing of data. But how do we get from 0 to 3 million slides in the tricky landscape of European and national regulations on data sharing? Bigpicture recently published a unique report that maps the legal frameworks, and identifies crucial regulations applicable to the initial data submitters of the EU countries involved in Bigpicture.
We spoke to Magdalena Kogut-Czarkowska, Attorney at TimeLex; a law firm that specializes in the legal aspects of information technology, privacy and data protection (GDPR), about the outcomes of the report. Timelex is involved in Bigpicture’s work package 3 and 5, and in various task forces, such as the GDPR Task Force – basically anywhere where legal input is necessary. The report (D5.01) is one of the deliverables of work package 5. Magdalena: “We want to be in a dialogue with the slide contributors about data sharing, and want to help them provide data in the easiest way possible, while staying in compliance with the law. The report lays a foundation for this.”
The fragmented landscape of EU and national legislation
As we all know, the ground rules for privacy and data sharing are set by the GDPR. And although the GDPR applies to every form of personal data, the Bigpicture platform comes with some additional challenges. Besides European legislation, there are also national laws that regulate use of medical data. Magdalena: “It’s a fragmented framework, as it’s not just the GDPR. We really needed to drill down to national legislations and practices.”
At the start of the research, Magdalena and her team looked at common European laws and spoke to some data providers throughout the EU, but quickly learned that they also had to reach out to national law experts. “We discovered that there are many differences in national laws using medical data for research between EU-based countries. For example, there are different rules across countries in what conditions need to be fulfilled before hospitals can re-use patient records. And on top of that, Bigpicture needs not only the WSIs, but also the metadata – additional info about the specific slide and the patient from which it was obtained. In many cases, this information comes from multiple databases. The question is what kind of rules a data provider needs to meet in order to take the data out of the hospital system and upload it into the Bigpicture repository. In some countries consent from the patient is required, while others allow use of data for research without such consent. There is also the question whether data should be pseudonymized or anonymized. And the path to obtaining approval from ethical committees can differ per hospital too.”
Paving the legal path for data sharing
The D5.01 report has two main objectives. Firstly, it will help slide contributors in the struggle to understand what is needed from them and what process they must follow (on a national level) to contribute to Bigpicture’s repository.
Secondly, the report helps us to understand the difficulties an constrains which will influence the design of the platform itself in terms of necessary functionalities that can accommodate the slide contributors.
Providing guidance to contributors
All the research that is done by work package 5, including the findings of the D5.01 report, already can serve as a guide for slide contributing parties. Magdalena: “The summary of requirements for data contributors which are included in the report can be viewed as a high level checklist. All differences aside, we have common themes and regulations we all need to follow, which should be translated into terms and conditions for the platform. We want to be certain that as many contributors as possible will be able to use the platform, so the project needs to be transparent and clear on how it will work and how the data will be used.”
What’s next?
In the report, the rules for 7 countries have been mapped, yet this is still done on a high level which doesn’t always reflect what local rules the data contributors must follow. The next step would be to continue the dialogue with contributors and discuss how in practice they approach the process of contributing slides. Magdalena: “There are still a lot of mapping to be done. Some contributors have more defined processes for identifying data than others. Some may not only use their own medical data, but need to combine it with other databases. We are keen to finding out more on the legal constrains contributors may face and discuss how to tackle them. And to look even further ahead, we also want to find out how to build the process of obtaining permission for AI providers to reuse the data. Data is not just stored in the Bigpicture repository, but also needs to become available for others to do research. What control measures do contributors require Bigpicture to put in place to allow researches to use the data?”
Coming up: European Health Data Space
The way medical data can be reused for research purposes is regulated per country. In May this year, the EU Commission proposed a regulation on European data governance, the European Health Data Space, that aims to harmonize the rules on secondary data usage throughout Europe. Magdalena: “If the new proposal is adopted, the rules of secondary data use will be clearer. In turn, it may be easier to find an approach of data sharing suitable for many of Bigpicture’s slide contributors.”
Read more on the EU commissions’ proposal here.