GDPR and scientific research in the UK: what are the new government's plans?

The King's Speech yesterday (which, for readers not in the UK, sets out the government's legislative plans) promises that the new Digital Information and Smart Data Bill will “help our scientists make better use of data for world-class research by reflecting the realities of modern interdisciplinary science research in our data laws. Scientists will be able to ask for broad consent for areas of scientific research, and allow legitimate researchers doing scientific research in commercial settings to make equal use of our data regime.”

All governments say they are in favour of innovation and research.  We shall have to wait for the draft bill to see if the proposals on scientific research are genuinely helpful.  At the moment it sounds as if the provisions may be a cut and paste from the previous government's Data Protection and Digital Information Bill, which would be a disappointment.   

The promise of broad consent may sound useful to the lay person but in the UK most researchers try to avoid relying on consent as their lawful basis for processing.   Indeed the Health Research Authority's guidance on “Consent in research” expressly says that “for the purposes of the GDPR, the legal basis for processing data for health and social care research should NOT be consent.”   The key reasons for this are concerns about the imbalance of power, and the ability of data subjects to withdraw their consent at any time, which can undermine the validity of the research.  Allowing scientists to collect a broad consent won’t change this.  It also won’t help for projects seeking to rely on pre-existing data sets, which is frequently the case for AI-based research projects due to the volume of data they require.

The reference to commercial researchers also doesn’t hold up well to scrutiny.  The lawful basis of processing for the purposes of scientific research is already available to researchers in commercial settings in the UK.  The difficulty they face is understanding which projects qualify as scientific research since the GDPR doesn't define it.  The previous government promised to clarify this.   However saying that references to processing of personal data for the purposes of scientific research mean processing for the purposes of "any research that can reasonably be described as scientific“ wasn’t much of a clarification.  So it is to be hoped that the new Bill doesn’t just re-produce this drafting.

By happy coincidence our latest Legitimately Interesting podcast, which went live this week, looks at how GDPR approaches scientific research and some of the challenges it presents.  If you’re interested, you can find it here.