A new judgment from the Court of Justice of the European Union has profound and wide-ranging implications for the international transfer of genomic data.
The sharing of genomic data is essential to unlock the benefits of genomics for research and healthcare. Assembling and sharing data from large, international studies offers particular value for general research into genomics, health and disease, from detailed study of the genetic factors driving different forms of cancer, to understanding how genetics may influence the risk of common diseases or why people react differently to infectious diseases, such as COVID-19. It also allows health professionals around the world to identify and share learning about new and extremely rare genetic conditions that may affect only a handful of people in the world.
However, the sharing of personal data is subject to legal controls, and the EU General Data Protection Regulation (GDPR) impacts the sharing of genomic data when it counts as personal data because it relates to an identified individual. Where genomic data constitutes personal data, lawful ‘processing’ requires a legal basis and may also need other legal mechanisms.
Individuals and institutions wishing to participate in international sharing of genomic data therefore need to be aware of their legal duties – and the new Schrems II judgment has resulted in important changes for data sharing between the European Economic Area (EEA) and third countries.
International data transfers between EU and the US are made much more difficult, with immediate effect, and transfers between EU and the UK will be similarly affected after the end of the Brexit implementation period, ending in less than six months.
A new discussion paper from the PHG Foundation outlines the legal implications of Schrems II and what these mean for genomic data controllers.