GDPR and health data (Regulation (EU) 2016/679)

European Union, regulation, also retained in UK law. The General Data Protection Regulation (EU) 2016/679 of 27 April 2016 applied from 25 May 2018, replacing Directive 95/46/EC. Primary text: EUR-Lex.

What it means for cancer research and care: health data, genetic data and biometric data are 'special categories' under Article 9 that may be processed only on a listed basis, such as explicit consent, healthcare provision or scientific research in the public interest with safeguards (Article 9(2)(j) and Article 89). Pseudonymised data remain personal data. Controllers must document purposes, run impact assessments for high-risk processing such as genomic databases, and honour access, rectification and (with research exceptions) erasure rights. Transfers outside the European Economic Area need adequacy or contractual safeguards, and the Court of Justice's Schrems II judgment of 2020 complicated the flow of trial data to US sponsors.

The arguments: the regulation gave individuals real rights and a single rulebook, but its research provisions leave much to national law, so a pan-European registry study can face 27 interpretations of consent and anonymisation, and US institutions have refused to sign EU data-transfer clauses. The European Health Data Space Regulation of 2025 is the attempt to build a common route for secondary use on top of the GDPR. The comparison with the US model, where HIPAA regulates holders rather than data, is the standard framing in the literature.