Using EHRs to design drug repositioning trials: A devolved approach to data protection

One area where the application of data protection law has proven complex is in relation to the secondary usage of health data in EHRs for medical research. Here the tension between the privacy interests of patients and the risk of harm if such sensitive data are compromised, and on the other side, the potential societal value of utilizing the data for the benefit of medical science, is especially striking. In this paper, we consider the applicable provisions of the EU Data Protection Directive, and outline a general approach to patient data handling for research, which we believe to be compatible with relevant legal and ethical requirements. We then illustrate and apply this by reference to a specific EU FP7 project, involving EHR data processing to select patients for clinical pharmaceutical trials. After introducing the project (PONTE), we explain the ‘devolved’ data protection architecture it employs and provide a legal evaluation.