Learn how GA4GH helps expand responsible genomic data use to benefit human health.
Learn how GA4GH helps expand responsible genomic data use to benefit human health.
Our Strategic Road Map defines strategies, standards, and policy frameworks to support responsible global use of genomic and related health data.
Discover how a meeting of 50 leaders in genomics and medicine led to an alliance uniting more than 5,000 individuals and organisations to benefit human health.
GA4GH Inc. is a not-for-profit organisation that supports the global GA4GH community.
To guide our collaborative, globe-spanning alliance, GA4GH relies on a Standards Steering Committee and an Executive Committee.
The Funders Forum brings together organisations that offer both financial support and strategic guidance.
The EDI Advisory Group responds to issues raised in the GA4GH community, finding equitable, inclusive ways to build products that benefit diverse groups.
Distributed across four Host Institutions, our staff team supports the mission and operations of GA4GH.
Curious who we are? Meet the people and organisations across six continents who make up GA4GH.
More than 500 organisations connected to genomics — in healthcare, research, patient advocacy, industry, and beyond — have signed onto the mission and vision of GA4GH as Organisational Members.
These core Organisational Members are genomic data initiatives that have committed resources to guide GA4GH work and pilot our products.
This subset of Organisational Members whose networks or infrastructure align with GA4GH priorities has made a long-term commitment to engaging with our community.
Local and national organisations assign experts to spend at least 30% of their time building GA4GH products.
Anyone working in genomics and related fields is invited to participate in our inclusive community by creating and using new products.
Wondering what GA4GH does? Learn how we find and overcome challenges to expanding responsible genomic data use for the benefit of human health.
Study Groups define needs. Participants survey the landscape of the genomics and health community and determine whether GA4GH can help.
Work Streams create products. Community members join together to develop technical standards, policy frameworks, and policy tools that overcome hurdles to international genomic data use.
GIF solves problems. Organisations in the forum pilot GA4GH products in real-world situations. Along the way, they troubleshoot products, suggest updates, and flag additional needs.
NIF finds challenges and opportunities in genomics at a global scale. National programmes meet to share best practices, avoid incompatabilities, and help translate genomics into benefits for human health.
Communities of Interest find challenges and opportunities in areas such as rare disease, cancer, and infectious disease. Participants pinpoint real-world problems that would benefit from broad data use.
See all our products — always free and open-source. Do you work on cloud genomics, data discovery, user access, data security or regulatory policy and ethics? Need to represent genomic, phenotypic, or clinical data? We’ve got a solution for you.
All GA4GH standards, frameworks, and tools follow the Product Development and Approval Process before being officially adopted.
Learn how other organisations have implemented GA4GH products to solve real-world problems.
Help us transform the future of genomic data use! See how GA4GH can benefit you — whether you’re using our products, writing our standards, subscribing to a newsletter, or more.
Help create new global standards and frameworks for responsible genomic data use.
Align your organisation with the GA4GH mission and vision.
Solve your real-world data problems with support from this valuable network of global institutions.
Work with like-minded groups committed to better data use in areas like rare disease, cancer, and infectious disease.
Share your thoughts on all GA4GH products currently open for public comment.
Solve real problems by aligning your organisation with the world’s genomics standards. We offer software dvelopers both customisable and out-of-the-box solutions to help you get started.
Learn more about upcoming GA4GH events. See reports and recordings from our past events.
Speak directly to the global genomics and health community while supporting GA4GH strategy.
Be the first to hear about the latest GA4GH products, upcoming meetings, new initiatives, and more.
Questions? We would love to hear from you.
Read news, stories, and insights from the forefront of genomic and clinical data use.
Attend an upcoming GA4GH event, or view meeting reports from past events.
See new projects, updates, and calls for support from the Work Streams.
Read academic papers coauthored by GA4GH contributors.
Listen to our podcast OmicsXchange, featuring discussions from leaders in the world of genomics, health, and data sharing.
Check out our videos, then subscribe to our YouTube channel for more content.
View the latest GA4GH updates, Genomics and Health News, Implementation Notes, GDPR Briefs, and more.
Discover all things GA4GH: explore our news, events, videos, podcasts, announcements, publications, and newsletters.
17 May 2021
Multi-dataset, secondary processing of already gathered data is crucial for genomic and health research. However, data protection practice creates barriers to this work. Two parallel lines require solution: issues around “legal basis”, “processing” and “purpose”; the duty to inform the data subject.
Multi-dataset, secondary (further) processing of already gathered data (“secondary processing”) is crucial for genomic and health research. However, data protection practice creates barriers to this work. This note suggests a way of thinking about this in practice, and conceptual steps that an Article 40 Code of Conduct (a Code) (at least) needs to resolve to remove the barriers. (See also Dove, 2019) Two parallel lines require solution: issues around “legal basis”, “processing” and “purpose”; the duty to inform the data subject.
Line 1: “Legal basis”, “processing” and “purpose” in secondary processing
This line is clarified by understanding three key steps in secondary processing:
Step 1: Is this new processing just part of the primary processing?
Secondary processing combines (often already gathered) datasets. These must be processed under at least one legal basis under Article 6 (and, for special data, Article 9), and for a disclosed purpose or purposes. The first question is: is the new unforeseen processing actually within the terms of the primary processing? So, in practice, much depends on how information and terms given to data subjects were drafted; the new, unforeseen processing could be squarely within the already described purposes and legal basis. A Code could provide best practice.
Step 2: Is it ‘compatible’ processing?
If the primary processing legal basis and purpose(s) do not specifically cover the secondary processing, is the secondary processing and purpose “compatible” with the original processing and purpose? Under the GDPR: 1) compatibility includes processing or purpose (Article 5.1.b); and, 2) there is a (rebuttable) presumption that processing for research purposes is compatible with other purposes (Recital 50) (and research is understood to include applied research, see Recital 159). Therefore, unless the proposed research is de facto incompatible with the original purpose, research processing should be compatible. Article 6(4) indicates considerations to take into account in assessing compatibility. The Code should further clarify these considerations.
Step 3: When steps 1 and 2 fail, is it a new processing?
This is the most difficult step. “Purpose limitation” is strong: “and not further processed” (Article 5.1.b) seems conclusive that if Steps 1 and 2 (above) fail, secondary processing is not possible. However, Recital 50 gives exceptions: “Where the data subject has given consent or the processing is based on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important objectives of general public interest, the controller should be allowed to further process the personal data irrespective of the compatibility of the purposes.” Article 23.1.e operationalises this (requiring Union or Member State Law). And this is where a Code (through Union Law) must seek a harmonising position that data sharing in genomics and health research fall within these exceptions.
Line 2: Around Information Requirements
Information Provision cannot destroy data sharing
Data subjects must be informed of processing of data relating to them. Where it is gathered directly, Article 13 applies: data subjects must be informed. Where data are gathered indirectly, Article 14 applies: data subjects must be informed unless it is impossible to do so or would require a disproportionate effort. If data in secondary processing situations have been gathered directly from the data subject; under Article 13.3 those data subjects must be informed of any secondary processing (regardless of impossibility or proportionality).
Article 13.3 is potentially devastating. “Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.” The effect of this is potentially that only situations where the data subjects can be informed directly of the processing can proceed; this seems close to insisting on a legal basis of informed consent. However, secondary processing is allowed for compatible purposes where any of the Article 6 (and 9) legal bases are used; Article 23.1.e and Recital 50 allow a lifting of the purpose limitation in the public interest. Is this really overruled by the effect of Article 13.3? A Code must address this inconsistency.
Secondary processing of already-gathered data is essential to realise the publicly desired goods of genomic and health research. A Code must be created to resolve the difficulties indicated here, and to re-negotiate an EU-wide harmonisation for data sharing in this sector.
Relevant GDPR Provisions
David Townend is Professor of Health and Life Sciences Jurisprudence at CAPHRI (Care And Public Health Research Institute) at Maastricht University.
Birgit Wouters is Scientific Researcher at Maastricht University Institute of Data Science.
Nina Stahl is a Researcher at the Faculty of Health, Medicine and Life Sciences at Maastricht University.
For a list of previous briefs, please consult here.
Please note that GDPR Briefs neither constitute nor should be relied upon as legal advice. Briefs represent a consensus position among Forum Members regarding the current understanding of the GDPR and its implications for genomic and health-related research. As such, they are no substitute for legal advice from a licensed practitioner in your jurisdiction.