What are the emerging trends in Data Privacy for Life Sciences?

Privacy concerns in the Life Sciences sector are influenced by the highly sensitive nature of the data involved. The processing of these data is subjected to a stringent regime. In the case of the European General Data Protection Regulation (GDPR), the processing is prohibited unless it falls into one of the exceptions listed in Article 9. The GDPR points out the significant risks to the fundamental rights and freedoms of individuals, including the possibility of discrimination, as rationale for this approach. In this context, it appears crucial that companies keep abreast of technological and regulatory developments to ensure compliance with data protection requirements.

The COVID-19 pandemic accelerated the transition of clinical research to a more decentralized model. To adapt to the exceptional circumstances derived from the sanitary emergency, numerous countries permitted remote monitoring in clinical trials. Furthermore, there is a widespread use of mobile applications, wearables, and all types of devices to facilitate remote patient monitoring and collection of data. While very promising, this digital and interconnected environment increases the challenges faced in terms of security and guarantee of data subjects’ fundamental rights to data protection and privacy as stated in the Charter of Fundamental Rights of the European Union (EU).

Several regulatory instruments are expected to affect privacy during the AI and digitalization era of the life sciences sector. In addition, the broad geographical extent of clinical trials and national data protection and privacy laws add complexity to the regulatory patchwork.

The EU has proposed what would constitute the first regulation on AI: the AI Act. The goal of the act is to ensure that the development of innovative AI-based technologies can continue while protecting people’s rights. Under the proposed legislation, the risks of AI technologies are classified from minimal to unacceptable. Importantly, AI systems in healthcare areas may be classified as high-risk and would be strictly regulated. For the development and assessment of high-risk AI systems, actors need to access and use high quality datasets. Moreover, the risks that AI might trigger individuals’ privacy should be considered seriously, as AI may reveal personal information about an individual. Therefore, the GDPR is one of the pillars for the AI legislation. The AI Act, together with the GDPR, aim to provide trustful, accountable and non-discriminatory access to high quality data for the training, validation and testing of AI systems, while protecting individual’s privacy.
The proposal is currently in trilogue meetings, targeted to be approved in the next months. In the meantime, the European Data Protection Board is following closely the development of the negotiations, with the purpose of ensuring compatibility with the GDPR.

Additionally, the EU proposed the Data Governance Act, which has recently entered into force. This act aims to increase trust in data sharing, optimize mechanisms to render data available and overcome technical obstacles in data sharing.

While we wait for the approval of the American Data Privacy and Protection Act (ADPPA), several US states are working on their own comprehensive privacy laws. New state laws have entered into force this year (California Privacy Rights Act (amending the CCPA), Colorado Privacy Act, Connecticut Personal Data Privacy and Online Monitoring Act, and Virginia Consumer Data Protection Act), while others are expected to be approved or effective in the short term. Additionally, some states have adopted a sectoral approach, with the most significant example being Washington’s My Health My Data Act. It is also worth noticing the prominent role that the FTC has taken with regards to health data. Additionally, the FTC has started enforcing the Health breach Notification Rule, which is applicable to non-HIPPA covered entities. Furthermore, the recently proposed amendment to this rule clarifies that many health applications are within its scope.

The healthcare sector, and hospitals in particular, are the main target for cyberattacks. Such is the case of the ransomware attack on the Hospital Clinic de Barcelona earlier this year. As a result of this incident, thousands of appointments had to be rescheduled as it was impossible to use the systems or access clinical records, and highly sensitive data of patients and staff was leaked on the deep web.

These types of attacks often lead to disruption of operations, regulatory fines, and reputational damage. According to the latest IBM Data Breach Report, data breaches are more costly in health than in any other sector, reaching an average 10.93 million dollars in 2023.

In conclusion, while new technologies present numerous opportunities for the life sciences sector, the risks associated to data subjects are no less significant. In a complex ecosystem with numerous actors involved, increased digitalization, connectivity, and escalating security threats, it is crucial for companies to implement a data protection policy that ensures compliance with the complex and changing regulatory environment.