Anonymity in EU Health Law: Not an Alternative to Information Governance

• Published in: Medical law review Vol. 28; no. 3; pp. 478 - 501
• Main Author: Mourby, Miranda
• Format: Journal Article
• Language: English
• Published: England Oxford University Press 01.08.2020
• Subjects: Biomedical Research; Clinical Trials as Topic - legislation & jurisprudence; Computer Security - legislation & jurisprudence; Confidentiality; Court of Justice of the European Communities; Data Anonymization - legislation & jurisprudence; Data Anonymization - standards; Data protection; European Union; Guidelines as Topic - standards; Jurisprudence; Medical care; Privacy; Tissue Donors - legislation & jurisprudence; EUROPEAN UNION; Anonymity; Medical research; Cell donors; Confidentiality; Data sharing; Information sharing
• ISSN: 1464-3790; 1464-3790
• DOI: 10.1093/medlaw/fwaa010

Abstract Data sharing has long been a cornerstone of healthcare and research and is only due to become more important with the rise of Big Data analytics and advanced therapies. Cell therapies, for example, rely not only on donated cells but also essentially on donated information to make them traceable. Despite the associated importance of concepts such as ‘donor anonymity’, the concept of anonymisation remains contentious. The Article 29 Working Party’s 2014 guidance on ‘Anonymisation Techniques’ has perhaps helped encourage a perception that anonymity is the result of data modification ‘techniques’, rather than a broader process involving management of information and context. In light of this enduring ambiguity, this article advocates a ‘relative’ understanding of anonymity and supports this interpretation with reference not only to the General Data Protection Regulation but also to European Union health-related legislation, which also alludes to the concept. Anonymity, I suggest, should be understood not as a ‘technique’ which removes the need for information governance but rather as a legal standard of reasonable risk-management, which can only be satisfied by effective data protection. As such, anonymity can be not so much an alternative to data protection as its mirror, requiring similar safeguards to maintain privacy and confidentiality.