One of the most common questions in European research projects today is how to ensure access to research material and research data. Data donation (or data donorship) is mentioned more and more frequently as a possible solution.
Data donation is specifically discussed in the debate about sharing personal data for research purposes, including when donating samples or body tissues to science, thus also implicitly providing access to the related data of the donor. This concept is encroaching on the debate on data ownership and its relation to data protection for the last couple of years.
This blog briefly explains why the concept of donation of personal data, despite its advantages for scientific research in the field, is largely a legal oxymoron.
At the surface, a data donation simply means the permanent transfer of data from one entity to another, in general or for a specified purpose. Transfers are a common practice, due to the necessities of business or a legal obligation. In and of itself, a data transfer is not particularly problematic, unless the data transferred is personal data.
But in civil law, a donation has a very specific meaning: it is the concept of transferring the property of goods without any compensation. It is essentially a gift.
A donation inter vivos is an act by which the donor divests himself now and irrevocably of the thing donated in favour of the one,
who accepts it.
Two main characteristics of a donation, in addition to the lack of a compensation, are thus the notions of (transfer of) ownership and irrevocability.
In the field of health the concept of donation is used for organ or blood donation, or even posthumous donation. But these donations refer to physical objects, for which no concomitant use is possible, and the irrevocability of the transfer is factual.
In general, any data donation scheme should be in compliance with the GDPR. Therefore, it must:
However, the concept of “donation” seems to be problematic on at least three issues related to personal data protection law:
For the sake of completeness, posthumous donations would not be so problematic, as the GDPR does not apply to personal data of deceased persons. Data protection law does not consider them to be natural persons. However, it should be kept in mind that personal data of deceased persons can be regulated at national level. For example, Articles 84 and following of the French Data Protection Act provide that individuals may give specific instructions concerning the processing of their personal data after their death. Moreover, data concerning deceased individuals may contain personal data of living individuals, which are covered by the GDPR.
The notion of “donation” is thus not adequate in the context of data protection law. “Personal data donation” appears to be an oxymoron, at the very least in the sense that it suggests a degree of freedom and flexibility that does not exist under the GDPR: personal data cannot be made “free to use” by donating it.
However, donation is also a well-known concept, in particular in the field of health and science, where organs and blood are often donated. Therefore, the notion of “data donation” could be used to increase awareness on the need to make personal data available for scientific research, and on the terms under which this can be done.
Unconditional donations are not viable, but with a proper framework for scoping consents – defining purposes, consent management, and proportionality – some degree of flexibility can be created. Moreover, the creation of a framework for spontaneous personal data donations, outside of studies and trials, where participants are pre-selected, would ensure the availability of unbiased personal data for scientific research purposes.
Raising awareness through parallelisms with well-known practices would be helpful to foster the access to personal data for scientific research purposes. But this should not be done at the cost of the protection of the fundamental rights of the data subjects. Therefore, the framework of personal data “donation” must be clearly scoped and managed.