Personal data donation: a legal oxymoron beneficial to science?

One of the most common questions in European research projects today is how to ensure access to research material and research data. Data donation (or data donorship) is mentioned more and more frequently as a possible solution.

Data donation is specifically discussed in the debate about sharing personal data for research purposes, including when donating samples or body tissues to science, thus also implicitly providing access to the related data of the donor. This concept is encroaching on the debate on data ownership and its relation to data protection for the last couple of years.

This blog briefly explains why the concept of donation of personal data, despite its advantages for scientific research in the field, is largely a legal oxymoron. 

What is a “data donation”?

At the surface, a data donation simply means the permanent transfer of data from one entity to another, in general or for a specified purpose. Transfers are a common practice, due to the necessities of business or a legal obligation. In and of itself, a data transfer is not particularly problematic, unless the data transferred is personal data. 

But in civil law, a donation has a very specific meaning: it is the concept of transferring the property of goods without any compensation. It is essentially a gift.

A donation inter vivos is an act by which the donor divests himself now and irrevocably of the thing donated in favour of the one,
who accepts it.

Two main characteristics of a donation, in addition to the lack of a compensation, are thus the notions of (transfer of) ownership and irrevocability.

In the field of health the concept of donation is used for organ or blood donation, or even posthumous donation. But these donations refer to physical objects, for which no concomitant use is possible, and the irrevocability of the transfer is factual. 

Why is “donating” personal data a problematic legal concept?

In general, any data donation scheme should be in compliance with the GDPR. Therefore, it must:

1. be lawful, fair and transparent, and
2. respect the principles of data limitation (e.g. the data may be processed only for the purposes for which it was donated), data minimisation, accuracy, storage limitation (without prejudice to national legislation and the exception for scientific research as set forth in the GDPR), integrity and confidentiality.

However, the concept of “donation” seems to be problematic on at least three issues related to personal data protection law:

• First, the transfer of ownership, one of the main characteristics of a donation, is incompatible with the legal protection of personal data, as it is doubtful whether or not one actually “owns” a set of personal data. It is thus unlikely that such data are alienable under EU law. The reason for this is that personal data are protected as a fundamental right (a human right) by Article 8 of the European Convention on Human Rights (on privacy), as well as Articles 7 and 8 of the EU Charter of Fundamental Rights (on the respect for private and family life and on the protection of personal data, respectively). A fundamental right is inalienable; one cannot “sell” personal data, no more than someone could “sell” body parts or their right to physical integrity. 

• Second, irrevocability, another main characteristic of a donation, is also incompatible with the legal protection of personal data. Indeed, pursuant to Article 7.3 of the GDPR, consent, which can be the only basis for a donation, can be withdrawn. This would make any donation (which is inherently voluntary and based on consent) easily withdrawable. 

• Third, a donation of personal data is conceptually interesting because it grants access to data for an indefinite number of situations, and not only for one or few instances. However, as the GDPR requires that consent be given for a specific purpose, this calls the validity of a consent in the context of data donation into question. Simply put, under the GDPR a donation could only be done conditionally since it must be linked to a specific purpose; an unconditional consent allowing processing for any purposes is not compatible with the GDPR. Moreover, the validity of consent is conditioned by the information provided to the data subjects as well as their degree of understanding of the information provided. Thus, consent cannot be considered valid if the data subject does not fully understand what he or she is consenting to. Therefore, data subjects cannot be adequately informed about research projects that have yet to be conceived, and consent to merely process data “for scientific purposes” is usually considered to be too generic and vague to satisfy the requirements of the GDPR.

For the sake of completeness, posthumous donations would not be so problematic, as the GDPR does not apply to personal data of deceased persons. Data protection law does not consider them to be natural persons. However, it should be kept in mind that personal data of deceased persons can be regulated at national level. For example, Articles 84 and following of the French Data Protection Act provide that individuals may give specific instructions concerning the processing of their personal data after their death. Moreover, data concerning deceased individuals may contain personal data of living individuals, which are covered by the GDPR.

Why choose the wrong terminology?

The notion of “donation” is thus not adequate in the context of data protection law. “Personal data donation” appears to be an oxymoron, at the very least in the sense that it suggests a degree of freedom and flexibility that does not exist under the GDPR: personal data cannot be made “free to use” by donating it. 

However, donation is also a well-known concept, in particular in the field of health and science, where organs and blood are often donated. Therefore, the notion of “data donation” could be used to increase awareness on the need to make personal data available for scientific research, and on the terms under which this can be done.

Unconditional donations are not viable, but with a proper framework for scoping consents – defining purposes, consent management, and proportionality – some degree of flexibility can be created. Moreover, the creation of a framework for spontaneous personal data donations, outside of studies and trials, where participants are pre-selected, would ensure the availability of unbiased personal data for scientific research purposes.

Raising awareness through parallelisms with well-known practices would be helpful to foster the access to personal data for scientific research purposes. But this should not be done at the cost of the protection of the fundamental rights of the data subjects. Therefore, the framework of personal data “donation” must be clearly scoped and managed.