Personal health data provide a vital resource for research to save and improve lives, reduce health inequalities and benefit society. Research data should be regarded as a global public good. Sharing of data, including genetic and other health-related data, is an essential part of public sector medical research for improved health care and disease prevention, for example to ensure sufficiently large sample sizes, identify complex pathways, and compare the determinants and outcomes of disease in different settings, thereby making the most of the contribution by patients and volunteers to research. It is important for EU citizens that their data are shared for health research, to ascertain whether research results from elsewhere are relevant to their particular genetic makeup and risk factors.

At the same time, it is essential to provide appropriate protections for personal data privacy. The General Data Protection Regulation (GDPR) addresses the protection of personal data in the European Union (EU) and European Economic Area (EEA) and the international transfer of data to areas outside the region. It has become apparent that the implementation of the GDPR has introduced impediments to this international transfer of data to outside the EU/EEA, creating problems for academic researchers, healthcare professionals and others in the public sector. These problems affect patients and all citizens who are the ultimate beneficiaries of public sector health research.

The present report is produced by an initiative of the European academy networks, ALLEA Summary (the European Federation of Academies of Sciences and Humanities), EASAC (the European Academies’ Science Advisory Council) and FEAM (the Federation of European Academies of Medicine), to reaffirm the vital importance of sharing personal health data for research in the public sector, to explore the issues for international transfer and to offer guidance to resolve the growing problem, while respecting the right to protection of personal data. Commentaries elsewhere on controversies surrounding the transfer of data under the GDPR have usually focused on the private sector and the voice of the public sector researcher has been relatively neglected. This must change.

The transfer of personal data for research outside the EU/EEA is a particular problem. Drawing on the Working Group discussions and other material described in our report, ALLEA, EASAC and FEAM have developed consensus messages that can be summarised as follows.

• Health research is crucial for all: for patient benefit, population health, development of health-care systems, and for social cohesion and stability.

• Sharing pseudonymised personal health data for public sector research is essential: strong pseudonymisation procedures are important to make effective use of limited resources and maximise the value of contributions made to research by patients and volunteers. Long-term structured anonymised health data are also important for further development of new areas of research such as artificial intelligence.

• Data must be shared safely and efficiently, taking account of privacy concerns: this is part of the conduct of responsible science, and addressing these opportunities should be part of wider initiatives to build trust in research and researchers and to take account of patient views.

• Implementation of the GDPR has resulted in impediments to data sharing with researchers outside the EU/EEA: this affects both the direct transfer of data and remote access to data at its original location and secondary uses of the data by foreign institutions, all of which often representing collaborative research with EU researchers. Thus, European researchers and EU citizens benefit from international sharing of data. When other countries do not have equivalent procedures for data protection (adequacy) there is currently no workable mechanism for sharing health data for public sector research. It has been estimated that in 2019 more than 5,000 collaborative projects (projects involving the US National Institutes of Health and EEA countries) were affected1, a solution is urgently needed both for ongoing collaborations as well as for new research.

• There must be increased commitment to finding a solution to overcome the barriers in sharing data: the preferred option is to find a solution under Article 46 of the GDPR with additional operational guidance provided by the European Data Protection Board accompanied by tangible examples to show how to apply the guidance to health research. This is urgent.

• There must also be increased commitment to enabling the use of shareable data: even when appropriate mechanisms for transferring data are established, there are other, methodological and technical quality issues that need resolving to enable interoperability in the use of data. These challenges require greater attention across the research community. Along with data, biological samples must sometimes be shipped to laboratories outside the EEA and temporary solutions (such as sending syntaxes) do not allow for highly specialised analyses—any legal mechanism for sharing data must also allow for analyses of such samples.

• Privacy-enhancing technologies are relevant in offering potential to improve data security but their use does not circumvent the requirements of the GDPR, nor do these technologies solve the problems presented here.

Continuing monitoring and assessment of the issues is imperative because of the fast-changing environment and technology development, other country initiatives on data sharing, the momentum favouring open science and data, the role of big data and artificial intelligence on large data analysis, and new opportunities and needs in health care and disease prevention. We recommend development of an interdisciplinary mechanism for continuing monitoring of these developments, acting also to raise visibility of the opportunities and challenges for personal health data sharing for research. We suggest that academies and their networks might adopt a primary role in catalysing discussion with research institutions and research funders, and in engagement with other stakeholders, particularly patient groups and policy-makers.

There is an indispensable role for the EU to lead global discussion about privacy rules, the value of health research and the free movement of data including options for reforming regulations in other countries for reciprocity in data sharing.

Our messages are addressed to Directorates across the European Commission, particularly those responsible for Justice, Health and Research, the European Data Protection Board, European Data Protection Supervisor, other EU institutions, policy-makers in Member States, and to all those in the scientific, medical and policy communities worldwide who are interested in, and affected by, these issues. We welcome the commitment by the European Commission, following previous inputs from the research community, to develop consistency across the GDPR and facilitation of cross-border sharing of personal data to support health research; but given the large number of ongoing collaborations between European researchers and institutions outside the EU/ EEA on critical health research, we emphasise the urgency in tackling the problems.

During a late stage in our Working Group discussion, the European Data Protection Board (EDPB) and the European Commission published new proposals for certain key issues (in particular the EDPB roadmap, supplementary measures and standard contractual clauses (SCCs)) and these will be discussed subsequently. However, these recent recommendations from the EDPB and the European Commission do not solve the problems for the research community in transferring data outside the EU/EEA, nor are there transfer mechanisms that enable European researchers to place data into large databases that applicants can access. These problems must be solved very soon if European research potential is to be realised and if further research disconnects are to be obviated.

Less global sharing of health data for research is hurting everyone. The immediate challenge is to find a simple solution that is safe and respectful of fundamental rights, including the right to data protection and the right to effective remedy, and one that does not conflict with other countries’ laws or with regulations of international organisations.