The European data protection legislation and its consequences for public health monitoring: a plea for action*

T he Network of Competent Authorities (NCA) is one of the implementing structures of the Health Information and Knowledge Strand of the EU Public Health Programme 2003– 08. 1 The NCA became aware of problems in the field of European public health monitoring related to data protection legislation, and established in 2005, on a voluntary basis, a Work Group on Data Protection, consisting of six members of the NCA with a specific interest in the topic, and two staff members from the NCA's Scientific Assistance Office. 2 The Work Group carried out an explorative survey among researchers in the European public health field, experts on health data protection and the national Data Protection Offices. This exercise resulted in a (non-exhaustive) overview of problems encountered in public health monitoring, and of major differences between national data protection systems regarding possibilities for using person identifiable health data for public health purposes. The major conclusions that can be drawn from this overview is that the legal possibilities for such usage differ to great extents between the Member States, and that this diversity can be traced back to the improper transposition of the EU Directive on Data Protection (Directive 95/46/EC). 3 EU directives are addressed to the Member States, who are obliged to transpose the directive into national law. By now, all Member States indeed have transposed Directive 95/46/EC, 4 though, as the results of the inventory of the Work Group showed, not in a harmonized way; for instance, Article 8 on the processing of sensitive data (e.g. health data), has not been fully transposed by all Member States. This has resulted in the absence of certain legal grounds for personal health data processing in the concerned Member States, which should be present according to EU law. Moreover, diverging opinions on how to interpret the Directive and national data protection laws appeared to be another cause of the differences found. 5 In public health practice, the main problems arising due to the legislative framework sketched above, are the inability to link different databases at the subject level, and the need to obtain explicit informed consent for each processing of person identifiable health data. Not being able to link different data sources poses a threat to data quality, as double counting of events cannot be prevented, and as people who have died or emigrated cannot be identified. Moreover, enabling linkage will help governments in developing …