Exchange of Human Data Across International Boundaries

Literature Cited

1. 1.

   ALLEA (Eur. Fed. Acad. Sci. Humanit.), EASAC (Eur. Acad. Sci. Advis. Counc.), FEAM (Fed. Eur. Acad. Med.) 2021. International sharing of personal health data for research Tech. Rep. ALLEA, EASAC, FEAM Brussels/Berlin: https://easac.eu/fileadmin/PDF_s/reports_statements/Health_Data/International_Health_Data_Transfer_2021_web.pdf
   [Google Scholar]
2. 2.

   The Orphan Drug Act of 1983. 21 U.S.C. Ch. 9 § 301 et seq .
3. 3.

   Eur. Parliam., Eur. Counc 2000. Regulation (EC) no. 141/2000 of the European Parliament and of the Council of 16 December 1999 on orphan medicinal products. Off. J. L 18/1
   [Google Scholar]
4. 4.

   Eur. Counc 2009. Council recommendation of 8 June 2009 on an action in the field of rare diseases. Off. J. C 151/7
   [Google Scholar]
5. 5.

   Perkins BA, Caskey CT, Brar P, Dec E, Karow DS et al. 2018. Precision medicine screening using whole-genome sequencing and advanced imaging to identify disease risk in adults. PNAS 115:143686–91
   [Google Scholar]
6. 6.

   Njølstad PR, Andreassen OA, Brunak S, Børglum AD, Dillner J et al. 2019. Roadmap for a precision-medicine initiative in the Nordic region. Nat. Genet. 51:924–30
   [Google Scholar]
7. 7.

   Zhang Y, Qi G, Park JH, Chatterjee N. 2018. Estimation of complex effect-size distributions using summary-level statistics from genome-wide association studies across 32 complex traits. Nat. Genet. 50:1318–26
   [Google Scholar]
8. 8.

   Ursin G, Stenbeck M, Chang-Claude J, Gunter M, Kaaks R et al. 2019. Data must be shared—also with scientists outside of Europe. Lancet 394:102121902–3
   [Google Scholar]
9. 9.

   R. Soc 2019. Protecting privacy in practice: the current use, development and limits of privacy enhancing technologies in data analysis Tech. Rep., R. Soc. London: https://royalsociety.org/-/media/policy/projects/privacy-enhancing-technologies/privacy-enhancing-technologies-report.pdf
   [Google Scholar]
10. 10.

    Eur. Parliam., Eur. Counc 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Off. J. L 119/1
    [Google Scholar]
11. 11.

    Eur. Parliam., Eur. Counc., Eur. Comm 2012. Charter of fundamental rights of the European Union. Off. J. C 326/02
    [Google Scholar]
12. 12.

    EU Memb. States 2012. Consolidated version of the treaty on the functioning of the European Union. Off. J. C 326/47
    [Google Scholar]
13. 13.

    Bentzen HB, Høstmælingen N. 2019. Balancing protection and free movement of personal data: the new European Union General Data Protection Regulation. Ann. Intern. Med. 170:5335–37
    [Google Scholar]
14. 14.

    Bentzen HB 2020. In the name of scientific advancement: how to assess what constitutes ‘scientific research’ in the GDPR to protect data subjects and democracy. Disinformation and Digital Media as a Challenge for Democracy G Terzis, D Kloza, E Kużelewska, D Trottier 341–66 Cambridge, UK: Intersentia
    [Google Scholar]
15. 15.

    Counc. Eur 1981. Convention for the protection of individuals with regard to automatic processing of personal data Conv. 108 Counc. Eur. Strasbourg, France:
    [Google Scholar]
16. 16.

    Counc. Eur 2018. Convention for the protection of individuals with regard to the processing of personal data Conv. 108+ Counc. Eur. Helsingør, Denmark:
    [Google Scholar]
17. 17.

    Counc. Eur 2022. Chart of signatures and ratifications of Treaty 223: protocol amending the convention for the protection of individuals with regard to automatic processing of personal data Web Resour. Counc. Eur. Strasbourg, France: accessed April 12. https://www.coe.int/en/web/conventions/full-list?module=signatures-by-treaty&treatynum=223
    [Google Scholar]
18. 18.

    Altman RB, Levitt M. 2018. What is biomedical data science and do we need an annual review of it?. Annu. Rev. Biomed. Data Sci. 1:i–iii
    [Google Scholar]
19. 19.

    Bak MAR, Ploem MC, Ateşyürek H, Blom MT, Tan HL, Willems DL. 2020. Stakeholders’ perspectives on the post-mortem use of genetic and health-related data for research: a systematic review. Eur. J. Hum. Genet. 28:403–16
    [Google Scholar]
20. 20.

    Parliam. Den 2018. Lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninger (databeskyttelsesloven) [Act on supplementary provisions to the regulation on the protection of individuals with regard to the processing of personal data and on the free exchange of such data (data protection act)]. Lov nr 502 af 23/05/2018. https://www.retsinformation.dk/Forms/R0710.aspx?id=201319
    [Google Scholar]
21. 21.

    State Assem. Estonia 2018. Isikuandmete kaitse seadus [Personal data protection act]. https://www.riigiteataja.ee/akt/104012019011
    [Google Scholar]
22. 22.

    Artic. 29 Data Protect. Work. Party 2007. Opinion 4/2007 on the concept of personal data Work. Pap. 136, Artic. 29 Data Protect Work. Party Brussels:
    [Google Scholar]
23. 23.

    EDPB (Eur. Data Protect. Board) 2021. Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data: version 2.0 Regul. Recommend., EDPB Brussels:
    [Google Scholar]
24. 24.

    EDPB (Eur. Data Protect. Board) 2021. Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Regul. Guidel., EDPB Brussels:
    [Google Scholar]
25. 25.

    Kuner C 2020. Transfers of personal data to third countries or international organisations (Articles 44–50). The EU General Data Protection Regulation (GDPR): A Commentary C Kuner, LA Bygrave, C Docksey 153–209 Oxford: Oxford Univ. Press
    [Google Scholar]
26. 26.

    EC (Eur. Comm.) 2021. Adequacy decisions Web Resour. Eur. Comm. Brussels: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
    [Google Scholar]
27. 27.

    EC (Eur. Comm.) 2002. Commission decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act. Off. J. L 2/13
    [Google Scholar]
28. 28.

    Smith ID, Villiers T, Freeman G. 2021. Taskforce on innovation, growth and regulatory reform Tech. Rep. Taskforce Innov. Growth Regul. Reform London: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/994125/FINAL_TIGRR_REPORT__1_.pdf
    [Google Scholar]
29. 29.

    EDPB (Eur. Data Protect. Board) 2021. Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom Regul. Decis., EDPB Brussels:
    [Google Scholar]
30. 30.

    Eur. Parliam 2021. Resolution of 21 May 2021 on the adequate protection of personal data by the United Kingdom (2021/2594(RSP)). Off. J. C 15/218
    [Google Scholar]
31. 31.

    Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems Case C-311/18, ECLI:EU:C:2020:559
    [Google Scholar]
32. 32.

    Google 2021. United States national security requests for user information Transpar. Rep. Google Mountain View, CA: accessed April 2022. https://transparencyreport.google.com/user-data/us-national-security?hl=en
    [Google Scholar]
33. 33.

    Microsoft 2021. US national security orders report Transpar. Rep. Microsoft Redmond, WA: accessed April 2022. https://www.microsoft.com/en-us/corporate-responsibility/us-national-security-orders-report?activetab=pivot_1%3aprimaryr2
    [Google Scholar]
34. 34.

    Newsbeezer 2021. France confirms its Health Data Hub will leave Microsoft's servers. Newsbeezer May 18. https://newsbeezer.com/franceeng/france-confirms-its-health-data-hub-will-leave-microsofts-servers/
    [Google Scholar]
35. 35.

    Dir. e-helse 2021. Setter arbeidet med Helseanalyseplattformen på pause. Press Release Dec. 15 Dir. e-helse, Oslo: https://www.ehelse.no/aktuelt/setter-arbeidet-med-helseanalyseplattformen-pa-pause
    [Google Scholar]
36. 36.

    EDPB (Eur. Data Protect. Board) 2021. Letter to ENISA regarding the European Cybersecurity Certification Scheme for Cloud Services (EUCS) Regul. Letter, EDPB Brussels: https://edpb.europa.eu/system/files/2021-11/edpb_letter_to_enisa_out2021-00157.pdf
    [Google Scholar]
37. 37.

    Eur. Parliam 2021. Resolution of 20 May 2021 on the ruling of the CJEU of 16 July 2020—Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (‘Schrems II’), Case C-311/18 (2020/2789(RSP)). Off. J. C 15/176
    [Google Scholar]
38. 38.

    White House 2022. United States and European Commission announce Trans-Atlantic Data Privacy Framework Press Release, Mar. 22 White House Washington, DC:
    [Google Scholar]
39. 39.

    EC (Eur. Comm.) 2022. European Commission and United States joint statement on Trans-Atlantic Data Privacy Framework Press Release, Mar. 25 Eur. Comm. Brussels:
    [Google Scholar]
40. 40.

    EC (Eur. Comm.) 2022. Trans-Atlantic Data Privacy Framework Fact Sheet, Eur. Comm. Brussels: https://ec.europa.eu/commission/presscorner/detail/en/FS_22_2100
    [Google Scholar]
41. 41.

    EDPB (Eur. Data Protect. Board) 2022. Statement 01/2022 on the announcement of an agreement in principle on a new Trans-Atlantic Data Privacy Framework Press Statement Apr. 6, EDPB Brussels:
    [Google Scholar]
42. 42.

    noyb 2022.. “ Privacy Shield 2.0?” First reaction by Max Schrems Press Statement Mar. 25, noyb Vienna: https://noyb.eu/en/privacy-shield-20-first-reaction-max-schrems
    [Google Scholar]
43. 43.

    EDPB (Eur. Data Protect. Board) 2021. EDPB work programme 2021/2022 Work Program, EDPB Brussels: https://edpb.europa.eu/system/files/2021-03/edpb_workprogramme_2021-2022_en.pdf
    [Google Scholar]
44. 44.

    Rabesandratana T. 2019. European data law is impeding studies on diabetes and Alzheimer's, researchers warn. Science Nov. 20. https://www.science.org/content/article/european-data-law-impeding-studies-diabetes-and-alzheimer-s-researchers-warn
    [Google Scholar]
45. 45.

    Eiss R. 2020. Confusion over Europe's data-protection law is stalling scientific progress. Nature 584:498
    [Google Scholar]
46. 46.

    Bentzen HB, Castro R, Fears R, Griffin G, ter Meulen V, Ursin G. 2021. Remove obstacles to sharing health data with researchers outside of the European Union. Nat. Med. 27:1329–33
    [Google Scholar]
47. 47.

    U.N. Secr 2020. Comments of the United Nations Secretariat on behalf of the United Nations System Organizations on the “Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies” adopted by the European Data Protection Board on 18 January 2020 Public Comment., May 14 U.N. Secr. New York: https://edpb.europa.eu/sites/edpb/files/webform/public_consultation_reply/2020.05.14_letter_to_edpb_chair_with_un_comments_on_guidelines_2-2020.pdf
    [Google Scholar]
48. 48.

    EDPB (Eur. Data Protect. Board) 2020. Letter to Miguel de Serpa Soares Regul. Lett., Oct. 7 EDPB Brussels: https://edpb.europa.eu/sites/default/files/files/file1/edpb_letter_out2020-0109_un.pdf
    [Google Scholar]
49. 49.

    EDPB (Eur. Data Protect. Board) 2021. Letter to Miguel de Serpa Soares Regul. Lett. May 19, EDPB Brussels: https://edpb.europa.eu/system/files/2021-05/edpb_letter_out2021-0086_un_en.pdf
    [Google Scholar]
50. 50.

    EDPB (Eur. Data Protect. Board) 2021. Letter to Miguel de Serpa Soares Regul. Lett., Nov. 18 EDPB Brussels: https://edpb.europa.eu/system/files/2021-11/edpb_letter_out2021-00156_un_en.pdf
    [Google Scholar]
51. 51.

    Bovenberg J, Peloquin D, Bierer B, Barnes M, Knoppers BM. 2020. How to fix the GDPR's frustration of global biomedical research. Science 370:651240–42
    [Google Scholar]
52. 52.

    Maximillian Schrems v Data Protection Commissioner Case C-362/14, ECLI:EU:C:2015:650
    [Google Scholar]
53. 53.

    EC (Eur. Comm.) 2021. Standard contractual clauses for international transfers Web. Resour. Eur. Comm. Brussels: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en
    [Google Scholar]
54. 54.

    EC (Eur. Comm.) 2022. Standard contractual clauses (SCC) Web Resour Eur. Comm. Brussels: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
    [Google Scholar]
55. 55.

    Mascalzoni D, Bentzen HB, Budin-Ljøsne I, Bygrave LA, Bell J et al. 2019. Are requirements to deposit data in research repositories compatible with the European Union's General Data Protection Regulation?. Ann. Intern. Med. 170:5332–34
    [Google Scholar]
56. 56.

    Ursin G, Bentzen HB. 2021. Open science and sharing personal data widely—legally impossible for Europeans?. Acta Oncol 60:121555–56
    [Google Scholar]
57. 57.

    Peloquin D, DiMaio M, Bierer B, Barnes M. 2020. Disruptive and avoidable: GDPR challenges to secondary research uses of data. Eur. J. Hum. Genet. 28:697–705
    [Google Scholar]
58. 58.

    EDPB (Eur. Data Protect. Board) 2020. Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies: version 2.0 Regul. Guidel., EDPB Brussels:
    [Google Scholar]
59. 59.

    EDPB (Eur. Data Protect. Board) 2019. Opinion 4/2019 on the draft administrative arrangement for the transfer of personal data between European Economic Area (“EEA”) financial supervisory authorities and non-EEA financial supervisory authorities Regul. Opin., EDPB Brussels:
    [Google Scholar]
60. 60.

    EDPB (Eur. Data Protect. Board) 2022. Guidelines 04/2021 on codes of conduct as tools for transfers: version 2.0 Regul. Guidel., EDPB Brussels:
    [Google Scholar]
61. 61.

    Phillips M, Molnár-Gábor F, Korbel JO, Thorogood A, Joly Y et al. 2020. Genomics: data sharing needs an international code of conduct. Nature 578:31–33
    [Google Scholar]
62. 62.

    Artic. 29 Data Protect. Work. Party 2018. Working document setting forth a co-operation procedure for the approval of “binding corporate rules” for controllers and processors under the GDPR White Pap. 263 rev.01, Artic. 29 Data Protect Work. Party Brussels:
    [Google Scholar]
63. 63.

    Artic. 29 Data Protec. Work. Party 2018. Recommendation on the standard application for approval of controller binding corporate rules for the transfer of personal data White Pap. 264, Artic. 29 Data Protect Work. Party Brussels:
    [Google Scholar]
64. 64.

    Artic. 29 Data Protect. Work. Party 2018. Recommendation on the standard application form for approval of processor binding corporate rules for the transfer of personal data White Pap. 265, Artic. 29 Data Protect Work. Party Brussels:
    [Google Scholar]
65. 65.

    Artic. 29 Data Protect. Work. Party 2018. Working document setting up a table with the elements and principles to be found in binding corporate rules White Pap. 256 rev.01, Artic. 29 Data Protect Work. Party Brussels:
    [Google Scholar]
66. 66.

    Artic. 29 Data Protect. Work. Party 2018. Working document setting up a table with the elements and principles to be found in processor binding corporate rules White Pap. 257 rev.01, Artic. 29 Data Protect Work. Party Brussels:
    [Google Scholar]
67. 67.

    EDPB (Eur. Data Protect. Board) 2022. Approved binding corporate rules Binding Corporate Rules Database, EDPB Brussels: accessed April 2022. https://edpb.europa.eu/our-work-tools/accountability-tools/bcr_en
    [Google Scholar]
68. 68.

    noyb 2020. 101 Complaints on EU-US transfers filed News Comment. Aug. 17, noyb Vienna: https://noyb.eu/en/101-complaints-eu-us-transfers-filed?mtc=nl
    [Google Scholar]
69. 69.

    EDPB (Eur. Data Protect. Board) 2020. European Data Protection Board: thirty-seventh plenary session: guidelines controller-processor, guidelines targeting social media users, taskforce complaints CJEU Schrems II judgement, taskforce supplementary measures Press Release Sept. 4, EDPB Brussels: https://edpb.europa.eu/news/news/2020/european-data-protection-board-thirty-seventh-plenary-session-guidelines-controller_en
    [Google Scholar]
70. 70.

    noyb 2022. Austrian DSB: EU-US data transfers to Google Analytics illegal News Comment. Jan. 13, noyb Vienna: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal?mtc=nl
    [Google Scholar]
71. 71.

    CNIL (Comm. Natl. Inform. Lib.) 2022. Use of Google Analytics and data transfers to the United States: The CNIL orders a website manager/operator to comply Press Release Feb. 10, CNIL Paris:
    [Google Scholar]
72. 72.

    EDPS (Eur. Data Protect. Superv.) 2022. Decision of the European Data Protection Supervisor in complaint case 2020–1013 submitted by Members of the Parliament against the European Parliament Regul. Decis., EDPS Brussels: https://noyb.eu/sites/default/files/2022-01/Case%202020-1013%20-%20EDPS%20Decision_bk.pdf
    [Google Scholar]
73. 73.

    Walker K. 2022. It's time for a new EU-US data transfer framework. Google Blog Jan. 19. https://blog-google.cdn.ampproject.org/c/s/blog.google/around-the-globe/google-europe/its-time-for-a-new-eu-us-data-transfer-framework/amp/
    [Google Scholar]
74. 74.

    EDPB (Eur. Data Protect. Board) 2018. Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 Regul. Guidel., EDPB Brussels:
    [Google Scholar]
75. 75.

    EDPB (Eur. Data Protect. Board) 2020. Guidelines 05/2020 on consent under Regulation 2016/679: version 1.1 Regul. Guidel., EDPB Brussels:
    [Google Scholar]
76. 76.

    EDPB (Eur. Data Protect. Board) 2020. Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak Regul. Guidel., EDPB Brussels:
    [Google Scholar]
77. 77.

    Dove ES, Chen J, Loideain NN 2021. Raising standards for global data-sharing. Science 371:6525133–34
    [Google Scholar]
78. 78.

    EU-US TTC (Trade Technol. Counc.) 2021. EU-US Trade and Technology Council inaugural joint statement Pub. Statement, EU-US TTC Brussels: https://ec.europa.eu/commission/presscorner/detail/e%20n/statement_21_4951
    [Google Scholar]
79. 79.

    Manancourt V, Scott M. 2021. Washington says a transatlantic data deal is close. Brussels disagrees. Politico Sept. 17. https://www.politico.eu/article/washington-transatlantic-data-deal-brussels
    [Google Scholar]
80. 80.

    Scott M. 2022. Digital bridge: Privacy Shield update 3.0—semiconductor subsidies—EU-US policy spat. Politico Feb. 3. https://www.politico.eu/newsletter/digital-bridge/privacy-shield-update-3-0-semiconductor-subsidies-eu-us-policy-spat
    [Google Scholar]
81. 81.

    Christakis T, Propp K, Swire P. 2021. Towards OECD principles for government access to data. Lawfare Dec. 20. https://www.lawfareblog.com/towards-oecd-principles-government-access-data
    [Google Scholar]
82. 82.

    Hallinan D, Bernier A, Cambon-Thomsen A, Crawley FP, Dimitrova D et al. 2021. International transfers of personal data for health research following Schrems II: a problem in need of a solution. Eur. J. Hum. Genet. 29:1502–9
    [Google Scholar]
83. 83.

    DOC (U.S. Dep. Commer.), DOJ (U.S. Dep. Justice), ODNI (U.S. Off. Dir. Natl. Intell.) 2020. Information on U.S. privacy safeguards relevant to SCCs and other EU legal bases for EU-U.S. data transfers after Schrems II White Pap., U.S. Dep. Commer. Washington, DC: https://www.commerce.gov/sites/default/files/2020-09/SCCsWhitePaperFORMATTEDFINAL508COMPLIANT.PDF
    [Google Scholar]
84. 84.

    Scott M. 2021. US offers deal to woo Europe on data. Politico Oct. 21. https://www.politico.eu/article/negotiations-for-new-transatlantic-data-deal-nudge-forward
    [Google Scholar]
85. 85.

    Christakis T, Propp K, Swire P. 2022. EU/US Adequacy negotiations and the redress challenge: whether a new U.S. statute is necessary to produce an “essentially equivalent” solution. European Law Blog Jan. 31. https://europeanlawblog.eu/2022/01/31/eu-us-adequacy-negotiations-and-the-redress-challenge-whether-a-new-u-s-statute-is-necessary-to-produce-an-essentially-equivalent-solution/
    [Google Scholar]
86. 86.

    Bentzen HB, Svantesson DJB 2017. Jurisdictional challenges related to DNA data processing in transnational clouds. Trans-Atlantic Data Privacy Relations as a Challenge for Democracy DJB Svantesson, D Kloza 241–62 Cambridge, UK: Intersentia
    [Google Scholar]
87. 87.

    Internet Jurisd. Policy Netw 2019. Data & jurisdiction program: operational approaches: norms, criteria, mechanisms Tech. Rep., Internet Jurisd. Policy Netw. Paris: https://www.internetjurisdiction.net/uploads/pdfs/Papers/Data-Jurisdiction-Program-Operational-Approaches.pdf
    [Google Scholar]
88. 88.

    NIPH (Nor. Inst. Pub. Health), Cancer Regist. Nor 2020. Comments on proposed EDPB Guidelines 2/2020 Tech. Comment., NIPH/Cancer Regist. Nor. Oslo: https://edpb.europa.eu/sites/edpb/files/webform/public_consultation_reply/edpb_guidelines_niph_crn_comments_20200518.pdf
    [Google Scholar]
89. 89.

    NSHG-PM (Nord. Soc. Hum. Genet. Precis. Med.) 2020. Comments on EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data Tech. Comment. Dec. 21, NSHG-PM. https://edpb.europa.eu/sites/default/files/webform/public_consultation_reply/nshg-pm_comments_edpb_recommendations_012020.pdf
    [Google Scholar]