What is the initiative called?
Code of Conduct for Health Research.
What does the EU GDPR say about codes of conduct?
The EU GDPR specifies in Article 40 that “the Member States, the supervisory authorities, the Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation, taking account of the specific features of the various processing sectors and the specific needs of micro, small and medium-sized enterprises.”
What is the aim of the Code of Conduct for Health Research?
The aim is to reach a sector-specific code that explains how the GDPR applies in practice. With regards to clinical trials, it will focus on the secondary use of data that are not regulated within the Clinical Trials Directive. The Code has to be understandable to non-legal experts.
Who is leading the initiative?
The initiative is spearheaded by BBMRI-ERIC.
Does the Code of Conduct for Health Research connect with other code initiatives?
Yes. Firstly, the code initiative was inspired by the IMI Code of Practice on Secondary Use of Medical Data in Scientific Research Projects (27 Aug 2014 FINAL DRAFT), by the European CRO Federation’s GDPR Code of Conduct for Service Providers in Clinical Research (EUCROF GDPR Code or Code) and by RD Code of Conduct for user access to the RD-Connect Genome-Phenome Analysis Platform (GPAP) for health-related information. Secondly, the initiative connects with others who aim for a code of conduct under the EU GDPR Article 40, in order to learn from each other but to ensure, wherever feasible, complementarity. Exchanges with other code initiatives happen on the national (Poland, the Netherlands) as well as the European level (e.g., EFPIA, EUCROF).
How did the initiative evolve?
By 2017, BBMRI-ERIC began to exchange with policy makers, fellow research infrastructures as well as other stakeholders from academia and industry concerned with human research data and patient advocacy groups, such as EFPIA, ESR, ECRIN, EURORDIS, or CESSDA about the orientation and feasibility of such a code. Representatives started gathering for defining key topics and focus areas, and around 2018 the drafting action effectively started.
Was the initiative affected by COVID-19?
Yes. At the beginning of 2020, many points were already discussed and drafted, but Covid-19 emergency needs arrived and took precedence. The initiative had to be put on hold while many experts were asked to focus on pandemic national legislations or projects enabling data exchange. However, it is clear that the pandemic experience has provided some interesting case studies for the code and has spurred the willingness of stakeholders to contribute.
Who is currently involved and how?
Thus far, more than 160 individuals representing 90 organisations in the field of health research have indicated their interest and support for the Code of Conduct for Health Research initiative. Indicating interest in the initiative does not mean that an individual or an organisation endorses the Code. It means that a benefit in the development of such a code is recognised and there is interest in taking part in the process.
Who is involved in the drafting action?
Many stakeholders and experts contributed to drive the initiative forward. Most notably, the following individuals (presented here in alphabetical order) have substantially contributed in various stages to the initiative, including discussions on structure, content, focus, structure or governance: Anne Bahr, Christian Becker, Heidi Beate Bentzen, Gauthier Chassang, Minerva de la Paz, Jasjote Grewal, Petr Holub, Alastair Kent, Jan-Eric Litton, Deborah Mascalzoni, Mihaela Matei, Michaela Th. Mayrhofer, Fruzsina Molnar-Gabor, Anastassia Negrouk, Murat Sariyar, Irene Schlünder, David Townend, Olga Tzortzatou, and Evertbeen van Veen.
Who can get involved?
This is a non-exclusive initiative. We welcome representatives from sector-specific organisations interested in a Code of Conduct for Health Research, who are committed to its development to get involved. To join, please email codeofconduct@bbmri-eric.eu.
How do I get involved?
Please send an email to codeofconduct@bbmri-eric.eu and/or sign up to the Code of Conduct for Health Research mailing list at the top of this page to receive regular updates on the code of conduct initiative.
When will the Code be available for comments and public consultation?
We have started to consult sections of the Code with expert groups and present regular status updates at conferences and workshops. The input received allows us to further refine the content. An elaborated version will be published and opened for public consultation. We especially invite comments from delegates representing the relevant Committees, Working Parties and Networks, international organisations and academic institutions. Please expect further specifications on the public consultation via the newsletter as soon as it becomes available.
How can the final document be endorsed?
Once consensus on the final document has been reached for submission to the competent Data Protection Authority, organisations are invited to support the Code in line with Article 40 of the EU GDPR prior submissions. The invitation will first go out via this initiative’s newsletter.
How will the Code be submitted?
Early summer 2019, the EDPB adopted a final version of the Guidelines on Codes of Conduct, including final versions of the annex to the guidelines on accreditation and certification. The aim of the Guidelines is to provide practical guidance and interpretative assistance in relation to the application of Articles 40 and 41 of the GDPR, intended to clarify the procedures and rules involved in the submission, approval, and publication of Codes of Conduct at both the national and the European level.
How will the Code’s adherence be monitored?
The EDPB adopted an opinion on the Austrian DPA’s draft decision on the Accreditation Criteria for Codes of Conduct monitoring bodies, which outlines how adherence to the Code should be monitored. The governance of the Code is seen as important as the content of the Code itself. Identifying the appropriate adherence mechanisms will be key. Such mechanisms should not add additional bureaucratic burdens but monitor compliance practically and feasibly.
When will the Code of Conduct for Health Research be approved?
After submission, the evaluation is expected to take a few months, including a back and forth between the competent authority/EDPB and the initiative. Once approved, however, the Code has transnational reach and will contribute to the clarity of GDPR compliance in the sector of health research.