Opinion and Action Plan on 'Data Protection and Privacy'

A fuller understanding of the human brain, better diagnoses and treatment of brain disorders, as well as the development of new brain-like technologies are all goals of the Human Brain Project. Realizing these goals requires the collection, storage, curation, and analysis of data of various sorts over extended periods of time. Securing privacy interests and advancing data protection measures are key concerns of the Human Brain Project. Their importance was recognized during the proposal development, taken up by the Ethics and Society Subproject (SP12) and reinforced by the Ethics Review in Jan 2015. The HBP needs to comply with national and European data protection legislation. But it is clear that the HBP must go beyond existing legal protections and show not only that it is ethically sensitive to privacy concerns even when such concerns fall outside regulatory frameworks, but also that it makes appropriate use of data and is able to identify and respond to new, unanticipated threats to privacy as they emerge. This document expresses the opinion concerning data protection and privacy by those involved in the Ethics and Society section of the HBP. This includes the members of the sub-project on Ethics and Society (SP12), members of the Ethics Advisory Board and the Ethics Rapporteurs. We identify some of the main privacy-related concerns within HBP, articulate the basic ethical principles that should guide examination of the issues, and present a brief review of the history of data protection and regulation in Europe, focusing on the current state of such regulation. While aware that misuse of the information must be prevented, we are mindful that a form of privacy protection that would prohibit use of any medical or other records for research would stifle medical and scientific progress making it impossible to achieve expected benefits to health that are in the public interest. Therefore, we offer final recommendations that are intended to minimize potential risks while securing the public benefit anticipated from HBP research. Finally, it is worth noting that there is a more general context to current debates on data protection and privacy. A variety of well publicised events have revealed the extent to which the security apparatuses of different national states acquire covert access to data stored on the internet and mine it in various ways in the course of their work. These revelations influence how citizens think about and how policymakers legislate data protection. The structure of the the Opinion is as follows: it starts with a description of some of the key privacy challenges and concerns raised by the HBP. The Opinion then describes conceptual and empirical research on privacy and data protection undertaken in the context of the HBP. It outlines technical options and the regulatory environment within which the HBP operates. The Opinion concludes with a set of recommendations to the HBP