{"id":4182,"date":"2025-07-10T16:53:06","date_gmt":"2025-07-10T14:53:06","guid":{"rendered":"https:\/\/confluencedesdroits-larevue.com\/?p=4182"},"modified":"2025-07-10T16:53:07","modified_gmt":"2025-07-10T14:53:07","slug":"gauthier-chassang-lisa-feriol-noemie-dubruel-the-evolving-concept-of-privacy-in-european-law-addressing-specific-challenges-for-advancing-biomedical-research-and-innov","status":"publish","type":"post","link":"https:\/\/confluencedesdroits-larevue.com\/?p=4182","title":{"rendered":"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation"},"content":{"rendered":"\n
\n
\"\"<\/figure>
\n

Gauthier Chassang
Lawyer, Inserm, CERPOP UMR1295 (Inserm and University of Toulouse Paul Sabatier), Genotoul Societal Platform, Toulouse (GIS Genotoul)<\/p>\n<\/div><\/div>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure>
\n

Lisa Feriol
PhD Student in law, Inserm, CERPOP UMR1295 (Inserm and University of Toulouse Paul Sabatier), Ekitia (Not-for-profit data sharing organisation)<\/p>\n<\/div><\/div>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure>
\n

No\u00e9mie Dubruel
PhD Student in law, Inserm, CERPOP UMR1295 (Inserm and University of Toulouse Paul Sabatier)<\/p>\n<\/div><\/div>\n\n\n\n

<\/div>\n\n\n\n

Privacy is a central and evolving social value in democratic systems that is recognised as a fundamental human right by international and European law. Protecting privacy in biolaw is crucial for public trust in scientific research and innovation. Regulatory requirements have been set to safeguard privacy while enabling scientific and technological advancements in biomedicine. As society and technology evolve, the concept of \u201cprivacy\u201d is reshaped. Studying its complex nature is essential to understand its scope, particularly in European health research and biomedical innovation. Based on international and European ethical and legal texts, and jurisprudence, we analyse privacy through a bidimensional lens, highlighting its interconnected material and immaterial dimensions. We address how privacy laws have shifted their focus from protecting the human body integrity to protecting personal data. We argue for the need to reconceptualise and develop the legal concept and regulatory framework for privacy in this field through several examples of innovations and recent regulatory developments. This must take into account the new challenges posed by technological developments and research practices, while maintaining a balance that ensures sufficient leeway to advance scientific knowledge and biomedical innovation in an ethical manner.Keywords: privacy, health research, biomedical innovation, informational privacy, biolaw, legal concept, European law.<\/p>\n\n\n\n

<\/div>\n\n\n\n
Evolving-Concept-of-Privacy-in-European-Law_G.-Chassang_L.-Feriol_N.-Dubruel-07-25<\/a><\/a><\/div>\n\n\n\n
<\/div>\n<\/div><\/div>\n\n\n
biolaw<\/a>, <\/span>biomedical innovation<\/a>, <\/span>European law<\/a>, <\/span>health research<\/a>, <\/span>informational privacy<\/a>, <\/span>legal concept<\/a>, <\/span>privacy<\/a><\/div>\n\n\n
<\/div>\n\n\n\n

Introduction<\/strong><\/h1>\n\n\n\n

As a legal concept, privacy can be considered as a social value, as a right and as a freedom granting to every person a capacity to live privately, in intimacy, without third interferences in personal life choices, in particular from governments.1<\/sup><\/a><\/sup> Incorporated in the international human rights corpus through Article 12 of the Universal Declaration of Human Rights (UDHR),2<\/sup><\/a><\/sup> the right to privacy protection can be seen as interconnected with other fundamental human rights. In this regard, in particular in the field of biomedical research and innovation, privacy protection can be related to the protection of human dignity, notably where invasions of the privacy sphere are particularly intrusive.3<\/sup><\/a><\/sup> Human dignity4<\/sup><\/a><\/sup> can be described as the foundational overarching matricial concept in human rights and biomedical ethics,5<\/sup><\/a> that emphasises the inherent value and worth of every individual. Human beings possess an inherent dignity6<\/sup><\/a><\/sup> simply by virtue of being human.7<\/sup><\/a><\/sup> It can be interpreted as a component of the individual, opposable to third parties to protect individual freedom but also as a representation of a \u201cdignified humanity,\u201d capable of limiting individual freedom,8<\/sup><\/a> Human dignity implies treating individuals with respect and involves recognising and protecting their rights and freedoms, fostering their well-being, and ensuring that ethical considerations guide actions and decisions in any context, including in scientific research. Therefore, specifically in the field of biomedical research and innovation, the principle of human dignity includes the essence of privacy protection that will be further developed separately,9<\/sup><\/a> The legal meaning of dignity remains blurry and judges often have to arbitrate between the protection of human dignity and other fundamental rights. This arbitration can be particularly complex in the European context, where the margin of appreciation of states and European standards must also be taken into account. Human dignity enriches the interpretation of existing rights, particularly with regard to privacy and bioethical issues,10<\/sup><\/a><\/sup> as an inalienable individual right that can limit extensions of certain other rights, notably the right to privacy.

In Europe, privacy (or private and family life) is protected as a fundamental right by Article 8 of the European Convention of Human Rights (ECHR),11<\/sup><\/a><\/sup> and Article 8 of the Charter of Fundamental Rights of the EU (CFREU).12<\/sup><\/a><\/sup> These texts are ensuring that \u201ceveryone has the right to respect for his private and family life, his home and his correspondence.\u201d They are also aligned in terms of conceptual interpretation of protected rights.13<\/sup><\/a><\/sup> We can see that the legal concept of a right to privacy protects different objects, revealing its multidimensionality. The Courts at European level, namely the European Court of Human Rights (ECtHR) and the Court of Justice of the European Union (CJEU), interpreted broadly these articles through many case-laws, in different contexts, confirming the proteomic nature of the right to privacy and allowing to envisage new approaches in the general definition of privacy as a legal concept. As the United Nations states, \u201cprivacy helps us establish boundaries to limit who has access to our bodies, places and things, as well as our communications and our information \u00bb.14<\/sup><\/a><\/sup> This statement needs to be completed by the legal capacity granted to individuals to freely self-determine, to voluntarily and knowingly accept interferences with their privacy sphere, notably for participating in biomedical research. Therefore, while the right to privacy may appear to conflict with the freedom to conduct research, international organisations in Europe, namely the Council of Europe (CoE) and the European Union (EU), strive to establish balanced rules allowing both scientific advances and biomedical innovations while respecting the essence of privacy and, by then, human dignity. In this regard, both organisations develop a consistent legal conceptualisation of privacy that needs further analysis and contextual clarification. How could privacy be described as a concept of law within biomedical research and innovation? Because privacy is a notoriously uncertain idea that has constant ethical and legal ramifications, this paper proposes to illustrate privacy in the context of biomedical research and innovations by qualifying further its multidimensionality. In this objective, we analyse how the right to privacy is integrated in legal instruments framing biomedical research and innovation in Europe, by considering both major hard law instruments which are legally binding States governments and research professionals, and relevant soft law instruments for privacy which are gold standard recommendations with non-legally-binding values. By adopting a pragmatic approach intended to unveil the anatomy of privacy as an empirical legal concept, we identify two essential dimensions of the concept based on the nature of the objects protected in relation to privacy. This approach allows to highlight the current scope of privacy, to deepen the analysis of related rules in biomedical research and innovation and to envisage its potential developments in biolaw. In the first part, we examine the material dimension of privacy in biomedical research through its applications to biological physical entities (I). Then, we analyse the immaterial dimension of privacy in biomedical research resulting from the importance of data and digital developments transforming the field (II). In doing so, we reflect on the areas of convergence of these dimensions and on the legal, ethical, scientific and technological evolutions supporting a broad interpretation of the legal concept of privacy.<\/p>\n\n\n\n

I. The material dimension of privacy in health research and biomedical innovation: the protection of the human body<\/strong><\/h1>\n\n\n\n

Material privacy can be understood as the protection of physical, tangible elements entering the private sphere of individuals. In the field of biomedical research and innovation, this dimension is focusing on the protection of the human body from unethical experimentation and, more directly, on recognising a right to respect the physical integrity of the individual (A). Then, in the light of the technological developments and the research needs, this protection of the body had to be extended to elements of the human body and its derivatives (B).<\/p>\n\n\n\n

A) The progressive approximation of the protection of the individual physical integrity and privacy<\/h2>\n\n\n\n

Although the concept of privacy is broad and cannot be exhaustively defined, it is clear that privacy covers the protection of the human body as the seat of the individual personality and as a very personal and private means of expressing individuality. Although such a statement does not appear in the legal texts that define the concept of privacy, an analysis of the case law reveals some elements of a definition of privacy that is linked to the physical integrity of the person, since it can \u201cencompass several aspects of a person’s physical and social identity.\u201d15<\/sup><\/a><\/sup> Indeed, it was in 1985 that the ECtHR first affirmed that the concept of private life protected by Article 8 of the 1950 ECHR included the physical integrity of the individual in a case involving the sexual assault of a disabled minor, recognising the human body as the most intimate aspect of private life16<\/sup><\/a><\/sup> and the necessity for the government to open legal remedies for allowing privacy protection. Since then, the scope of the right to privacy has been further extended to protect the human body. This concept of the material dimension of privacy is particularly relevant in the biomedical field. This is because the body enters the sphere of intimacy and can be subjected to suffering, modification or even exploitation for scientific and other purposes. The inclusion of the protection of the human body within the scope of Article 8 has led to the development of individual rights linked to biomedicine, such as reproductive rights (in relation to prenatal diagnosis, contraception, abortion, surrogate motherhood and medically assisted procreation), end-of-life issues (euthanasia and assisted suicide) and affirmed the importance of the principle of individual autonomy and consent to any medical intervention on the human body as a basis for legitimising certain attacks on bodily integrity. Thus, considering the body as part of the individual’s private sphere means establishing a link between the protection of physical integrity, the protection of moral integrity and, consequently, the protection of privacy. These three elements are therefore three aspects of the protection of the individual that contribute to respect for the primacy of the human person.17<\/sup><\/a><\/sup>

In this context, the biomedical research area is interesting as an exception when bodily integrity is not respected for non-medical reasons. In the context of research, the human body could be reduced to an object of experimentation, without necessarily being of direct benefit to the health of the individual. This raises a number of issues and is part of a framework that has developed over the course of history. The Second World War was a turning point in the recognition of fundamental rights in science, following the discovery of the atrocities committed on human beings by Nazi doctors under the guise of scientific research experiments. It therefore seemed essential to provide additional protection, first and foremost for the physical integrity of the individual. With this in mind, the Nuremberg Code, resulting from the Nuremberg judgment, established the essential principles of respect for human dignity for the research community and reaffirmed the very principles of medical ethics.18<\/sup><\/a><\/sup> This document, which has become a veritable international standard for research, has led to the recognition of the need for human experimentation, but in accordance with rules that guarantee respect for human dignity and privacy. Obligations such as obtaining the prior consent of research volunteers, after they have received sufficiently clear, complete and appropriate information, provide guarantees that the protection of the individual will prevail. The impact of research on the body is no longer considered solely in terms of physical suffering, but is directly linked to a global consideration of the individual and intimacy. Afterwards, the 1964 World Medical Association (WMA) Declaration of Helsinki, lastly revised in 2024, helped to refine the ethical principles applicable to medical research involving human subjects.19<\/sup><\/a><\/sup> The aim was to reaffirm the importance of research, but also to legitimise its existence in the light of the risks taken by individuals.20<\/sup><\/a><\/sup> The interest of research for society, but also the development of methods of experimentation on living beings, entail specific considerations for the individual, which has led to the affirmation of the importance of the autonomy of the will.21<\/sup><\/a><\/sup> The set of principles laid down in the Declaration of Helsinki, such as the consideration of risks through a risk-benefit analysis, special consideration for so-called vulnerable persons, the scientific requirements of research protocols,22<\/sup><\/a><\/sup> the ethical evaluation of research protocols, respect for the fundamental rights and autonomy of participants through the expression of informed consent, constitute a set of rules that ensure adequate protection for human subjects involved in research.23<\/sup><\/a><\/sup> The Declaration of Helsinki is addressed to doctors and leads them to consider the body as an element to be protected. However, the challenges of research cannot be reduced to the protection of the body, but require a broad consideration of the individual, from all angles of protection: physical and informational.24<\/sup><\/a><\/sup>

All the principles and rules for the protection of the individual, and in particular his or her physical integrity, in the context of biomedical research are laid down in the Oviedo Convention25<\/sup><\/a><\/sup> of the CoE and its additional protocols. The rules set out in this Convention are implemented in the national legislation of the 29 States that have ratified it and are further defined by case law, in particular that of the EctHR, and integrated within EU law.26<\/sup><\/a><\/sup> The Convention underlines the ambiguity of compromising the physical integrity of some individuals for the benefit of many and the advancement of medical and biological knowledge.27<\/sup><\/a><\/sup> The essence of the text is to encourage the research community to put the interests and well-being of the human being first, in a spirit of respect for the dignity and, more broadly, the identity of the individual.28<\/sup><\/a><\/sup> The link between physical integrity and privacy is reaffirmed. Rules are then laid down and, for example, the Additional Protocol on Biomedical Research (APBR) stipulates that research must always be carried out under the supervision of qualified clinical professionals and that research participants have the right to be compensated for any harm resulting from research interventions. In order not to conflict with the fundamental right to health care, research interventions must not interfere with necessary clinical interventions to which the donor has access.29<\/sup><\/a><\/sup> On the basis of these provisions, it can be assumed that the extension of the scope of the protection of privacy includes aspects relating to the safety and quality of interventional procedures carried out for therapeutic or research purposes. In addition, privacy is no longer understood as a mere right to be protected, but takes on a more important dimension that justifies a right to receive any information concerning a person’s health.30<\/sup><\/a><\/sup> The Oviedo Convention and its additional protocols lay down strict rules on information and consent, the basis for the expression of individual autonomy. The individual must be informed of the purpose and nature of the intervention in his or her body, as well as its consequences and risks31<\/sup><\/a><\/sup> in order to be free to withdraw consent to take part in the research at any time.32<\/sup><\/a><\/sup>

The Council for International Medical Sciences (CIOMS) of the World Health Organisation (WHO) strengthened the rules for the protection of human subjects in biomedical research in its International Ethical Guidelines particularly in the context of increasingly technical and digitalised research, so as not to increase the risk taking of research participants.33<\/sup><\/a><\/sup>

Moreover, the UDHR, adopted in 2005, refers to personal integrity34<\/sup><\/a><\/sup> in the broadest sense of the term, which should allow for respect for human vulnerability at all levels. This declaration is based on all the principles that protect integrity, such as respect for dignity, the affirmation of autonomy and consent, and non-maleficence, but it brings a new perspective by linking the different aspects of vulnerability: all bodies, all individuals and all intimate spheres are not equal and cannot benefit from equal treatment alone. Privacy and its protection must also be considered at the level of each individual, who is not all equal in terms of risk. Therefore, the evolution of the ethical and conceptual considerations that led to the development of a normative framework for biomedical research shows a substantial shift from the protection of the integrity of the human body to a broader consideration of the whole nature of the individual. The integrity of the human person, and therefore his or her private life, has thus become the focus of protection.35<\/sup><\/a><\/sup>

However, while the human body as a whole has been taken into account in the various European and International texts laying down the main principles for the oversight of biomedical research,36<\/sup><\/a><\/sup> as science and practice progressed, it has become necessary to consider the oversight of elements and derivatives of the human body.<\/p>\n\n\n\n

B) The protection of elements and derivatives of the human body<\/h2>\n\n\n\n

Roman or Common law traditions differentiate between the human person, as a legal subject with rights of personality and dignity, and things, or goods, as legal objects or things subject to property rights.37<\/sup><\/a><\/sup> Bodily elements are inherent components of a person but when detached from the body, they tend to become goods. The legal qualification of these elements may change over time, where they are modified, replicated and eventually reintroduced into the human body, thus becoming again an integrative part of the person,38<\/sup><\/a> In any case, the protection of human rights required the establishment of specific rules for scientific research.

Human biological samples can be used in research for several reasons depending on the scientific purposes of the projects. The lawfulness and legitimacy of their use is assessed by Research Ethics Committees (RECs) with regard to the public interest purpose of the research and the respect of individual\u2019s rights. They can be collected and used for their biological function, such as in clinical research developing products or methods for organ transplantation, gene or cell therapies, or for their informational value, such as in genomic research on human diseases, samples containing the desired information.39<\/sup><\/a><\/sup> Samples obtained from living or deceased persons, such as organs, cells, tissues, deoxyribonucleic acid (DNA) and ribonucleic acid (RNA)40<\/sup><\/a><\/sup> as products or derivatives of the human body are considered as prolonging the body of the source person until a certain extent, necessitating to protect donor\u2019s rights from the initial procurement or collection and along the samples\u2019 lifecycle, in line with the respect of human dignity. Micro-organisms of human origins are only concerned where the collection or use in research invades the privacy sphere of their human host, the donor. The objective of the biolaw is to avoid objectification or reification of the human person, to avoid utilitarianism considering the person simply as a means to get biological samples without acknowledging his or her fundamental rights and interests.

In our view, sample donor\u2019s rights related to material privacy are protected according to a risk-based approach establishing an equilibrium between the mere principles protecting the human body integrity and inviolability, the protection of human autonomy, and the necessity to collect and use samples for ethical scientific research. The nature of the intervention and associated risks and burden for the participant generated by the sample collection procedure must be scientifically justified to achieve the research purposes, necessary, minimised and detailed in the protocol,41<\/sup><\/a> that will be submitted to independent review. Where founded and appropriate, planned interference with the human body integrity does not constitute degrading treatments prohibited under Art.3 ECHR. Quality requirements for tissues and cells donation for transplantation in the EU42<\/sup><\/a><\/sup> applying from donation, over procurement, testing, processing, preservation, storage, to distribution, including import, could be envisaged as contributing to the respect of material privacy by protecting safety and, by then, the respect of the integrity of the human receiver body.

The Oviedo Convention and its additional protocols protect the research participant\u2019s autonomy regarding elements of the human body used in research.43<\/sup><\/a><\/sup> The informed consent process shall clearly cover the collection of biological materials and their envisaged uses, including any foreseeable further uses and potential commercial uses.44<\/sup><\/a><\/sup> As a general rule, the disposal (i.e storage and reuse) of human biological samples procured for another purpose is possible when it is complying with the information given to the concerned person and applicable consent procedures adopted in national laws.45<\/sup><\/a><\/sup>

Moreover, material privacy is questioned in relation to the beginning of life notably regarding embryos, which are considered as special biological elements raising very sensitive issues. Their statute and use in research and innovation question the right to life of future human beings and the right to private and family life as part of the parents\u2019 rights. The Oviedo Convention grants a specific protection to in vitro<\/em> embryos regarding their potential uses in research and prohibits their creation for research purposes,46<\/sup><\/a><\/sup> but the ECtHR does not recognise an embryo as an autonomous subject of law, as a person.47<\/sup><\/a><\/sup> Nevertheless, the Court recognises that the possibility for an individual to make a conscious and considered choice about the fate of his or her embryos concerns an intimate aspect of personal life and falls within the scope of their right to self-determination and private life.48<\/sup><\/a><\/sup> In the EU, these issues have been raised in the preparatory works of research funding programs,49<\/sup><\/a> and, despite cultural and legal differences between EU Member States on human embryos protection, a minimal consensus50<\/sup><\/a><\/sup> on non-negotiable requirements has been reached for allowing funding ethical research with human embryos.51<\/sup><\/a><\/sup> As a closely related topic, human cloning for reproductive purposes has been prohibited at international level in a specific additional protocol to the Oviedo Convention,52<\/sup><\/a> In Europe, the artificial creation of viable genetically identical human beings is contrary to human dignity and constitutes a misuse of biology and medicine.53<\/sup><\/a><\/sup> It would infringe the very essence of all fundamental rights of the clone by predetermining his genetic characteristics, genetic identity. Today, the scientific use of human reprogrammed stem cells is seen as an ethical alternative that has been regulated to avoid resulting in embryos capable of developing into human beings.54<\/sup><\/a><\/sup>

Material privacy is also questioned for performing scientific research or educational activities on human bodies or samples after death. There are no common European rules on this topic. Some States enacted specific legal provisions for body donation based on consent of the living individual before his or her death (e.g. Czech Republic, Greece) or on opt-out (e.g. Portugal, France) and provisions regarding relatives\u2019 rights, some also condition the use of unclaimed bodies (e.g. Portugal, Romania), while others have no legislation on the topic (e.g. Belgium, Estonia).55<\/sup><\/a><\/sup> Generally, privacy is regulated with regard to the respect of the memory of the deceased person and conditions for respecting the bodies are conceived as fiduciary duties of the research establishments in charge of ensuring the storage, availability and use of the bodies. In France for example, the law evolved56<\/sup><\/a><\/sup> after a scandal and a public inquiry involving a University that committed ethical misconduct and injury to the deceased body donated for science.57<\/sup><\/a><\/sup>

Material privacy is also questioned from a property rights angle. None acts at CoE or EU level recognises an individual property right on its own human body or its elements as it would create (unnecessary) risks to human dignity58<\/sup><\/a><\/sup> and increase the vulnerability of individuals. This would open the door to human exploitation, risks of expropriation, commercialisation and other types of undesirable threats to the physical or moral integrity of the person, and risks of misuses of human remains after the death.59<\/sup><\/a><\/sup> Therefore, the human body and its elements are considered inalienable and the Oviedo Convention and its APBR prohibits that they give raise, as such, to financial gain,60<\/sup><\/a><\/sup> giving them an extrapatrimonial nature. Undue payment for donation is prohibited and human samples cannot be sold or bought as such, they are special, out-of-market, goods. This approach notably justifies the prohibition and fight against human organ trafficking.61<\/sup><\/a><\/sup> Privacy ensures adequate protection based on an empirical ethical reasoning and actionable control rights for individuals which are not fully identical to property rights as a transferable right to exclude others. Courts in Europe or in the US,62<\/sup><\/a> refused to address claims related to malpractices regarding human samples63<\/sup><\/a><\/sup> based on individual ownership rights,64<\/sup><\/a><\/sup> while accepting arguments based on the respect of private life. The extra-patrimonial protection adopted in Europe does not exclude certain valorisation of samples used in, or made available for, scientific research. Two pathways are possible: 1) the pricing of access to biocollections; fees can be calculated based on the integral cost of resources and infrastructures engaged in quality management of the samples;65<\/sup><\/a><\/sup> 2) valorisation through intellectual property rights (IPR); this case being strictly regulated, specifically in EU law66<\/sup><\/a><\/sup> regarding patentability of samples, tissues or cell lines produced or modified, or elements that have been isolated by researchers, as well as original technological processes underlying sample manipulation or modification, regardless of their human origin.67<\/sup><\/a><\/sup> Some case laws in IPR pushed judges to advance biolaw, for instance, in 2011, where the CJEU defined the notion of human embryo68<\/sup><\/a><\/sup> for enforcing the EU patenting law and protecting public order and morality,69<\/sup><\/a> 70<\/sup><\/a> 71<\/sup><\/a> Advances in biomedical research and innovations will still question the role and scope of IPR as many innovations include or are derived from human biological components (e.g. gene or cell therapeutic products, cDNA, bioprinting, organoids\u2026).

Lastly, the material dimension of privacy is questioned by the transhumanist movement that claims for enabling human enhancement as an ethical paradigm shift based on a right to have full access to scientific innovations for personal uses.72<\/sup><\/a><\/sup> Frontiers in privacy protection are challenged based on an influential libertarian discourse promoting unrestricted individual freedom and individual-centered privacy where anyone could self-enhance its body or mind properties, notably with implants. While active implants are developed and beneficial, to treat Parkinson disease for example, new controversial projects are emerging to develop artificial organs or chips intended to increase or outpass natural human capacities, to create networked individuals through human-machine interfaces73<\/sup><\/a><\/sup> or for reaching immortality thanks to technology. These non-clinical applications, notably based on neurotechnologies, raise silent concerns among scientists74<\/sup><\/a><\/sup> and could call regulators to envisage restrictions of individual freedom to dispose of their body by considering negative effects,75<\/sup><\/a> not only for the concerned individual risking his health and freedoms, but also for society and humanity in terms of equity, justice, discrimination, privacy of others, morality, risks for democracy and human identity. Today, few Guidelines exist in Europe to help researchers appraising technological enhancement risks in their project.76<\/sup><\/a><\/sup>

Through these examples, we see that the scientific developments engaging the human body feed the development of the legal concept of privacy, helps to clarify its evolving scope and generate new ethical issues questioning the imbrications of privacy with human dignity.

The material dimension of privacy grants individuals a right to control the use of their own body, bodily elements and detached elements against a third entity provided that this control does not engage legitimate rights of thirds or important societal values. Personal control exercised is progressively loosen where a biological sample is manufactured, derived or substantially transformed in a way that does not anymore engage the donor\u2019s interests entering into the scope of the protection of private and family life. Privacy protection can also be protected after death and entrusted by the relatives of the concerned individual. Nevertheless, protection is still afforded under the principle of human dignity. The link between the material side of privacy and its immaterial side is particularly strong in biomedical sciences as scientific research evolves towards practices focusing on the use of data attached to biological material samples.77<\/sup><\/a><\/sup> The evolution of the international and European reference texts on research ethics underpins the adaptive nature of the concept of privacy in biomedical research. The WMA Declaration of Helsinki of 2013,78<\/sup><\/a><\/sup> together with the Declaration of Taipei,79<\/sup><\/a><\/sup> and recommendations from the CoE,80<\/sup><\/a><\/sup> emphasise the various facets of privacy, including the protection of the integrity of the body and the protection of the information about individuals in any new biomedical research and technological development, notably in genetics. This second dimension relates to the protection of what some call the \u201cinformational body\u201d,81<\/sup><\/a> and is known as \u201cinformational privacy\u201d.<\/p>\n\n\n\n

II. The immaterial dimension of privacy in biomedical research and innovation: the informational privacy<\/strong><\/h1>\n\n\n\n

Informational privacy completes material privacy by regulating the digital world and how data about someone can be processed (A) and governed (B). This section analyses the specific legal regime established in Europe for maintaining informational privacy in scientific research, including biomedical research and innovation. It illustrates current practices and challenges which are calling for reinforcing the underlying legal concept of informational privacy and developing related protection.<\/p>\n\n\n\n

A) The personal data protection, digital privacy, and new challenges in research<\/h2>\n\n\n\n

Modern research is here understood as \u201cdata-driven\u201d and research data, methods and biomedical innovations have become increasingly digital82<\/sup><\/a><\/sup> inscribing individuals\u2019 informational privacy as part of biolaw. Data, whether anonymous or identifying, is a valuable and indispensable resource for the research community seeking greater data availability and circulation. Specifically, the access to personal data, and to specially protected categories of personal data such as health, genetic, biometric, ethnic data, for processing in biomedical research and innovation has to be regulated.

Informational privacy is a concept of legal science described in the literature83<\/sup><\/a><\/sup> and based on freedom of choice, on personal control over information or informational resources, on a self-determination capacity on the part of the concerned individual or groups regarding the processing of the data, and on State protection. These elements have been essentially captured and developed as a legal concept by biolaws and guidelines at national and international level on personal data protection. But informational privacy in biomedical research and innovation could be understood more broadly and inclusively. For instance, it could be related to the Oviedo Convention\u2019s Article 13 addressing issues related to advances in human genome editing technologies and providing that an intervention seeking to modify the human genome may only be undertaken for preventive, diagnostic or therapeutic purposes and only if its aim is not to introduce any modification in the genome of any descendants.

Therefore, informational privacy can be envisaged as the protection of individual rights and interests, for protecting individual identity and dignity of persons,84<\/sup><\/a><\/sup> but also as measures to protect collective rights and interests that can eventually compete and restrict individual freedoms, for protecting human identity as an attribute of human species and a common heritage of mankind, on behalf of human dignity.

In Europe, national laws have first regulated personal data protection since the 1970\u2019s,85<\/sup><\/a><\/sup> then followed by the international CoE Convention 108 of 1981,86<\/sup><\/a><\/sup> the first international legally binding on the topic, modernised in 2018 (Convention 108+),87<\/sup><\/a><\/sup> and the EU Directive88<\/sup><\/a><\/sup> of 1995, replaced by the General Data Protection Regulation (GDPR)89<\/sup><\/a><\/sup> of 2016. Research and innovation have been progressively considered in such frameworks with the concern of both ensuring personal data availability and adequate protection of individual\u2019s rights, in line with the APBR that specified that any personal information collected in the course of biomedical research must be considered confidential and treated as such.90<\/sup><\/a><\/sup> In 2000, the ECtHR linked the right to protection of personal data to the concept of private life91<\/sup><\/a><\/sup> and reaffirmed this in 2008.92<\/sup><\/a><\/sup> In the EU, personal data protection has been recognised as a specific fundamental right protected by Article 8 of the CFREU and Article 16 of the Treaty on the Functioning of the EU. With the GDPR the processing of personal data in research activities is ruled by basic harmonised principles but Member States keep competence for further regulating the domain, what results in a fragmented EU national laws landscape,93<\/sup><\/a> National specificities and divergent interpretations led to complexities hampering the full achievement of the initial GDPR ambition to liberate the full potential of personal data and increase the circulation of this resource.

Both the CoE Convention 108+94<\/sup><\/a><\/sup> and the GDPR95<\/sup><\/a><\/sup> adopt a risk-based and proportionality principle approach to any personal data processing undertaken under the responsibility of a data controller and related data processors. The risk-based approach considers the nature of the data, the processing purposes and characteristics. The protection afforded applies to the entire data lifecycle, from initial collection, to reuses and final erasure. However, it does not apply to the protection of personal data after the death of the data subject, even if Member States can regulate this matter.96<\/sup><\/a><\/sup> Both texts fix equivalent essential principles and related case-laws dealt by the ECtHR and the CJEU are consistent.97<\/sup><\/a><\/sup> The GDPR applies specifically to EU Member States for processing taking place inside and, to some extent, outside the EU borders. Both texts establish a special legal regime for scientific research and technological development that set up the basis of an equilibrium between privacy protection and research needs. The CoE adopted specific recommendations on the protection of health data,98<\/sup><\/a><\/sup> including in research, and in the EU, the European Data Protection Board (EDPB) is also developing specific guidelines, including for research.

Within the GDPR, this special regime comes from several provisions. Article 9 provides a legal basis allowing the processing of sensitive personal data where necessary in research, as an exception to the general prohibition of processing,99<\/sup><\/a><\/sup> subject to the respect of specific conditions fixed by Article 89 GDPR. But Member States laws vary on the legal basis and conditions to be used for research.100<\/sup><\/a><\/sup> For instance, while the GDPR emphasises the data subjects\u2019 opt-out mechanisms for supporting individual autonomy, Member States can impose consent for processing special categories of data such as health or genetic data.101<\/sup><\/a><\/sup> Long debates opposed defenders of specific consent against those defending broad consent practices in research,102<\/sup><\/a> The case has been made for broad consent utility and validity where it is not possible to fully identify the research purpose of the processing at the time of data collection, or where it is necessary for meeting legitimate scientific or public interest purposes, notably in genomics, this practice being lawful in some Member States.103<\/sup><\/a><\/sup> The GDPR considers both practices and, without mentioning \u201cbroad consent\u201d, it allows consent to be given for one or several specified purposes,104<\/sup><\/a><\/sup> recognises e-consent and layered consent practices enabling the data subject to voluntarily enlarge the scope of consent while keeping adequately informed105<\/sup><\/a><\/sup> about the research activities.106<\/sup><\/a><\/sup> Now, similar issues are raised in the context of the draft European Health Data Space Regulation (EHDSR)107<\/sup><\/a><\/sup> organising a governance system for the secondary use of personal data contained in various digital health records for research and innovation purposes at EU level. In this regard, Article 5(1)(b) GDPR introduces a presumption of compatibility for the further processing in research of personal data initially collected for a different processing purpose,108<\/sup><\/a><\/sup> and Article 5(1)(e) allows the storage of personal data for longer periods than for the initial processing purposes insofar as the personal data will be processed solely for research or statistical purposes, subject to appropriate measures to safeguard the rights and freedoms of the data subject.109<\/sup><\/a><\/sup> These provisions ground crucial activities of research projects and repositories (data repositories or biobanks) ensuring adapted data governance and data management practices conceived in the respect of the principles of accountability110<\/sup><\/a><\/sup> and data protection by design and by default.111<\/sup><\/a><\/sup> Therefore, Article 89(2) GDPR allows derogations to data subjects\u2019 rights in research in so far as this is planned for into EU or National laws and that such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. The GDPR equilibrium is precious and is regularly challenged in practice. However, recent examples during the COVID-19 pandemic showed that informational privacy is a value to constantly respect, even where there are urgent needs for performing public health research at large scale,112<\/sup><\/a> Member States that restricted data subject\u2019s rights during this period by using their legitimate margin of interference for protecting public health under Article 23(1)(e) GDPR, have always been obliged to ensure that such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society. The EDPB gave further interpretation of these requirements,113<\/sup><\/a> Today, the GDPR continues raising specific challenges, divergent interpretation and practical roadblocks in data sharing. For instance, issues remain regarding the scope of the GDPR.114<\/sup><\/a><\/sup> Indeed, personal data is defined as any information concerning an identified or identifiable natural person, including pseudonymised data which remain indirectly identifiable, but excludes anonymous and anonymised data. For appraising identifiability, account should be taken of all the means reasonably likely to be used, by the controller or by another person, to identify the data subject directly or indirectly. To ascertain whether means are reasonably likely to be used for identification, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.115<\/sup><\/a><\/sup> In addition, the nature of the data processed must be considered and, in 2014, the EU data protection authorities116<\/sup><\/a><\/sup> defined three anonymisation criteria,117<\/sup><\/a><\/sup> since endorsed by the EDPB, which must be fulfilled irreversibly. The threshold of anonymisation requirements in the EU is very high and difficult to achieve. Challenges remain, notably for complying with the irreversibility criteria of anonymisation by considering the increasing availability of big data, new technologies,118<\/sup><\/a> and despite the use of contractual instruments forbidding attempts to re-identify data subjects. In genomic research in particular, the singularity of the human genome119<\/sup><\/a><\/sup> and risks of reidentifiability120<\/sup><\/a><\/sup> stemmed a precautionary approach tending to systematically consider such data as sensitive personal data, until it is demonstrated otherwise by the data controller.121<\/sup><\/a><\/sup> Therefore, it is scarce that researchers using big data or genetic and genomic data can reach these criteria and escape from the scope of the GDPR and other privacy laws, this leading to proposals to think post-identifiability, in genomics122<\/sup><\/a><\/sup> for example, by focusing more on education, engagement and adapted data governance. But, where reachable, anonymisation eases research collaborations and helps in meeting the requirements of open science through the deposition of research data in open data repositories. Other complexities come from the broadness and evolutive feature of the legal qualification of health data which can qualify either by nature, by crossing or by destination, everything depending on the context of the processing and a case-by-case analysis.123<\/sup><\/a><\/sup> In current technological context, data considered anonymous in one context could become personal health data in another. Indeed, protecting the data as such does not totally avoid privacy issues. For instance, anonymisation has ethical consequences for individual rights that the participants should understand, such as the impossibility to respect their right to know and to have communication of clinically validated and useful results, including incidental findings,124<\/sup><\/a><\/sup> revealed along the research. Also, as noted by the CoE, even if based on anonymised samples, research can lead to discrimination or stigmatisation of certain groups based on research results.125<\/sup><\/a><\/sup> The CFREU even grants a specific right against genetic discrimination.126<\/sup><\/a><\/sup>

Moreover, recent advances in AI and algorithmic systems have raised new challenges of human manipulation and responsibility127<\/sup><\/a><\/sup> affecting privacy and projects developing health innovations. Biomedical technologies relying on extensive computer modelling and simulation requiring AI tools powered by data128<\/sup><\/a><\/sup> raise new informational privacy risks. For example, AI-enabled tools for medical decision-making, but also efforts for the creation of virtual patient cohorts,129<\/sup><\/a><\/sup> or even digital twins,130<\/sup><\/a>131<\/sup><\/a><\/sup> based on synthetic data.132<\/sup><\/a><\/sup> In reality, the risk seems to have shifted from one of data protection to one of representativeness.133<\/sup><\/a><\/sup> Indeed, for synthetic data to be reliable and conclusive, it must be sufficiently representative of reality, so as not to conduct research based on false knowledge.134<\/sup><\/a><\/sup> The manipulation of data therefore accentuates the responsibility of researchers, opening up a little more consideration on the protection of privacy,135<\/sup><\/a><\/sup> the latter still being perceived as the sphere of intimacy to be protected, but also as a sphere specific to the individual,136<\/sup><\/a><\/sup> which cannot be altered or erroneous. The concept of informational privacy is thus evolving towards the challenge of maintaining a faithful representation of individuals. Interestingly, this challenge is also highlighted with recent advances in the Digital Afterlife Industry137<\/sup><\/a><\/sup> where \u201cdeathbots\u201d or \u201cdigital ghosts\u201d of deceased persons are created, for recreational or for health-related purposes,138<\/sup><\/a> thanks to generative AI systems (AIS), what also highlights the need to envisage privacy protection modalities after the death of the original data subject.

The EU AI Act (AIA) will set the stage for qualitative and trustworthy AI systems (AIS) that might present high-risk to health, safety or fundamental rights such as privacy. If the AIA liaises with the GDPR, this latter could prove incomplete regarding new issues raised by biomedical AIS. The next revision of the GDPR could be a milestone and the occasion to introduce new harmonised rules for protecting informational privacy based on ongoing regulatory achievement at National levels.139<\/sup><\/a><\/sup>

If the initial legal focus of informational privacy has been placed on personal data protection such a protection evolved from the specific protection of the data to the necessity to ensure appropriate governance of the data in order to cope with ground and sector-specific challenges.<\/p>\n\n\n\n

B) Moving from an individual-centred privacy protection to a collective governance-based approach<\/h2>\n\n\n\n

As mentioned above, the development of scientific research methods now calls for a focus on the informational aspects of privacy protection. We are moving from an understanding of respect for privacy based on the implementation of mechanisms at the level of the individual (in particular through informed consent), to an approach that considers individuals at a more collective level by focusing on the implementation of measures to protect their rights and interests at the level of the databases and related processing (relying on actors\u2019 responsibility and accountability) due to the multiplied risks arising from data aggregation and cross-referencing. This trend is directly reflected in the evolution of the Helsinki Declaration and its adaptation in the Taipei Declaration specific to issues related to database research, which introduces the word \u201cgovernance\u201d in its second version. The OECD guidelines on Creation and Governance of Human Genetic Research Databases (2006)140<\/sup><\/a><\/sup> and on Human Biobanks and Genetic Research Databases (2009)141<\/sup><\/a><\/sup> also attest to the evolution of research practices and associated risks. The aim of this systemic governance approach is to organise the conditions for the free circulation of personal sensitive data based on accountable management implementing the special regime granted to scientific research. In the GDPR, this requires implementing technical and organisational measures to counterbalance the adjustment of data subject\u2019s rights in research activities142<\/sup><\/a><\/sup> and to ensure the principle of data minimisation,143<\/sup><\/a>144<\/sup><\/a><\/sup> and other effective mechanisms of privacy protection. In a technical approach to the subject, the GDPR cites the anonymisation or pseudonymisation of data as examples.145<\/sup><\/a><\/sup> These measures are completed by the use of specific contracts,146<\/sup><\/a><\/sup> recognised technical standards, cybersecurity aspects, consideration of ethical aspects in the governance of data processing,147<\/sup><\/a><\/sup> the use of Privacy Enhancing Technologies (PETs)148<\/sup><\/a><\/sup> and more.149<\/sup><\/a><\/sup> It is interesting to note that the law increasingly relies on technology to ensure respect of privacy and enshrines their relevance in this area, thus demonstrating the importance of the multidisciplinary approach when considering the effectiveness of the fundamental individual rights of individuals in highly digitalised sector, such as today\u2019s research.150<\/sup><\/a><\/sup>

In addition to the technical and organisational measures foreseen by Article 89, the GDPR, in an operational approach to the law designed to guide actors faced with these issues, has introduced and imposed the use of certain tools, such as the Data Protection Impact Assessment151<\/sup><\/a><\/sup> for processing operations likely to generate a high risk for the rights and freedoms of natural persons. In addition, it introduced self-regulation mechanisms such as with the use of Codes of Conduct,152<\/sup><\/a><\/sup> to encourage stakeholders to adapt the general requirements to the specific features of their sector of activity or stakeholders concerned, which Codes must be validated by the supervisory authorities. Also, from a governance perspective, the GDPR requires organisations to appoint a Data Protection Officer in the case of processing of data considered as special by Article 9(1) GDPR,153<\/sup><\/a><\/sup> including health and genetic data.

Continuing the efforts made by the GDPR to organise the free circulation of personal data with regard to the protection of personal data, the ongoing implementation of the European Data Strategy154<\/sup><\/a><\/sup> presented in February 2020, which aims to create a single market for data, bears witness to the turning point that is taking place in the philosophy of the approach to both personal and non-personal data (including anonymised data in these new frameworks) by creating sectoral data spaces that must communicate with each other. Efforts are now being made to organise the circulation of data in order to unleash its potential, while respecting the values of the EU which calls for reflection on the adaptation of the fundamental rights at stake. As far as scientific research is concerned, the recent EHDSR aims in particular to propose a legal framework and a system of governance harmonised at European level in order to release the potential of existing health data for the benefit of research in particular, among other secondary uses of health data.

The final Regulation continues this collective understanding of privacy protection by imposing a European governance model for health data access and reuse in the public interest. This model differs from that of the GDPR as it facilitates access to health data with an obligation for data holders to make health data available through National Health Data Access Bodies, while at the same time ensuring full respect for fundamental rights, including respect for privacy.155<\/sup><\/a><\/sup> Whereas the GDPR provided for the preservation of the autonomy and privacy of data subjects through mechanisms at individual level associated with data controllers\u2019 accountability, the EDHSR provides for a reinforced general opt-out mechanism156<\/sup><\/a><\/sup> together with \u201cpublicly available\u201d information on the conditions under which electronic health data is made available for secondary uses. 157<\/sup><\/a><\/sup> The EHDSR keeps the possibility for Member States to introduce consent for four types of data considered particularly sensitive.158<\/sup><\/a><\/sup> Supporting the emphasis placed on access to health data, the EHDSR foresees that Member States may provide in their national law for the possibility of overriding the opt-out expressed by individuals159<\/sup><\/a><\/sup> under the strict conditions listed in the Regulation, in particular for scientific research purposes for important reasons of public interest.

To ensure a balance between the protection of individual rights and the maximised use of health data for the benefit of the public interest\u2014including scientific research\u2014the EHDS will first provides controlled access to anonymous data and, if the purpose cannot be achieved in any other way, to pseudonymised data,160<\/sup><\/a><\/sup> through a secure processing environment,161<\/sup><\/a><\/sup> after ethical assessment if required under national law. Moreover, the governance system intends to be representative of the various stakeholders\u2019 interests. Indeed, the governance bodies planned at national and European level are expected to collaborate with European citizens and patients in order to preserve their autonomy in a collective approach. 162<\/sup><\/a><\/sup>

The EHDSR goes a step further than the GDPR in the collective approach of privacy protection as it organises a delegation of individual rights and interests\u2019 protection to representative bodies completing the collective protection already ensured by established research ethics committees. However, we can hope that the EHDSR will prompt a move in Member States\u2019 legislation to extend ethical assessment to all secondary uses of health data and that a joint debate will be launched at European level on the concept of \u201cpublic interest\u201d justifying access to such sensitive data. This would strengthen further the harmonized approach to privacy protection within the EU.

This objective of facilitating data sharing is already well known to the research community notably illustrated by the open science movement, for which those involved in research have structured themselves, as illustrated by the development of the FAIR principles163<\/sup><\/a><\/sup> whose relevance is now unanimously recognised.

These major movements in favour of exploiting data for research purposes have led to a reconsideration of the traditional understanding of the effectiveness of privacy at the individual level, prompting the research community to propose new solutions to maintain autonomy. For example by introducing a certain granularity in consent,164<\/sup><\/a><\/sup> and now, in a systemic approach focusing on an adapted governance of research projects, through the concepts of meta-consent,165<\/sup><\/a><\/sup> consent to governance,166<\/sup><\/a><\/sup> opt-out mechanism,167<\/sup><\/a><\/sup> and transparency portal.168<\/sup><\/a><\/sup> Each solution has the potential to pragmatically equilibrate the needs for sharing data for research and the necessary protection of individuals\u2019 rights and freedoms\u2014including privacy. Nowadays, research ethics committees play a considerable role in this search for this balance; we might even see in this a kind of transfer of autonomy from individuals to these ethics committees regarding the conditions under which their data is used. Effective respect for the privacy of individuals concerned by the processing of their personal data is now ensured at the level of access and data processing conditions, with controlled\u2011access procedures.169<\/sup><\/a> These procedures are set up by research actors, together with requirements aimed at ensuring that processing is carried out under conditions that minimise as far as possible the risks170<\/sup><\/a><\/sup> of exposure for the data subjects privacy,171<\/sup><\/a><\/sup> having regard to the sensitivity of the data concerned and the processing context.172<\/sup><\/a><\/sup> This approach needs to be considered in a contextual and continuous manner, particularly with regard to changes in the processing undertaken or the potentially evolving sensitivity of the data processed, in order to guarantee the effectiveness of the privacy protection of the data subjects who have \u201centrusted\u201d their data for the benefit of research.

As the autonomy of individuals over the way their data is used, and therefore over the risks to their privacy, becomes increasingly complex in the light of developments in the sharing of personal data for a variety of purposes, including research, new approaches are now being considered, based on the notion of the \u2018commons\u2019.173<\/sup><\/a><\/sup> The commons refer to the collective management of certain goods on account of their collective potential, for the community.174<\/sup><\/a><\/sup> Some authors wonder whether health data could be classified as commons175<\/sup><\/a><\/sup> because of its potential for research and then for public interest, enabling collaborative modes of governance representing the various stakeholders concerned, and in particular the way in which the individuals concerned want their privacy to be protected. These new management modalities,176<\/sup><\/a><\/sup> whose criteria and definitions are vague,177<\/sup><\/a><\/sup> have for the most part been conceptualised in practice and are now tending to be recognised by the institutions178<\/sup><\/a><\/sup> and the European legislator.179<\/sup><\/a><\/sup> At international level, the WHO’s 2022 guidelines describe health data as a \u201ccommon good,\u201d advocating maximum re-use.180<\/sup><\/a><\/sup> These new ways of using data have led some authors to argue in favour of the application of collective rights to health data in scientific research, because of the way it is networked through new research methods and practices.181<\/sup><\/a><\/sup> The protection of the privacy of individuals affected by the processing of their personal data would be more effective at the collective level than at the level of the individual, by relying on organisations having a fiduciary duty to respect the will of data subjects and protect their interests.182<\/sup><\/a><\/sup> The processing of health data on a massive scale made possible by new data processing techniques presents numerous opportunities for benefitting to the public interest and helps to continuously renew questions about the balance between the rights, freedoms and interests of individuals and the collective interest. The 2022 WHO guidelines on sharing and reuse of health-related data for research purposes183<\/sup><\/a><\/sup> are a good reminder of this.184<\/sup><\/a><\/sup>

Thus, the effectiveness of the protection of individual privacy seems to be increasingly based on trust, and therefore on the social acceptability of the way in which the system of governance at work protects individual privacy, rather than on individual acceptance, as traditionally conceived. Therefore, in order to build this trustworthy collective protection, the research community is proposing adherence to complementary ethics principles for data governance.185<\/sup><\/a><\/p>\n\n\n\n

Conclusion<\/strong><\/h1>\n\n\n\n

As a legal concept, privacy is interconnected with other ethical values and fundamental human rights as several notions revolve around it, in particular those of freedom, dignity, confidentiality, self-determination and individual autonomy. The historical development of biolaw illustrates how the specific field of biomedical research and innovation allows establishing a link between the principles of human dignity and respect for privacy, and requires for their permanent conciliation. The EU law and CoE regulatory works characterise the elements protected under privacy right and emphasises how privacy can be respected in practice despite its conceptual gaps. Privacy should not be understood as the opposite of sharing intimate elements, whether related to one’s body or personal data. To the contrary, privacy right allows individuals to share by deciding about the scope of the protection they want to ensure with regard to material and immaterial elements of their private life. The biolaw conditions how and for which purposes interferences can be envisaged in research. The general jurisprudence of the ECtHR and CJEU in Europe shows complementarity: human dignity is non-negotiable and ultimately protects individuals and society from libertarian abuses. Human dignity plays where privacy don\u2019t, and vice-versa. Biomedical research and innovation illustrate new potential tensions where current advances question the place of individual\u2019s autonomy and the role of collective governance of privacy and data in the building of a balanced and dynamic research environment in consideration of the necessary interferences justified by public interest. While conceiving privacy in terms of its material and immaterial dimensions helps to understand its scope, advances in the biomedical field, particularly the current digital transformation of scientific research and health care, are leading regulators to focus on informational privacy to meet the challenges posed by new technologies. Material and immaterial privacy in the biomedical sciences is still based on an extra-patrimonial regime since it is not based on property rights (attached to objects) but on personality rights (attached to persons) and on State, organisational, technical and, increasingly, on collective means of protection to ensure effective protection of the individual. To date, privacy concerns are both drivers and bottlenecks for biomedical research, innovation and for technology adoption. Privacy is a moving target necessitating regulatory flexibility and anticipation, as well as sustainable, responsible, collective and agile governance, in order to accommodate to the evolving socio-technological contexts in which scientific research and biomedical innovation inscribe. Despite some shortcomings in its concrete application, it is crucial that the legal concept of privacy continues to be debated and developed in order to meet societal expectations in scientific and technological progress.<\/p>\n\n\n\n

\n\n\n\n

1<\/a> A. Luk\u00e1cs, \u201cWhat is privacy? The history and definition of privacy,\u201d 2016, pp. 256\u2013265.<\/p>\n\n\n\n

2<\/a> UN, Universal Declaration of Human Rights,1948.<\/p>\n\n\n\n

3<\/a> Such a link between dignity and privacy has notably been established in relation to interferences with the human body, for example in cases of alleged abusive sexual practices, see European Court of Human Rights (EctHR) K.A. and A.D. v. Belgium, req.42758\/98 and 45558\/99, 2005, or of abusive strip-searching by the police, see ECtHR Wainwright v. the UK, req.12350\/04, 2006, point 44, 46 and Roth v. Germany, req.6780\/18 and 30776\/18, 2021, points 5\u20136, 55, 64, 83\u201384, where the Court assessed the severity and justification of the invasion of the human body to engage Art. 3 and\/or 8 of the European Convention on Human Rights (ECHR). In the EU, this link is also underlined by the European Data Protection Supervisor, see EDPS website, Data Protection, What is Privacy? (accessed on 28 september 2024).<\/p>\n\n\n\n

4<\/a> UN, Universal Declaration of Human Rights,1948, Art. 1.<\/p>\n\n\n\n

5<\/a> B. Mathieu, \u201cLa dignit\u00e9 de la personne humaine: quel droit? quel titulaire,\u201d Recueil Dalloz<\/em>, 33, 1996, pp. 282; R. Andorno, \u201cDignit\u00e9 humaine, droits de l\u2019homme et bio\u00e9thique, quel rapport?,\u201d Journal international de Bio\u00e9thique, <\/em>vol. 21, 2010\/4, 2014, pp. 51\u201359.<\/p>\n\n\n\n

6<\/a> P. Bonjour, \u201cLa dignit\u00e9 humaine, philosophie, droit, politique, \u00e9conomie, m\u00e9decine,\u201d \u00e0 partir de l\u2019ouvrage coordonn\u00e9 par Thomas De Koninck et Gilbert Larochelle, Reliance<\/em>, 2006\/2 no 20, 2006, pp. 85\u201392.<\/p>\n\n\n\n

7<\/a> P. Ricoeur, \u201cPour l\u2019\u00eatre humain du seul fait qu\u2019il est humain,\u201d in Jean-Fran\u00e7ois de Raymond (dir.), Les enjeux des droits de l\u2019homme<\/em>, Paris, Larousse, 1988, pp. 235\u2013236.<\/p>\n\n\n\n

8<\/a> J. M. Sauv\u00e9, Vice-pr\u00e9sident du Conseil d\u2019\u00c9tat Fran\u00e7ais, \u201cDignit\u00e9 humaine et juge administratif,\u201d discours, Rencontre Europ\u00e9ennes de Strasbourg, 27 Novembre 2009; X. Bioy, \u201cLes limites du \u2018renoncement\u2019 aux droits fondamentaux,\u201d in Le renoncement en droit public<\/em>, \u00e9dit\u00e9 par Nathalie Jacquinot, Presses de l\u2019Universit\u00e9 Toulouse Capitole, 2021.<\/p>\n\n\n\n

9<\/a> K. Van Assche, S. Sterckx, \u201cThe protection of human dignity in research involving human body material,\u201d in B. van Beers, L. Corrias, W. G. Werner (eds.) Humanity across International Law and Biolaw<\/em>. Cambridge University Press, 2014:265\u2013287, 2014; L. Floridi, \u201cOn Human Dignity as a Foundation for the Right to Privacy,\u201d Philos. Technol.,<\/em> vol.  29, 2016, pp. 307\u2013312; EU-RENEW, \u201cThe Foundations of EU personal data protection law: Privacy and Human Dignity,\u201d epub, 30 January 2024.<\/p>\n\n\n\n

10<\/a> C. Grewe, \u201cLa dignit\u00e9 de la personne humaine dans la jurisprudence de la Cour europ\u00e9enne des droits de l\u2019homme,\u201d Revue g\u00e9n\u00e9rale du droit<\/em>, \u00c9tudes et r\u00e9flexions 2014, num\u00e9ro 3, pp. 6\u20137.<\/p>\n\n\n\n

11<\/a> CoE, Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention of Human Rights – ECHR), Rome, 1950, as amended by Protocols Nos. 11 and 14 as from its entry into force on 1 June 2010.<\/p>\n\n\n\n

12<\/a> EU, Charter of Fundamental Rights of the European Union (CFREU), OJEC C 364\/1, 2000.<\/p>\n\n\n\n

13<\/a> EU, Explanations relating to the Charter of Fundamental Rights (2007\/C 303\/02), OJEU C 33\/17, 2007.<\/p>\n\n\n\n

14<\/a> UN OCHR, Press release, Universal Declaration of Human Rights at 70: 30 Articles on 30 Art. – Art. 12, 21 November 2018.<\/p>\n\n\n\n

15<\/a> ECtHR, Denisov v. Ukraine [GC], req.76639\/11, 2018, \u00a7 95; and ECtHR, S. Marper v. the United Kingdom [GC], req. 30562\/04 and 30566\/04, 2008, \u00a7 66.<\/p>\n\n\n\n

16<\/a> ECtHR, X&Y v. Netherlands, req.8978\/80, 1985.<\/p>\n\n\n\n

17<\/a> U. Kilkelly, \u201cLe droit au respect de la vie priv\u00e9e et familiale. Un guide sur la mise en \u0153uvre de l\u2019Art. 8 de la Convention europeenne des Droits de l’Homme,\u201d Conseil de l’Europe, 2003, p. 14.<\/p>\n\n\n\n

18<\/a> Nuremberg Code, 1945, Art. 1.<\/p>\n\n\n\n

19<\/a> WMA, Declaration of Helsinki – Ethical Principles for Medical Research Involving Human Subjects, adopted in 1964, last amended at the 75th WMA General Assembly, Helsinki, Finland, 2024.<\/p>\n\n\n\n

20<\/a> C. Byk, Chapter 1. \u201cThe revised Declaration of Helsinki: a new context and new challenges for biomedical research,\u201d in International Journal of Bioethics<\/em>, \u201cNew practices, new ethics in biomedical research,\u201d vol. 15, n\u00b0 1, 2004, pp. 17\u201330.<\/p>\n\n\n\n

21<\/a> H. Rosenau, C. Magnon, \u201cChapter 3. Legal prerequisites for clinical trials according to the revised Declaration of Helsinki and the European Convention on Human Rights and Biomedicine,\u201d in International Journal of Bioethics<\/em> \u201cNew practices, new ethics in biomedical research,\u201d vol. 15, n\u00b0 1, 2004, p. 48.<\/p>\n\n\n\n

22<\/a> UNESCO, Establishing Bioethics Committees, Guide n\u00b0 1, 2005.<\/p>\n\n\n\n

23<\/a> WMA, Declaration of Helsinki, op. cit.<\/em><\/p>\n\n\n\n

24<\/a> Ibid., general principles point 9.<\/p>\n\n\n\n

25<\/a> CoE, Convention on Human Rights and Biomedicine, European Treaty Series, No 164, Oviedo, 1997.<\/p>\n\n\n\n

26<\/a> E.g. regarding the rights to dignity and to the integrity of the person as established under the ECHR and the Oviedo Convention. CJEU, Netherlands v. European Parliament and Council, Case C-377\/98, 2001, ECR-I7079, point 70.<\/p>\n\n\n\n

27<\/a> CoE, Convention on Human Rights and Biomedicine, op. cit.<\/em>, Preamble.<\/p>\n\n\n\n

28<\/a> Ibid., Art. 1.<\/p>\n\n\n\n

29<\/a> CoE, Additional Protocol to the Convention on Human Rights and Biomedicine concerning Biomedical Research (APBR), no. 195, Strasbourg, 2005, Arts 21\u201323.<\/p>\n\n\n\n

30<\/a> CoE, Convention on Human Rights and Biomedicine, op. cit.<\/em>, Art. 10.<\/p>\n\n\n\n

31<\/a> Ibid., Art. 5 ; CoE, Art. 14 APBR, op. cit.<\/em><\/p>\n\n\n\n

32<\/a> CoE, Art.14 APBR, op. cit.<\/em><\/p>\n\n\n\n

33<\/a> Council for International Organisations of Medical Sciences, International Ethical Guidelines for Health Research Involving Human Participants, Geneva, 2016, guideline 22.<\/p>\n\n\n\n

34<\/a> UNESCO, Universal Declaration on Bioethics and Human Rights, op. cit.<\/em>, Art. 8.<\/p>\n\n\n\n

35<\/a> CFREU, op. cit.,<\/em> Art. 1.<\/p>\n\n\n\n

36<\/a> WMA, Declaration of Helsinki, op. cit. ; <\/em>CoE, Convention on Human Rights and Biomedicine, op. cit.<\/em><\/p>\n\n\n\n

37<\/a> J.-R. Trahan, \u201cThe Distinction Between Persons & Things: An Historical Perspective,\u201d J. Civ. L. Stud.,<\/em> 1, 2008.<\/p>\n\n\n\n

38<\/a> A. Mahalatchimy, E. Rial-Sebbag, V. Tournay, A. Faulkner, \u201cDoes the French Bioethics Law create a \u201amoral exception\u2018 to the use of human cells for health? A legal and organisational issue \u00bb. Dilemata: International Journal of Applied Ethics<\/em>, n\u00b0 7, 2011, pp. 17\u201337; A. Mahalatchimy, E. Rial-Sebbag, \u201cAvant-propos : Contexte et enjeux soulev\u00e9s par l\u2019encadrement des th\u00e9rapies innovantes \u00bb de l\u2019ouvrage A. Mahalatchimy, E. Rial-Sebbag (coord.), \u201cL\u2019Humain m\u00e9dicament,\u201d Quaderni<\/em>, 81, 2013, Maison des sciences de l\u2019homme (ed.), Paris, pp. 5\u201313.<\/p>\n\n\n\n

39<\/a> CoE, Recommendation CM\/Rec(2016)6 of the Committee of Ministers to member States on research on biological materials of human origin, adopted by the Committee of Ministers on 11 May 2016 at the 1256th meeting of the Ministers\u2019 Deputies.<\/p>\n\n\n\n

40<\/a> S. Minchin, J. Lodge, \u201cUnderstanding biochemistry: structure and function of nucleic acids,\u201d Essays Biochem, 63(4), 2019, pp. 433\u2013456.<\/p>\n\n\n\n

41<\/a> CoE, Convention on Human Rights and Biomedicine, op. cit.<\/em>, Art.16; CoE, Recommendation CM\/Rec(2016)6, op. cit.<\/em>, Art.4, Art.12(2)(a), 21(3).<\/p>\n\n\n\n

42<\/a> The EU Tissues and Cells Legislative Package composed of Directive 2004\/23\/EC and related Directives from 2006 and 2015.<\/p>\n\n\n\n

43<\/a> CoE, Convention on Human Rights and Biomedicine, op. cit.<\/em>, Art. 5; CoE, Art. 14 APBR, op. cit.<\/em><\/p>\n\n\n\n

44<\/a> Art.13 APBR op. ci<\/em>t.<\/p>\n\n\n\n

45<\/a> CoE, Convention on Human Rights and Biomedicine, op. cit.<\/em>, Art.22.<\/p>\n\n\n\n

46<\/a> CoE, Convention on Human Rights and Biomedicine, op. cit.<\/em>, Art.18.<\/p>\n\n\n\n

47<\/a> ECtHR, Case Vo v. France, req. n\u00b0 53924\/00, \u00a7 82. ECtHR Evans v. Royaume\u2011Uni, req. no 6339\/05, \u00a7 54\u201356, 2007.<\/p>\n\n\n\n

48<\/a> ECtHR Parrillo v. Italie, req. n\u00b0 46470\/11, \u00a7 159, 2015. Reaffirmed in ECtHR Baret et Caballero v. France, req. n\u00b0 22296\/20 and n\u00b0 37138\/20, 2023.<\/p>\n\n\n\n

49<\/a> G. Chassang, E. Rial-Sebbag, A. Cambon-Thomsen (2011). Chapitre 12. Les fondements de l’\u00e9thique de la recherche en droit communautaire. Journal International de Bio\u00e9thique<\/em>, 22, 185\u2013203; EGE, Ethical aspects of research involving the use of human embryo in the context of the 5th Framework Programme, 1998.<\/p>\n\n\n\n

50<\/a> Are excluded from EU funding the research activities intending to create human embryos solely for the purpose of research, or for the purpose of stem cell procurement (including by means of somatic cell nuclear transfer) and activities leading to the destruction of human embryos. The activities using human embryos or embryonic stem cells for human cloning for reproductive purposes or activities intended to modify, hereditably, the genetic make-up of an individual (apart from research rekating to cancer treatment of the gonads, which may be financed). The creation of human embryoids (artificial embryo) may raise complex\/serious issues necessitating a specific ethics assessment before funding. Where permitted by national laws, the EU can fund projects justifying the use of supernumerary human embryos generated through lawful medical reproductive procedures, subject to appropriate parental consent, competent authorities\u2019 authorisations and ethics approval. See EC, \u201cEU Grants: How to complete your ethics self-assessment,\u201d V2.0, 13 July 2021, pp. 4\u20137.<\/p>\n\n\n\n

51<\/a> EU, Regulation (EU) 2021\/695 of the European Parliament and of the Council of 28 April 2021 establishing Horizon Europe \u2013 the Framework Programme for Research and Innovation, laying down its rules for participation and dissemination, and repealing Regulations (EU) No 1290\/2013 and (EU) No 1291\/2013. Art.18. see also Art.14 of Model Grant Agreement, V1.1, 15 November 2021.<\/p>\n\n\n\n

52<\/a> CoE, Additional Protocol to the Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine, on the Prohibition of Cloning Human Beings (ETS 168), Paris, 12 January 1998; UNESCO, Report of IBC on human cloning and international governance, Annex. SHS\/EST\/CIB-16\/09\/CONF.503\/2 REV.2. Belgium, Sweden, Spain, UK allow therapeutic cloning.<\/p>\n\n\n\n

53<\/a> CoE, Additional Protocol on the Prohibition of Human Cloning, op. cit.<\/em>, Preamble.<\/p>\n\n\n\n

54<\/a> A. E. Omole, A. O. J. Fakoya, K. C. Nnawuba, \u201cCommon Ethical Considerations of Human-Induced Pluripotent Stem Cell Research,\u201d in K.H. Haider (eds) Handbook of Stem Cell Therapy<\/em>, Springer, 2022.<\/p>\n\n\n\n

55<\/a> E. Brenner, et al, \u201cThe legal and ethical framework for governing body donation in Europe \u2013 2nd update on current practice,\u201d Annals of Anatomy – Anatomischer Anzeiger<\/em>, Vol. 252, 2024, pp. 152\u2013195.<\/p>\n\n\n\n

56<\/a> D\u00e9cret n\u00b0 2022\u2013719 du 27 avril 2022 relatif au don de corps \u00e0 des fins d’enseignement m\u00e9dical et de recherche.<\/p>\n\n\n\n

57<\/a> Synth\u00e8se du rapport d\u00e9finitif IGAS N\u00b02019\u2013115R \/ IG\u00c9SR N\u00b02020\u2013028.<\/p>\n\n\n\n

58<\/a> C. Foster, \u201cDignity and the use of body parts,\u201d Journal of Medical Ethics<\/em>, 40(1), 2014, pp. 44\u201347.<\/p>\n\n\n\n

59<\/a> Even if a notion of \u201crelational dignity \u00bb which integrates privacy considerations while not impeding by default life-saving sales has been proposed in literature. D. Hershenov, \u201cSelf-ownership, relational dignity, and organ sales,\u201d Bioethics<\/em>, 2018.<\/p>\n\n\n\n

60<\/a> CoE, Convention on Human Rights and Biomedicine, op. cit.<\/em>, Art. 21.<\/p>\n\n\n\n

61<\/a> CoE, Convention against Trafficking in Human Organs (ETS 216), 2015.<\/p>\n\n\n\n

62<\/a> J. Pila, \u201cProperty in Human Body Parts: An Old Legal Question for a New Technological Age,\u201d in D. Orentlicher, and Tamara K. Hervey (eds), The Oxford Handbook of Comparative Health Law,<\/em> 2021.<\/p>\n\n\n\n

63<\/a> Mainly addressing issues in the field of police investigations, compulsory medical examinations and, much more scarcely, in scientific research.<\/p>\n\n\n\n

64<\/a> E.g. in R. Skloot, The immortal life of Henrietta Lacks<\/em>, 2010.<\/p>\n\n\n\n

65<\/a> B. Cl\u00e9ment , M. Yuille, K. Zaltoukal et al.<\/em> \u201cPublic biobanks: Calculation and recovery of costs,\u201d Sci. Transl. Med<\/em>., 6, 261fs45, 2014.<\/p>\n\n\n\n

66<\/a> EU, Directive 98\/44\/EC of the European Parliament and of the Council of 6 July 1998 on the legal protection of biotechnological inventions. OJ L<\/em> 213\/3. 30 July 1998.<\/p>\n\n\n\n

67<\/a> P. Cole, \u201cPatentability of genes: a European Union perspective \u00bb Cold Spring Harb Perspect Med.,<\/em> 2014, 16;5(5):a020891. PMID: 25324232; PMCID: PMC4448586.<\/p>\n\n\n\n

68<\/a> CJEU, Oliver Br\u00fcstle v Greenpeace e.V. Case C-34\/10, 18 October 2011.<\/p>\n\n\n\n

69<\/a> As required under the EU Directive 98\/44\/EC op. cit.<\/em>, Art.6.<\/p>\n\n\n\n

70<\/a> M. G. Nielen, S. A. de Vries, N. Geijsen, \u201cEuropean stem cell research in legal shackles,\u201d EMBO J.<\/em>, 32(24):3, 2013, pp. 07\u201311.<\/p>\n\n\n\n

71<\/a> A. Kamperman Sanders, S. Bostyn,, H. Iserentant et al.<\/em>, \u201cFinal Report of the Expert Group on the development and implications of patent law in the field of biotechnology and genetic engineering,\u201d European Commission, 2016, pp. 138\u2013146.<\/p>\n\n\n\n

72<\/a> R. Manzocco (ed. Springer), Transhumanism \u2013 Engineering the Human Condition (History, Philosophy and Current Status)<\/em>, doi:10.1007\/978\u20133-030\u201304958-4, 2019.<\/p>\n\n\n\n

73<\/a> E.g. Neuralink’s clinical trial is called PRIME \u2014 for Precise Robotically Implanted Brain-Computer Interface. See: B. Chappell, \u201cWhat do we know about Elon Musk\u2019s Neuralink, which put an implant into a human brain.\u201d NPR<\/em>., 30, 2024.<\/p>\n\n\n\n

74<\/a> K. Kostick-Quenet , L. Kalwani, B. Koenig et al.,<\/em> \u201cResearchers’ Ethical Concerns About Using Adaptive Deep Brain Stimulation for Enhancement,\u201d Front Hum Neurosci.<\/em> 16:813922, 2022.<\/p>\n\n\n\n

75<\/a> W. Wiewi\u00f3rowski, \u201cCan We Trust Our Artificial Eyes?,\u201d EDPS epub<\/em>, 2019; SIENNA, Ethics Guidelines for Human Enhancement, 2021.<\/p>\n\n\n\n

76<\/a> SIENNA, Ethical Guidance for Research with Potential for Human Enhancement, 2021.<\/p>\n\n\n\n

77<\/a> K. Aky\u00fcz, G. Chassang, M. Goisauf et al.,<\/em> \u201cBiobanking and risk assessment: a comprehensive typology of risks for an adaptive risk governance,\u201d Life Sci Soc Policy<\/em> 17, 10, 2021. https:\/\/doi.org\/10.1186\/s40504\u2013021-00117\u20137<\/p>\n\n\n\n

78<\/a> WMA Declaration of Helsinki, op. cit.<\/em>, point 24.<\/p>\n\n\n\n

79<\/a> WMA Declaration of Taipei on Research on Health Databases, Big Data and Biobanks, 2016, point 4.<\/p>\n\n\n\n

80<\/a> CoE, Recommendation CM\/Rec(2016)6, op. cit.<\/em><\/p>\n\n\n\n

81<\/a> L. Floridi (ed. Oxford University Press UK), The ethics of information.<\/em> 1st ed. 2013; L. Floridi, \u201cDistributed morality in an information society,\u201d Science and Engineering Ethics,<\/em> 19(3), 2013, pp. 727\u2013743.<\/p>\n\n\n\n

82<\/a> EC, Proposal for a Regulation of the European Parliament and of the Council laying down Union procedures for the authorisation and supervision of medicinal products for human use and laying down rules governing the European Medicines Agency, amending Regulation (EC) No 1394\/2007 and Regulation (EU) No 536\/2014 and repealing Regulation (EC) No 726\/2004, Regulation (EC) No 141\/2000 and Regulation (EC) No 1901\/2006, COM(2023) 193 final, 2023\/0131 (COD), Brussels, April 26, 2023, p. 38.<\/p>\n\n\n\n

83<\/a> M. B. Lavagnino, \u201cInformation Privacy Revealed,\u201d Educause Review<\/em>, 28 January 2013. First, authors define it as \u201cthe claim of individuals, groups, or institutions to determine when, how and to what extent information about them is communicated to others.\u201d Second, it is defined as \u201cthe appropriate use of personal information under the circumstances. What is appropriate will depend on context, law, and the individual’s expectations; also, [privacy is] the right of an individual to control the collection, use, and disclosure of personal information.\u201d Third, \u201cprivacy involves the policies, procedures, and other controls that determine which personal information is collected, how it is used, with whom it is shared, and how individuals who are the subject of that information are informed and involved in this process.\u201d<\/p>\n\n\n\n

84<\/a> L. Floridi, \u201cOn human dignity as a foundation for the right to privacy,\u201d Philosophy and Technology. <\/em>doi: 10.1007\/s13347\u2013016-022, 2016.<\/p>\n\n\n\n

85<\/a> EHNE, \u201cEurope and cyberspace \u2013 Data protection, Cyberspace and the Need for the EU General Data Protection Regulation (GDPR),\u201d Digital Encyclopedia of European History<\/em> (Accessed on 25 September 2024).<\/p>\n\n\n\n

86<\/a> CoE, Convention for the protection of individuals with regard to the processing of personal data, CETS n\u00b0 108, 1981.<\/p>\n\n\n\n

87<\/a> CoE, Convention 108+ for the protection of individuals with regard to the processing of personal data, 2018.<\/p>\n\n\n\n

88<\/a> EU, Directive 95\/46\/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. OJ L<\/em> 281\/31.<\/p>\n\n\n\n

89<\/a> EU, Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation \u2013 \u201cGDPR \u00bb), OJ L<\/em> 119\/1.<\/p>\n\n\n\n

90<\/a> Art. 25 APBR, op. cit.<\/em><\/p>\n\n\n\n

91<\/a> ECtHR, Rotaru v Romania judgment, req. no. 28341\/95, 4 May 2000.<\/p>\n\n\n\n

92<\/a> ECtHR, Grand Chamber, S. and Marper v\/ United Kingdom, req. n\u00b0 30562\/04 and 30566\/04, 4 December 2008.<\/p>\n\n\n\n

93<\/a> G. Chassang, \u201cThe impact of the EU general data protection regulation on scientific research,\u201d ecancer<\/em> 11 709 \/ doi: 10.3332\/ecancer.2017.709, 2017; F. Lesaulnier, \u201cRecherche en sant\u00e9 et protection des donn\u00e9es personnelles \u00e0 l\u2019heure du R\u00e8glement g\u00e9n\u00e9ral relatif \u00e0 la protection des donn\u00e9es,\u201d M\u00e9decine & Droit<\/em>, vol.  142, Issue 40, 10\/2018, pp. 103\u2013111.<\/p>\n\n\n\n

94<\/a> R. Gellert, The Risk-Based Approach to Data Protection<\/em>, Oxford University Press, 2020, pp. 160\u2013163.<\/p>\n\n\n\n

95<\/a> Art.29 Statement on the role of a risk-based approach in data protection legal frameworks, 2014.<\/p>\n\n\n\n

96<\/a> G. Chassang, \u201cWhat About Post-Mortem Digital Privacy and Personal Health Data Protection ?,\u201d In : Deep diving into data protection.<\/em> Ed. CRIDS, 2021, pp. 433\u2013460.<\/p>\n\n\n\n

97<\/a> CoE, European Court of Human Rights, European Data Protection Supervisor, European Union Agency for Fundamental Rights (ed. Publications Office of the European Union), Handbook on European data protection law \u2013 2018 edition<\/em>, epub, 2018.<\/p>\n\n\n\n

98<\/a> CoE, Recommendation CM\/Rec(2019)2, Protection of health-related data, 2019.<\/p>\n\n\n\n

99<\/a> Art.9(2) GDPR op. cit.<\/em><\/p>\n\n\n\n

100<\/a> EC, Consumers, Health, Agriculture and Food Executive Agency, J. Hansen, P. Wilson, E. Verhoeven, M. Kroneman et al.<\/em>, Study \u201cAssessment of the EU Member States\u2019 rules on health data in the light of GDPR,\u201d Publications Office, 2021.<\/p>\n\n\n\n

101<\/a> Art.9(4) GDPR op. ci<\/em>t.<\/p>\n\n\n\n

102<\/a> S. Wiertz, J. Boldt, \u201cEthical, Legal, and Practical Concerns Surrounding the Implemention of New Forms of Consent for Health Data Research: Qualitative Interview Study,\u201d J Med Internet Res<\/em>, 2024;26:e52180, 2024; S. Wiertz, \u201cHow to Design Consent for Health Data Research? An Analysis of Arguments of Solidarity,\u201d Public Health Ethics<\/em>, Volume 16, Issue 3, 2023, pp. 261\u2013270.<\/p>\n\n\n\n

103<\/a> D. Hallinan, \u201cBroad consent under the GDPR: an optimistic perspective on a bright future,\u201d Life Sciences, Society and Policy,<\/em> vol.  16:1, 2020.<\/p>\n\n\n\n

104<\/a> Art.9(2)(a) GDPR op. cit.<\/em><\/p>\n\n\n\n

105<\/a> Art.13 and 14 GDPR op. cit.<\/em><\/p>\n\n\n\n

106<\/a> Recital 33 GDPR. See also, EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, point 4, 2021.<\/p>\n\n\n\n

107<\/a> EC, Proposal for a Regulation on the European Health Data Space, COM\/2022\/197 final, 3 May 2022.<\/p>\n\n\n\n

108<\/a> This presumption of research purpose compatibility for further processing personal data is also recognised in the CoE Convention 108+. See the Handbook on European data protection law, op. cit.<\/em>,p. 124\u2013125.<\/p>\n\n\n\n

109<\/a> Art.89(1) GDPR op. ci<\/em>t.<\/p>\n\n\n\n

110<\/a> Art.5(2) GDPR op. ci<\/em>t.<\/p>\n\n\n\n

111<\/a> Art.25 GDPR op. ci<\/em>t.<\/p>\n\n\n\n

112<\/a> EDPB, Guidelines 03\/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, 2020. R. Becker, A. Thorogood, J. Ordish, M. J. S. Beauvais, \u201cCOVID-19 Research: Navigating the European General Data Protection Regulation,\u201d J Med Internet Res., <\/em>22(8):e19799, 2020. A. Delfin-Rossaro, G. Chassang, E. Rial-Sebbag, \u201cOutils algorithmiques et crises sanitaires: Enjeux \u00e9thico-juridiques et recommandations,\u201d Droit, Sant\u00e9 et Soci\u00e9t\u00e9<\/em>, 2\u20133, 2022, pp. 61\u201368.<\/p>\n\n\n\n

113<\/a> EDPB, Statement on restrictions on data subject rights in connection to the state of emergency in Member States, 2020; EDPB, Guidelines 10\/2020 on restrictions under Art. 23 GDPR, Version 2.0, 2021.<\/p>\n\n\n\n

114<\/a> EC, Study \u201cAssessment of the EU Member States\u2019 rules on health data in the light of GDPR,\u201d op. cit.<\/em><\/p>\n\n\n\n

115<\/a> Recital 26 GDPR op. cit<\/em>., These provisions raised questions in the field of scientific research where there are considerable means and expertise involved in projects to perform high-level complex data processing and investigations which could allow (re)identifying data subjects.<\/p>\n\n\n\n

116<\/a> Art.29 Data Protection Working Party, Opinion 05\/2014 on Anonymisation Techniques, Adopted on 10 April 2014, 0829\/14\/EN WP2016.<\/p>\n\n\n\n

117<\/a> Non-individualisation: it must no longer be possible to re-identify and isolate an individual from the anonymised dataset; Non-correlation: it must no longer be possible to establish links between different data concerning the same individual; and Non-inference: it must no longer be possible to deduce information linked to an individual.<\/p>\n\n\n\n

118<\/a> S. Ayme, R. Choquet, L. Devillers et al.<\/em>, \u201cB\u00e9n\u00e9fices et risques de l’utilisation des donn\u00e9es de sant\u00e9 \u00e0 des fins de recherche: Rapport du Conseil scientifique Consultatif du Health Data Hub,\u201d 2023, hal-04345572, p. 14; C. Villani, \u201cGiving meaning to artificial intelligence. Pour une strat\u00e9gie nationale et europ\u00e9enne,\u201d Report, 2018, pp. 224; H. Tanghe, P. O. Gibert, \u201cL\u2019enjeu de l\u2019anonymisation \u00e0 l\u2019heure du big data,\u201d RFAS, <\/em>4, 2017, pp. 79\u201393.<\/p>\n\n\n\n

119<\/a> Health Data Hub, \u201cGuide – What is anonymous health data,\u201d epub, p. 4.<\/p>\n\n\n\n

120<\/a> M. Shabani, L. Marelli, \u201cRe-identifiability of genomic data and the GDPR,\u201d EMBO Reports, <\/em>20:e48316, 2019.<\/p>\n\n\n\n

121<\/a> EDPB, Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, Q18, 2021.<\/p>\n\n\n\n

122<\/a> K. Aky\u00fcz, M. Goisauf, G. Chassang et al.<\/em>, \u201cPost-identifiability in changing sociotechnological genomic data environments,\u201d Biosocieties, <\/em>vol.  19, 2023, pp. 204\u2013231.<\/p>\n\n\n\n

123<\/a> CNIL, \u201cQu\u2019est-ce qu\u2019une donn\u00e9e de sant\u00e9 ?,\u201d epub, 2018.<\/p>\n\n\n\n

124<\/a> A. Thorogood, Y. Joly, B.M. Knoppers, et al.<\/em>, \u201cAn implementation framework for the feedback of individual research results and incidental findings in research,\u201d BMC Med Ethics<\/em>, 15, 88, 2014.<\/p>\n\n\n\n

125<\/a> CoE, Recommendation CM\/Rec(2006)4, op. cit.<\/em>, Explanatory Memorandum, point 6.<\/p>\n\n\n\n

126<\/a> EU, CFREU, op. cit.<\/em>, Art.21(1).<\/p>\n\n\n\n

127<\/a> CoE, Declaration Decl(13\/02\/2019)1 on the manipulative capabilities of algorithmic processes, 2019.<\/p>\n\n\n\n

128<\/a> J. Lennie, J. Fisher, M. R. Gastonguay, \u201cTrends in the application of pharmacometric modeling and simulation in the development of the Orphan Drugs in the 21st century,\u201d Journal of Pharmacokinetics and Pharmacodynamics<\/em>, n\u00b0 42, 2015.<\/p>\n\n\n\n

129<\/a> A. Bajard, S. Chabaud, C. Cornu, et al., \u201cAn in silico approach helped to identify the best experimental design, population, and outcome for future randomized clinical trials,\u201d Journal of Clinical Epidemiology<\/em>, 2015.<\/p>\n\n\n\n

130<\/a> M. Grieves, \u201cDigital Twin: Manufacturing excellence through Virtual Factory Replication,\u201d White Paper, Florida Institute of Technology, 2014, p. 7.<\/p>\n\n\n\n

131<\/a> A virtual human twin (VHT) is a digital representation of a human health or disease state. They refer to different levels of human anatomy (e.g. cells, tissues, organs or organ systems). VHTs are built using software models and data and are designed to mimic and predict behaviour of their physical counterparts, including interaction with additional diseases a person may have, European Virtual Twins Initiative<\/em>, epub (Accessed on 25 September 2024).<\/p>\n\n\n\n

132<\/a> M. Elliot, A. Hundepool, E. Schulte Nordholt, J.-L. Tambay, T. Wende, Glossary ion Statistical Disclosure Control<\/em>, epub: website Statistical Disclosure Control, May 2009: \u201cSynthetic data: An approach to confidentiality where instead of disseminating real data, synthetic data that have been generated from one or more population models are released\u201d.<\/p>\n\n\n\n

133<\/a> K. Bhanot, M. Qi, J. S. Erickson, I. Guyon, P. Bennett, \u201cThe Problem of Fairness in Synthetic Healthcare Data\u201d, Entropy <\/em>(Basel), no.23, September 2021, pp. 1165.<\/p>\n\n\n\n

134<\/a> Ibid.<\/p>\n\n\n\n

135<\/a> F. Lesaulnier, \u201cValorisation de la recherche en sant\u00e9 humaine et protection des donn\u00e9es \u00e0 l\u2019\u00e8re du num\u00e9rique,\u201d M\u00e9decine & Droit<\/em>, 2023, p. 22.<\/p>\n\n\n\n

136<\/a> A. Voillemet, \u201cL\u2019usage de la donn\u00e9e m\u00e9dicale. Contribution \u00e0 l\u2019\u00e9tude du droit des donn\u00e9es,\u201d th\u00e8se en droit, Universit\u00e9 Polytechnique Hauts-de-France, Institut national des sciences appliqu\u00e9es Hauts-de-France, 2022, p. 294.<\/p>\n\n\n\n

137<\/a> C. Ohman & L. Floridi, \u201cThe Political Economy of Death in the Age of Information: A Critical Approach to the Digital Afterlife Industry,\u201d Minds and Machines,<\/em> 27, 2017, p. 639\u2013662.<\/p>\n\n\n\n

138<\/a> B. Jim\u00e9nez-Alonso, I. Bresc\u00f3 de Luna, \u201cGriefbots. A New Way of Communicating With The Dead?,\u201d Integr. psych. behav.,<\/em> 57, 2023, pp. 466\u2013481; B. Jim\u00e9nez-Alonso, I. Bresc\u00f3 de Luna, \u201cChapter 9 – AI and grief: a prospective study on the ethical and psychological implications of deathbots,\u201d In S. Caball\u00e9, J. Casas-Roma, J. Conesa (eds.), Intelligent Data-Centric Systems, Ethics in Online AI-based Systems,<\/em> Cap. 9, pp. 175\u2013191.<\/p>\n\n\n\n

139<\/a> CNIL, Fiches pratiques IA. 2024.<\/p>\n\n\n\n

140<\/a> OECD, Creation and Governance of Human Genetic Research Databases, \u00c9ditions OCDE, Paris, 2006.<\/p>\n\n\n\n

141<\/a> OECD Guidelines on Human Biobanks and Genetic Research Databases, 2009.<\/p>\n\n\n\n

142<\/a> Art. 89(2) GDPR op. cit.<\/em><\/p>\n\n\n\n

143<\/a> Recital 156 and Art. 89(1) GDPR op. ci<\/em>t.<\/p>\n\n\n\n

144<\/a> Art. 5(1)(c) GDPR, op. cit.,<\/em> on data minimisation, requires that personal data processed is adequate, relevant and limited to what is necessary in relation to the purposes of the processing. Specific issues can be raised in biomedical research, particularly where whole human genome sequencing technologies are used. Independent ethics review of research projects and infrastructures, together with data protection officers assessment, are implemented to decide, case-by-case, about the respect of data minimisation and other applicable legal and ethical requirements.<\/p>\n\n\n\n

145<\/a> Art.89(1) GDPR op. ci<\/em>t.<\/p>\n\n\n\n

146<\/a> Such as Data Transfert Agreement, Material Transfert Agreement.<\/p>\n\n\n\n

147<\/a> C. Staunton, S. Slokenberga, A. Parziale and D. Mascalzoni, \u201cAppropriate Safeguards and Art. 89 of the GDPR: Considerations for Biobank, Databank and Genetic Research,\u201d Front. Genet.,<\/em> 13:719317, 2022, p. 9.<\/p>\n\n\n\n

148<\/a> Such governance measures rely on the use of technological means, such as privacy enhancing technologies (PETs) enabling the controller to create and secure data, the processing environment, to control privacy and data breach risks based on data protection impact assessment, and on organisational means, in particular to ensure data access controls, reviews, and transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing features.<\/p>\n\n\n\n

149<\/a> European Data Protection Supervisor, Study on the appropriate safeguards under Art. 89(1) GDPR for the processing of personal data for scientific research, 2019.<\/p>\n\n\n\n

150<\/a> EU, Regulation (EU) 2022\/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018\/1724 (Data Governance Act), Recital 7 : \u201cThere are techniques enabling analyses on databases that contain personal data, such as anonymisation, differential privacy, generalisation, suppression and randomisation, the use of synthetic data or similar methods and other state-of-the-art privacy-preserving methods that could contribute to a more privacy-friendly processing of data \u00bb.<\/p>\n\n\n\n

151<\/a> Art. 35 GDPR, op. cit.<\/em><\/p>\n\n\n\n

152<\/a> Art. 40 GDPR, op. cit.<\/em><\/p>\n\n\n\n

153<\/a> Art. 37(1)c GDPR, op. cit.<\/em><\/p>\n\n\n\n

154<\/a> Notably through the legislative measures provided for this purpose, namely: the EU Data Governance Act, op. cit.<\/em> ; the EU Data Act, Regulation (EU) 2023\/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017\/2394 and Directive (EU) 2020\/1828, OJ L<\/em>, 2023\/2854, 2023 ; the EU Digital Markets Act, Regulation (EU) 2022\/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019\/1937 and (EU) 2020\/1828, OJ L<\/em> 265, 2022, pp. 1\u201366 ; the EU Digital Services Act, Regulation (EU) 2022\/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000\/31\/EC, OJ L<\/em> 277, 27.10.2022, pp. 1\u2013102 ; and in particular the recently adopted Regulation (EU) 2025\/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011\/24\/EU and Regulation (EU) 2024\/2847 (EHDSR).<\/p>\n\n\n\n

155<\/a> Recital 93, EHDSR, op. cit<\/em>.<\/p>\n\n\n\n

156<\/a> Art. 71, EHDSR, op. cit.<\/em><\/p>\n\n\n\n

157<\/a> Art. 58(1), EHDSR, op. cit.<\/em><\/p>\n\n\n\n

158<\/a> Including genetic, epigenomic and genomic data; molecular data such as proteomic and other omic data; data from wellness applications; health data from biobanks and associated databases (article 51(4) EHDSR, op. cit.<\/em>).<\/p>\n\n\n\n

159<\/a> Art. 71(4) EHDSR, op. cit<\/em>.<\/p>\n\n\n\n

160<\/a> The data user must provide a justification (art. 67(2)e EHDSR, op. cit.<\/em>).<\/p>\n\n\n\n

161<\/a> Art. 73 EHDSR, op. cit<\/em>.<\/p>\n\n\n\n

162<\/a> National health data access bodies will have to cooperate with all the stakeholders concerned, including patients\u2019 organisations, representatives of natural persons, health professionals, researchers and ethics committees (art. 57(2)b EHDSR, op. cit.<\/em>). Also, at national level, certain actors may be legally recognised as trusted health data holders if they comply with the requirements of the EHDSR. This status will enable them to assess requests for access to the health data they hold (art. 72 EHDSR, op. cit.<\/em>). National bodies will also collaborate with the data altruism organisations created by the DGA (Chap. IV DGA op.<\/em> cit.<\/em>; Recital 78 EHDSR). At European level, the Stakeholder Forum should enable the views of stakeholders to be taken into consideration, including in particular representatives of patient organisations (art. 93 EHDSR, op. cit<\/em>.).<\/p>\n\n\n\n

163<\/a> M. Wilkinson, M. Dumontier, I. Aalbersberg, et al.<\/em> \u201cThe FAIR Guiding Principles for scientific data management and stewardship,\u201d Sci Data,<\/em> 3, 160018, 2016.<\/p>\n\n\n\n

164<\/a> Such as dynamic consent, meta-consent, broad consent or layered consent.<\/p>\n\n\n\n

165<\/a> T. Ploug, and H. S\u00f8ren, \u201cMeta Consent \u2013 A Flexible Solution to the Problem of Secondary Use of Health Data,\u201d Bioethics<\/em>, vol.  30,9, 2016, pp. 721\u2013732.<\/p>\n\n\n\n

166<\/a> S. N. Boers, Johannes J. M. van Delden, and A. L. Bredenoord, \u201cBroad Consent Is Consent for Governance,\u201d American Journal of Bioethics<\/em>, 15 (9), 2015, pp. 53\u201355.<\/p>\n\n\n\n

167<\/a> A. Noor Giesbertz, L. Annelien Bredenoord, J.M. Johannes van Delden, \u201cA Thick Opt-Out Is Often Sufficient,\u201d American Journal of Bioethics<\/em>, 13:4, 2013, pp. 44\u201346.<\/p>\n\n\n\n

168<\/a> A transparency portal is an online tool designed to provide clear and accessible information on how an organisation processes and uses personal data, particularly in the field of health and medical research. In this way, the tool makes it easier for data subjects to exercise their rights.<\/p>\n\n\n\n

169<\/a> Y. Joly, S. O. M. Dyke, B. M. Knoppers, T. Pastinen, \u201cAre Data Sharing and Privacy Protection Mutually Exclusive?,\u201d Cell.<\/em>, 167(5):1150\u20131154, 2016, pp. 1151 : \u201cControlled access uses an access agreement, overseen by an access committee, to make data availability conditional upon the researchers identifying themselves and agreeing to a number of conditions on data usage. Because controlled access is regarded as a form of open access, these conditions should be kept to the minimum necessary to ensure that participants’ data are reasonably well protected from re-identification \u00bb. This is the approach that seems to have been adopted by the proposed regulation on the European Health Data Space, op. cit.<\/em>, even raising questions about the interplay between this future regulation and the provisions of the GDPR, op. cit<\/em>.<\/p>\n\n\n\n

170<\/a> WHO, Sharing and reuse of health-related data for research purposes: WHO policy and implementation guidance. Geneva: World Health Organization, 2022.<\/p>\n\n\n\n

171<\/a> J. E. Cohen, \u201cTurning Privacy Inside Out,\u201d Theoretical Inquiries in L<\/em>aw, vol.  20.1, 2018.<\/p>\n\n\n\n

172<\/a> Such as ethics committees opinions, imposed processing conditions, prohibition of re-identification of data, use of secure processing environments, data protection impact assessment, etc.<\/p>\n\n\n\n

173<\/a> \u201cThe term \u2018common\u2019 comes from the Latin noun munus, muneris<\/em> meaning gift, obligation or function. Common goods can be represented as shared goods, like a co-ownership or a planet (R\u00e9mon, 2020: 1), whose use and governance are managed by a community (Villani et al.<\/em>, 2018: 14; Bollier, 2014),\u201d translated from French,inA-S Hulin, E. Guiraud, J. Lawar\u00e9e and L. Langlois, \u201cLe partage et la mise en commun des donn\u00e9es de sant\u00e9 : quels enjeux pour un objectif d’innovation sociale responsable ?,\u201d \u00c9thique publique<\/em> [En ligne], vol.  25, no. 1, 2023, p. 12.<\/p>\n\n\n\n

174<\/a> \u201cThis would be a third category of property alongside private property and public property (Emerich, 2021: 222; Benyekhlef, 2020: 315),\u201d translated from French, Ibid.<\/p>\n\n\n\n

175<\/a> Ibid.<\/p>\n\n\n\n

176<\/a> Such as data trusts, data cooperatives, data marketplaces or data unions.<\/p>\n\n\n\n

177<\/a> M. Micheli, E. Farrell, B. Carballa Smichowski, M. Posada Sanchez, S. Signorelli and M. Vespe, \u201cMapping the landscape of data intermediaries,\u201d Publications Office of the European Union<\/em>, Luxembourg, 2023, doi:10.2760\/8943, JRC133988.<\/p>\n\n\n\n

178<\/a> Ibid.<\/p>\n\n\n\n

179<\/a> The Data Governance Act, op. cit.<\/em>, has defined different types of data-sharing intermediaries with inclusive governance arrangements, making it possible to institute players in the non-personal and personal data-sharing landscape that enable sharing in line with the interests of the various interests at stake, according to two models: data intermediation services (Art. 10) providing for commercial relationships, and altruistic data organisations (Chapter IV) based on the general interest.<\/p>\n\n\n\n

180<\/a> \u201cData, and the knowledge derived from the use of that data, should be recognized as a global public good, and data-sharing and data reuse should be maximized in ways that are effective, ethical and equitable in order to improve public health,\u201d WHO, Sharing and reuse of health-related data for research purposes, op. cit., <\/em>p. 1.<\/p>\n\n\n\n

181<\/a> I. Coulybaly, \u201cLa protection des donn\u00e9es \u00e0 caract\u00e8re personnel dans le domaine de la recherche scientifique,\u201d Th\u00e8se en droit, University of Grenoble, 2011.<\/p>\n\n\n\n

182<\/a> D. Bourcier, P. De Filippi, \u201cVers un droit collectif sur les donn\u00e9es de sant\u00e9,\u201d Revue de droit sanitaire et social (RDSS)<\/em>, Dalloz Revues, n. 3, 2018, pp. 445.<\/p>\n\n\n\n

183<\/a> Op. cit.<\/em><\/p>\n\n\n\n

184<\/a> \u201c[. . .] all data sharing should balance and protect the privacy of individuals and the dignity of communities while acknowledging the imperative to improve public health through the most productive use of data,\u201d p. 1<\/p>\n\n\n\n

185<\/a> D. Lin, J. Crabtree, I. Dillo, et al., \u201cThe TRUST Principles for digital repositories,\u201d Sci Data,<\/em> 7, 144, 2020; S. R. Carroll, et al., \u201cThe CARE Principles for Indigenous Data Governance,\u201d Data Science Journal<\/em>, 19, 2020, p. 1\u201312.<\/p>\n\n\n\n

\n\n\n\n
Evolving-Concept-of-Privacy-in-European-Law_G.-Chassang_L.-Feriol_N.-Dubruel-07-25<\/a><\/a><\/div>\n\n\n\n

Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel, \u00ab The Evolving Concept of Privacy in European Law. Addressing Specific Challenges for Advancing Biomedical Research and Innovation \u00bb, D\u00e9finitions et concepts du biodroit [Dossier], Confluence des droits_La revue <\/em>[En ligne], 07 | 2025, mis en ligne le 7 juillet 2025. URL : https:\/\/confluencedesdroits-larevue.com\/?p=4182<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Gauthier Chassang Lawyer, Inserm, CERPOP UMR1295 (Inserm and University of Toulouse Paul\u00a0Sabatier), Genotoul Societal Platform, Toulouse (GIS Genotoul) | Lisa Feriol PhD Student in law, Inserm, CERPOP UMR1295 (Inserm and University of\u00a0Toulouse Paul\u00a0Sabatier), Ekitia (Not-for-profit data sharing organisation) | No\u00e9mie Dubruel PhD Student in law, Inserm, CERPOP UMR1295 (Inserm and University of\u00a0Toulouse Paul Sabatier)<\/p>\n","protected":false},"author":2,"featured_media":4269,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_editorskit_title_hidden":false,"_editorskit_reading_time":0,"_editorskit_is_block_options_detached":false,"_editorskit_block_options_position":"{}","footnotes":""},"categories":[5,3,13],"tags":[501,494,504,503,502,497,500],"yoast_head":"\nGauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation - Confluence des droits_La revue<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/confluencedesdroits-larevue.com\/?p=4182\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation - Confluence des droits_La revue\" \/>\n<meta property=\"og:description\" content=\"Gauthier Chassang Lawyer, Inserm, CERPOP UMR1295 (Inserm and University of Toulouse Paul\u00a0Sabatier), Genotoul Societal Platform, Toulouse (GIS Genotoul) | Lisa Feriol PhD Student in law, Inserm, CERPOP UMR1295 (Inserm and University of\u00a0Toulouse Paul\u00a0Sabatier), Ekitia (Not-for-profit data sharing organisation) | No\u00e9mie Dubruel PhD Student in law, Inserm, CERPOP UMR1295 (Inserm and University of\u00a0Toulouse Paul Sabatier)\" \/>\n<meta property=\"og:url\" content=\"https:\/\/confluencedesdroits-larevue.com\/?p=4182\" \/>\n<meta property=\"og:site_name\" content=\"Confluence des droits_La revue\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-10T14:53:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-10T14:53:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/confluencedesdroits-larevue.com\/wp-content\/uploads\/2025\/06\/pexels-steve-1509534-1-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1863\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"DICE \u00c9ditions\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"DICE \u00c9ditions\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"75 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/?p=4182#article\",\"isPartOf\":{\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/?p=4182\"},\"author\":{\"name\":\"DICE \u00c9ditions\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/person\/5c2bef570684d183d7f5a81e4107304c\"},\"headline\":\"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation\",\"datePublished\":\"2025-07-10T14:53:06+00:00\",\"dateModified\":\"2025-07-10T14:53:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/?p=4182\"},\"wordCount\":14112,\"publisher\":{\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#organization\"},\"keywords\":[\"biolaw\",\"biomedical innovation\",\"European law\",\"health research\",\"informational privacy\",\"legal concept\",\"privacy\"],\"articleSection\":[\"Actu\",\"Articles\",\"Dossier\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/?p=4182\",\"url\":\"https:\/\/confluencedesdroits-larevue.com\/?p=4182\",\"name\":\"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation - Confluence des droits_La revue\",\"isPartOf\":{\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#website\"},\"datePublished\":\"2025-07-10T14:53:06+00:00\",\"dateModified\":\"2025-07-10T14:53:07+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/?p=4182#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/confluencedesdroits-larevue.com\/?p=4182\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/?p=4182#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/confluencedesdroits-larevue.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#website\",\"url\":\"https:\/\/confluencedesdroits-larevue.com\/\",\"name\":\"Confluence des droits_La revue\",\"description\":\"UMR 7318 Droits International, Compar\u00e9 et Europ\u00e9en\",\"publisher\":{\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/confluencedesdroits-larevue.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#organization\",\"name\":\"Confluence des droits_La revue\",\"url\":\"https:\/\/confluencedesdroits-larevue.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/confluencedesdroits-larevue.com\/wp-content\/uploads\/2024\/05\/Confluence-des-droits_La-revue.png\",\"contentUrl\":\"https:\/\/confluencedesdroits-larevue.com\/wp-content\/uploads\/2024\/05\/Confluence-des-droits_La-revue.png\",\"width\":3934,\"height\":613,\"caption\":\"Confluence des droits_La revue\"},\"image\":{\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/person\/5c2bef570684d183d7f5a81e4107304c\",\"name\":\"DICE \u00c9ditions\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c7dfd2401bef8b8be87ab2a215ca0435?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c7dfd2401bef8b8be87ab2a215ca0435?s=96&d=mm&r=g\",\"caption\":\"DICE \u00c9ditions\"},\"url\":\"https:\/\/confluencedesdroits-larevue.com\/?author=2\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation - Confluence des droits_La revue","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/confluencedesdroits-larevue.com\/?p=4182","og_locale":"fr_FR","og_type":"article","og_title":"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation - Confluence des droits_La revue","og_description":"Gauthier Chassang Lawyer, Inserm, CERPOP UMR1295 (Inserm and University of Toulouse Paul\u00a0Sabatier), Genotoul Societal Platform, Toulouse (GIS Genotoul) | Lisa Feriol PhD Student in law, Inserm, CERPOP UMR1295 (Inserm and University of\u00a0Toulouse Paul\u00a0Sabatier), Ekitia (Not-for-profit data sharing organisation) | No\u00e9mie Dubruel PhD Student in law, Inserm, CERPOP UMR1295 (Inserm and University of\u00a0Toulouse Paul Sabatier)","og_url":"https:\/\/confluencedesdroits-larevue.com\/?p=4182","og_site_name":"Confluence des droits_La revue","article_published_time":"2025-07-10T14:53:06+00:00","article_modified_time":"2025-07-10T14:53:07+00:00","og_image":[{"width":2560,"height":1863,"url":"https:\/\/confluencedesdroits-larevue.com\/wp-content\/uploads\/2025\/06\/pexels-steve-1509534-1-scaled.jpg","type":"image\/jpeg"}],"author":"DICE \u00c9ditions","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"DICE \u00c9ditions","Dur\u00e9e de lecture estim\u00e9e":"75 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/confluencedesdroits-larevue.com\/?p=4182#article","isPartOf":{"@id":"https:\/\/confluencedesdroits-larevue.com\/?p=4182"},"author":{"name":"DICE \u00c9ditions","@id":"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/person\/5c2bef570684d183d7f5a81e4107304c"},"headline":"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation","datePublished":"2025-07-10T14:53:06+00:00","dateModified":"2025-07-10T14:53:07+00:00","mainEntityOfPage":{"@id":"https:\/\/confluencedesdroits-larevue.com\/?p=4182"},"wordCount":14112,"publisher":{"@id":"https:\/\/confluencedesdroits-larevue.com\/#organization"},"keywords":["biolaw","biomedical innovation","European law","health research","informational privacy","legal concept","privacy"],"articleSection":["Actu","Articles","Dossier"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/confluencedesdroits-larevue.com\/?p=4182","url":"https:\/\/confluencedesdroits-larevue.com\/?p=4182","name":"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation - Confluence des droits_La revue","isPartOf":{"@id":"https:\/\/confluencedesdroits-larevue.com\/#website"},"datePublished":"2025-07-10T14:53:06+00:00","dateModified":"2025-07-10T14:53:07+00:00","breadcrumb":{"@id":"https:\/\/confluencedesdroits-larevue.com\/?p=4182#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/confluencedesdroits-larevue.com\/?p=4182"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/confluencedesdroits-larevue.com\/?p=4182#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/confluencedesdroits-larevue.com\/"},{"@type":"ListItem","position":2,"name":"Gauthier Chassang, Lisa Feriol, No\u00e9mie Dubruel \u2013 The\u00a0Evolving Concept of Privacy in\u00a0European Law. Addressing Specific Challenges for\u00a0Advancing Biomedical Research and\u00a0Innovation"}]},{"@type":"WebSite","@id":"https:\/\/confluencedesdroits-larevue.com\/#website","url":"https:\/\/confluencedesdroits-larevue.com\/","name":"Confluence des droits_La revue","description":"UMR 7318 Droits International, Compar\u00e9 et Europ\u00e9en","publisher":{"@id":"https:\/\/confluencedesdroits-larevue.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/confluencedesdroits-larevue.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/confluencedesdroits-larevue.com\/#organization","name":"Confluence des droits_La revue","url":"https:\/\/confluencedesdroits-larevue.com\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/logo\/image\/","url":"https:\/\/confluencedesdroits-larevue.com\/wp-content\/uploads\/2024\/05\/Confluence-des-droits_La-revue.png","contentUrl":"https:\/\/confluencedesdroits-larevue.com\/wp-content\/uploads\/2024\/05\/Confluence-des-droits_La-revue.png","width":3934,"height":613,"caption":"Confluence des droits_La revue"},"image":{"@id":"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/person\/5c2bef570684d183d7f5a81e4107304c","name":"DICE \u00c9ditions","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/confluencedesdroits-larevue.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/c7dfd2401bef8b8be87ab2a215ca0435?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c7dfd2401bef8b8be87ab2a215ca0435?s=96&d=mm&r=g","caption":"DICE \u00c9ditions"},"url":"https:\/\/confluencedesdroits-larevue.com\/?author=2"}]}},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=\/wp\/v2\/posts\/4182"}],"collection":[{"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4182"}],"version-history":[{"count":15,"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=\/wp\/v2\/posts\/4182\/revisions"}],"predecessor-version":[{"id":4560,"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=\/wp\/v2\/posts\/4182\/revisions\/4560"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=\/wp\/v2\/media\/4269"}],"wp:attachment":[{"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/confluencedesdroits-larevue.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}