Ethical recommendations for COVID-19 data sharing by Bavarian health care organizations.

The COVID-19 pandemic requires broad-based and collaborative health research among participating disciplines. The lack of integrated and widely accessible patient data sets is also perceived as a barrier in COVID-19 research.

A valuable source of information for researchers are the large volumes of digital health data that are continuously collected at various healthcare facilities and that can subsequently be analyzed in encrypted (pseudonymized) form (secondary data use). However, efforts to collect and link such data may be undermined by privacy concerns. The EU General Data Protection Regulation (GDPR) is a key legal framework for the use and exchange of European digital health data for research purposes. Evidence suggests that the GDPR and its implementation in recent years has made many organizations reluctant to share data, even though the GDPR explicitly allows such use for research purposes via the so-called opening or permission clause.

We see an ethical obligation to make extensive and bold use of the GDPR open clause for science in a crisis such as the COVID-19 pandemic to support collaborative health research. At the same time, it was and is unknown whether and to what extent this has already occurred and whether the crisis has increased data use under the GDPR open clause. Various Bavarian health organizations already collect digital health data, which are valuable sources of information for health research.

Our project investigated whether and how the use and sharing of patient data during the pandemic took place in Bavarian health institutions and how this could be improved in the future. To this end, qualitative, semi-structured interviews were conducted with 17 Bavarian researchers, data protection officers, representatives of Bavarian research ethics committees, and other stakeholders.