Big Data in medical research and EU data protection law: challenges to the consent or anonymise approach

Medical research is increasingly becoming data-intensive; sensitive data are being re-used, linked and analysed on an unprecedented scale. The current EU data protection law reform has led to an intense debate about its potential effect on this processing of data in medical research. To contribute to this evolving debate, this paper reviews how the dominant 'consent or anonymise approach' is challenged in a data-intensive medical research context, and discusses possible ways forwards within the EU legal framework on data protection. A large part of the debate in literature focuses on the acceptability of adapting consent or anonymisation mechanisms to overcome the challenges within these approaches. We however believe that the search for ways forward within the consent or anonymise paradigm will become increasingly difficult. Therefore, we underline the necessity of an appropriate research exemption from consent for the use of sensitive personal data in medical research to take account of all legitimate interests. The appropriate conditions of such a research exemption are however subject to debate, and we expect that there will be minimal harmonisation of these conditions in the forthcoming EU Data Protection Regulation. Further deliberation is required to determine when a shift away from consent as a legal basis is necessary and proportional in a data-intensive medical research context, and what safeguards should be put in place when such a research exemption from consent is provided.