Standard contractual clauses for cross-border transfers of health data after Schrems II.

Standard contractual clauses (SCCs) have long been considered the most accessible method to transfer personal data legally across borders. In July 2020, the Court of Justice of the European Union (CJEU) in Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Schrems II) placed heavy conditions on their use. The Schrems II Court found that SCCs were valid as 'appropriate safeguards' for data transfers from EU entities to others outside the EU/EEA as long as unspecified 'supplementary measures' were in place to compensate for the lack of data protection in the third country. Data protection officers are under intense pressure to explain these measures and allow routine transfers to continue. Some authorities interpret the decision as preventing the use of SCCs to transfer personal data outside of the EU because private contracts cannot comprehensively redress gaps in national law. This article argues that these authorities are mistaken and that notwithstanding Schrems II SCCs can still be useful instruments for cross-border transfers. This is especially true in highly regulated contexts such as medical research. This paper traces the history of SCCs under the General Data Protection Regulation (GDPR) and shows how the CJEU in Schrems II misunderstood the purpose of SCCs and other Article 46 GDPR 'appropriate safeguards'. The CJEU mistakenly approached Article 46 safeguards such as SCCs as being similar to country-specific adequacy rulings under Article 45 GDPR. But unlike Article 45 adequacy rulings, SCCs were not intended to provide a stand-alone mechanism for transfer reliant on the law of the importing country. Rather SCCs provide an alternative, multi-layered standard for data protection that encompasses law, technology and organizational commitments. Their purpose is to be used in situations where legislation alone is insufficient to protect data subject rights. The European Commission's new draft SCCs support this analysis.

International transfers of health data between the EU and USA: a sector-specific approach for the USA to ensure an 'adequate' level of protection.

International health research increasingly depends on collaboration and combination using medical data to advance treatment and drug discovery. The European Union (EU), through its General Data Protection Regulation, has tightened the rules for sharing data across borders to protect individual privacy. These new rules threaten cooperation between the EU and the USA, the two largest public funders of biomedical research. This article analyzes the primary pathway for sharing research data with the USA, the US-EU Privacy Shield, and argues that the Shield is ill-suited to support complex health studies. Its legitimacy is in question under both EU and US law, and its terms are too restrictive for the variety of exchanges underlying research, treatment, and care. As an alternative, we propose that the USA seek an additional sector-based adequacy determination based on the existing US health privacy law, the Health Insurance Portability and Accountability Act. A sector-specific approach to adequacy for health would avoid many of the most contentious issues that divide the USA and EU on data protection. It could also serve as a model for other third-party jurisdictions and facilitate international harmonization of health research practices.

COVID-19 contact tracing apps: a stress test for privacy, the GDPR, and data protection regimes.

Digital surveillance has played a key role in containing the COVID-19 outbreak in China, Singapore, Israel, and South Korea. Google and Apple recently announced the intention to build interfaces to allow Bluetooth contact tracking using Android and iPhone devices. In this article, we look at the compatibility of the proposed Apple/Google Bluetooth exposure notification system with Western privacy and data protection regimes and principles, including the General Data Protection Regulation (GDPR). Somewhat counter-intuitively, the GDPR's expansive scope is not a hindrance, but rather an advantage in conditions of uncertainty such as a pandemic. Its principle-based approach offers a functional blueprint for system design that is compatible with fundamental rights. By contrast, narrower, sector-specific rules such as the US Health Insurance Portability and Accountability Act (HIPAA), and even the new California Consumer Privacy Act (CCPA), leave gaps that may prove difficult to bridge in the middle of an emergency.

Cardiac allograft rejection: examination of the expression and function of the decoy chemokine receptor D6.

BACKGROUND: Inflammatory cell recruitment during allograft rejection is driven by a group of inflammatory cytokines termed chemokines. Chemokines are presented on the surface of the vascular endothelium where they ligate specific receptors expressed on the surface of leukocytes. Recently, a group of nonsignaling chemokine receptors have been described. These bind and internalize chemokines but do not drive leukocyte migration. It is believed that these compete with classical signaling receptors to modulate inflammation. METHODS: This study describes the first examination of the human decoy chemokine receptor D6 during rejection; D6 binds at least 12 potent proinflammatory chemokines. The expression of D6 by graft infiltrating leukocytes was examined in cardiac allografts by confocal microscopy on biopsy sections (n=19). Cytokine regulation of D6 was examined in vitro, and a chemokine scavenging assay was performed using the prototypical transplant-associated chemokine CCL5/RANTES. RESULTS: D6 expression was found to be higher in the biopsies taken from more severe cardiac allograft rejection (P<0.01) and was predominantly localized to graft infiltrating CD45(+)CD68(+) leukocytes. In vitro studies demonstrated that the transforming growth factor-beta strongly increased the expression of D6 by monocytes, which significantly enhanced D6-mediated chemokine scavenging (by 85%, P<0.05). CONCLUSIONS: We present the first examination of the biology of D6 during rejection and identify a transplant-associated cytokine that is able to regulate its expression. These data suggest an exciting new mechanism for the antiinflammatory actions of transforming growth factor-beta. Understanding the expression patterns of D6 may provide important insight into the regulation and control of inflammatory cell recruitment during allograft rejection.

Evaluation of the nutrition counselling component of a fitness programme for children with disabilities.

OBJECTIVE: To describe and evaluate the nutrition counselling component of a fitness programme for children with disabilities. METHODS: Twenty-eight children with disabilities, ages 6-14 years, participated in a 16-week comprehensive fitness programme consisting of twice weekly exercise sessions, nutrition counselling and physical activity promotion education sessions. Nutrition sessions consisted of three individual and two group sessions. Individual nutrition goals were developed for each child using 3-day food intake diaries and parent interview. Body Mass Index (BMI) and progress towards nutrition goals were documented. RESULTS: No significant BMI changes were recorded for the entire group (n=28) or a sub-group with a goal to decrease BMI (n=8). Most of the children made improvements in individual goals indicating improvements in healthy eating habits. This included eating the daily recommended amount of servings of each food group, trying new foods and limiting foods containing saturated and trans fats, sodium and sugar. CONCLUSION: Short-term changes were noted in eating habits and behaviours during the 16-week fitness programme, although the effects did not influence overall BMI during the 16-week programme. Children with disabilities are at nutritional risk, and long-term follow-up is needed to determine if initial changes in parent-reported child eating behaviours will impact long-term nutrition, BMI and overall health.