Record linkage of population-based cohort data from minors with national register data: a scoping review and comparative legal analysis of four European countries

Background : The General Data Protection Regulation (GDPR) was implemented to build an overarching framework for personal data protection across the European Union/Economic Area (EU/EEA). Linkage of data directly collected from cohort participants based on individual consent must respect data protection rules and privacy rights of data subjects. Our objective was to investigate possibilities of linking cohort data of minors with routinely collected education and health data comparing EU/EEA member states. Methods : A legal comparative analysis and scoping review was conducted of openly online accessible published laws and regulations in EUR-Lex and national law databases on GDPR’s implementation in Portugal, Finland, Norway, and the Netherlands and its connected national regulations purposing record linkage for health research that have been implemented up until April 30, 2021. Results: EU/EEA has limited legislative authority over member states. The GDPR offers flexibility for national legislation. Exceptions to process personal data, e.g., public interest and scientific research, must be laid down in EU/EEA or national law. Differences in national interpretation caused obstacles in cross-national research and record linkage: Portugal requires written consent and ethical approval; Finland allows linkage mostly without consent through the national Data Protection Supervisory Authority; Norway when based on regional ethics committee’s approval and adequate information technology safeguarding confidentiality; the Netherlands mainly bases linkage on the opt-out system and Data Protection Impact Assessment. Conclusions: Though the GDPR is the most important legal framework, national legislation execution matters most when linking cohort data with routinely collected health and education data. As national interpretation varies, legal intervention balancing individual right to informational self-determination and public good is gravely needed for scientific research. More harmonization across EU/EEA could be helpful but should not be detrimental in those member states which already opened a leeway for registries and research for the public good without explicit consent.