In her dissertation A fair balance. Health data protection and the promotion of health data use for clinical and research purposes, Irith Kist discusses the complexity of obtaining consent for the use of health data in health care and scientific research.
Irith Kist is Data Protection Officer at the Netherlands Cancer Institute (NL), and also a member of the Data Protection Advisory Commission of the City of Amsterdam (NL). She holds a PhD in the field of health data protection and privacy law in combination with health law.
Irith Kist emphasizes in her PhD that consent is not simply a matter of saying “yes” or “no.” Patients need to be well-informed about what they are consenting to, which can be challenging because specific research questions and future research areas are not always clear at the start of a study. She highlights the importance of balancing the protection of patient privacy with enabling scientific research.
Editor Tessa Roberts-Smorenburg frequently collaborates with Irith Kist in her daily practice and is a regular member of the critical care-ethical moral deliberations in which they examine case studies. Tessa interviewed Irith Kist about her PhD research and explores the concerns that Irith observes from her perspective.
Which burning issue do you address in your research?
“In practice, I observed that patient privacy in hospitals is taken very seriously, as evidenced by the consent for the use of health data in scientific research. However, I also noticed numerous questions about consent in information leaflets, which patients often do not fully understand. Here, giving consent is not equal to the feeling of privacy and a private life.
Consent allows for the exchange of data to ensure quality care. Additionally, data sharing is necessary to advance scientific research. So the burning issue is that while we aim to protect patient privacy to ensure good care, this often conflicts in practice with the need to exchange patient data to achieve quality of care and foster innovation”.
How does the situation of health data in the Netherlands differ from other countries?
The responsibility to protect health data in the Netherlands is vested in the organization’s responsibility. However, consent alone is not sufficient to ensure this protection, as a patient can only express his rights of autonomy whilst the data need be secured at all times by the organization.
Historically, the right to privacy protection emerged from the atrocities of World War II, when personal data were not safe with the government. This historical context has led to a strong focus on self-determination in our present society.
In public debates in the Netherlands, it is often claimed that the right to data protection is violated, which fosters distrust in the government among the public. Research shows that a sense of trust is crucial for gaining support for legislation on consent and data protection.
Additionally, neoliberalism is increasingly influencing the Netherlands. Although I have not conducted empirical research on this matter, my practical experience suggests a growing trend towards a ‘Can-do’ society, where the belief is that ‘the world is ours for the taking’.
This foundation of consent in the Netherlands differs from other countries, where the public interest and the legitimate interests also serve as a lawful basis for the further use of health data .
What is the meaning of transparency from your perspective?
In my daily practice as data protection officer, I first hear from patients that the meaning of transparency resonates in stories about their own life world, such as how their data can help improve a cancer medication. They may not benefit from it themselves, but they appreciate knowing that someone else might.
Additionally, I am convinced that as an organization, we must be able to explain the use of data to our patients. This means that we need to have a good governance structure and agreements in place. Ultimately, everything should serve the purpose of providing good care for the patient. The patient must always be able to freely express if he does not want or does not agree to something, and his privacy must be safeguarded.
During your PhD defense, you made a distinction in privacy law between the positions of patient, human, and citizen. Can you elaborate on this distinction? And what do you mean by a ‘privacy paradox’?
“In today’s world, health data is the new gold. As a patient, you have the traditional treatment relationship with your doctor. This means that they work according to medical standards and are bound by professional secrecy. In this context, a doctor treats symptoms when someone is ill.
Now I see in society that people are turning to commercial companies for screenings or treatments. These individuals are (usually) not ill, and it often concerns prevention. In these cases, they are not protected by a treatment relationship and the associated professional secrecy.
The third category in this tripartite division is the citizen. For citizens, and there are general frameworks for the prohibited use of data. I observe that there is a lack of awareness of the risks, leading to a privacy paradox: sometimes we are perfectly fine with it, and at other times, there is a loud outcry.”
What are your concerns nowadays?
“One of my biggest concerns is the growing polarization. On the one hand, we have gone overboard on our premises in privacy, and on the other hand, our data are shared by ourselves for instance on social media and the internet.
Secondly, we are practically not drawing sound conclusions on the law of privacy. In the Netherlands, there are so many different views and interpretations of privacy law in the context of consent. This is also an economic and political issue. If we cannot share the data with others, it increases the chance that other countries will surpass us in terms of innovation and science.
Thirdly, the corona pandemic gave us insight into the need to work well collaboratively. I understand the importance of protecting our patient’s health data and that we, as an organization, must safeguard their privacy. However, in the Dutch legal implementation, are we not missing the telos of healthcare: providing good care for our patients? For this, it is necessary to exchange data to ensure the quality of care and to advance cancer treatments. In short, what is a fair balance?”
Can you elaborate on the image you had made for your dissertation?
“On the image, you see a scale on which you can see that it is out of balance. The weights are all on one side. To me, that visualizes that we have gone over the top with a one-sided focus on privacy as an expression of self-determination, while there are more possibilities within the law to realize good care for all patients. The rising sun represents the hope on the horizon that is always central for our patients. Because that is what I ultimately do my work for; for the patients.”
Read her dissertation here: (universiteitleiden.nl)
Listen to the podcast Serious Privacy. The Healthiest Data Show on Earth (with Irith Kist) (buzzsprout.com)
‘The topic of this podcast is health data and how sharing it is important for the advancement of medicine and health treatment, but the disparities on how data is treated globally is not ideal for research purposes’.
About dr. Irith Kist
Irith Kist began a bachelor’s program at the College of Translation and Interpretation (1996) and completed a master’s degree in Political Science (1997) and a law degree (1999). She obtained a second law degree in Tax Law (2009). In her career, she held various positions and since 2016, she has specialized in privacy law as data protection officer with the Amsterdam Institute for Secondary Vocational Education, the municipality of The Hague, and the Netherlands Cancer Institute. She has been working at the Netherlands Cancer Institute since 2018 and has been an external Ph.D. researcher at Leiden University from 2020 to 2024.