Optimising cohort data in Europe

may imply additional costs, this ensures that consent is administrated adequately and relieves researchers and data controllers from extensive communication duties. However, such a solution is a double-edged sword because it creates silos between data collection activities (including communication with participants) and data processing (Vaccarino et al., 2018). Such a separation between data collection and data processes has the potential to raise doubts about the data quality and value. As Mouton Dorey et al. (2018) point out, the more detached data controllers are from data collection processes, the more likely they are to have reservations about data quality. Since data collection has a crucial impact on how data is registered in cohort databases, registries and biobanks this means that later comparative work between EU databases could be negatively affected as the basis for comparison and data integration will be unclear (Van der Wel et al., 2019). A solution to prevent such problems is to rely on biobank personnel specifically dedicated to the communication with participants and/or data donors (Beyan et al., 2020). 2.1.2. Data processing (a) GDPR necessity and proportionality for data processing The GDPR as well as other national regulations rely on the principles of necessity and proportionality for research in general and data collection and processing in particular. The GDPR clearly outlines these two concepts in Article 89 and Recital 4: the purpose of research is to bring a benefit to society and to archive what is of public interest (e.g. historical or statistical research purpose) (Shabani et al., 2021). Proportionality balances privacy concerns with the collection and processing of personal data for a scientific research purpose (Verhenneman et al., 2020). As Article 89 makes clear, research in the public interest should include considerations on what “necessity” and “proportionality” mean in a research context with personal data (Guinchard, 2018). Article 89 is in fact a proportionality provision: research interest and research objectives should be balanced against data subjects’ interests and the right of personal dataprotection. Thus, for instance, the collection and storage of personal data are lawful as long as there is a necessity to retain data for public interest, or scientific and statistical purposes (Slokenberga et al., 2021). The background for safeguards regarding free and secure data transfer across borders can be found in Recital 53 of the GDPR. Recital 53 stipulates that while “member states are allowed to maintain or introduce further conditions, including limitations, with regard to the processing of…data concerning health”, those limitations should not prevent the free flow of personal data across the EU when conditions for cross-border processing are applicable (General Data Protection Regulation, Recital 53, 2016). Per Recital 39, the processing of personal data should be done in a way that would ensure its confidentiality and security (General Data Protection Regulation, Recital 39, 2016). In this