Who Controls Covid-Related Medical Data? Copyright and Personal Data

摘要

In January 2021, Pfizer, who together with BioNTech developed a vaccine for Covid-19, and the Israeli Ministry of Health (MoH) signed an agreement entitled the Real-World Epidemiological Evidence Collaboration. Per the agreement, Pfizer would provide vaccines for Israel's entire eligible population and receive an undisclosed payment and data regarding the vaccine's safety and efficacy. Israel thus served as a de facto laboratory, with the world closely following. The agreement's declared goal was to track pandemic data in a real-world context. The MoH would share "aggregate project data" (Sec. 3), meaning "any de-identified data" (Sec. 1.8). "Project data" are owned by the MoH or the Israeli Health Maintenance Organizations (HMO) (Sec. 8.1). The data are about millions of people from a variety of sources and are used as they are collected. This is big medical data. Who controls big medical data of such utmost significance? The agreement highlights the interrelationship between two modes of protecting data: data protection law and copyright law. The former provides legal protection to data subjects and limits the data controller, but generally speaking, allows the data to be processed for the benefit of public health; the latter awards the databases' controller with rights regarding the dataset, a control which may hinder others' access to highly important data. This editorial unpacks this relationship.