TY - JOUR T1 - Putting the GDPR into Practice: Difficulties and Uncertainties Experienced in the Conduct of Big Data Health Research A1 - Wouters, Birgit A1 - Shaw, David A1 - Sun, Chang A1 - Ippel, Lianne A1 - van Soest, Johan A1 - van den Berg, Bob A1 - Mussmann, Ole A1 - Koster, Annemarie A1 - van der Kallen, Carla A1 - van Oppen, Claudia A1 - Dekker, Andre A1 - Dumontier, Michel A1 - Townend, David PY - 2021 N2 - The potential of big data in health research is dependent upon the ability to collect, reuse, link, and analyse those datasets. The EU General Data Protection Regulation 2016/679 presents big data health research with several difficulties and uncertainties. In this Article we analyze the impact of five elements of the GDPR on big data health research: (1) the distinction made between non-special versus special categories of data; (2) informed consent and its relation to secondary processing of data; (3) the use of the national identification number; (4) the principle of data minimization; and, (5) the principle of storage limitation. We argue that, while the GDPR relaxes its multiple restrictions in the case of scientific research, (1) the GDPR continues to leave too much discretionary power to the Member States, thereby undermining the goal of harmonization; and that (2) the GDPR does not adequately address the challenges brought by the emergence of big data and artificial intelligence used in health research. To conclude, we will advocate for a GDPR Article 40 code of conduct for scientific research to mitigate the issues arising from the GDPR. Keywords: GDPR | Big Data | Health Research | Data Protection | Privacy | Confidentiality JF - European Data Protection Law Review JA - European Data Protection Law Review VL - 7 IS - 2 UR - https://doi.org/10.21552/edpl/2021/2/9 M3 - doi:10.21552/edpl/2021/2/9 ER -