GDPR v. open neuroimaging : the case of Europe’s data sharing dilemma

Abstract

Momentum toward open science has spurred the widespread adoption of data-sharing standards, platforms, and large-scale initiatives across the international neuroimaging community. Within Europe, however, the General Data Protection Regulation (GDPR) imposes strict conditions whenever these data qualify as “personal data,” creating tension with the goals of open science. This commentary aims to clarify how the GDPR and related national laws affect the legality and practicality of sharing human neuroimaging data. We offer some suggestions on the way forward. Due to the definitions laid out within the GDPR, MRI datasets almost invariably constitute personal data. Consequently, researchers must first establish a legal basis for processing such data, second, satisfy core data protection principles, third, meet extensive information and participant-rights obligations and finally navigate stringent rules for cross-border transfers. We discuss how consent, while ethically essential, seldom meets the Regulation’s requirement for specificity in large-scale data sharing contexts. Public interest processing paired with the scientific-research derogation is often the only workable pathway, yet this depends on heterogeneous Member State laws. We argue that this patchwork legal framework disproportionately burdens smaller institutions and complicates international collaboration. Achieving GDPR-compliant open neuroimaging is possible but not yet routine. Sustainable data sharing requires long-term centrally funded infrastructure that abstracts away cross-border liability, and targeted programmes to supply legal and technical support to smaller institutions. Without these, compliance barriers will continue to exclude less-resourced centres, threatening the inclusivity of European neuroscience.