Data protection and the promotion of health research: if the laws are not the problem, then what is?

Data protection laws offer such broad exemptions for research that research ethics boards and data custodians lack sufficient guidance as to when it may be acceptable to release data to researchers without consent. The result: idiosyncratic institutional policies that create major challenges for researchers conducting multi-centred studies. The 2005 CIHR Best Practices for Protecting Privacy in Health Research provide an important first step towards greater clarity. However, there is still a need to translate these Best Practices into harmonized policies. This should be seen as an opportunity rather than a threat. Clear rules for data protection will reinforce public trust, which is essential for continued access to personal information for research.