The EU Commission’s proposal in May, 2022 for a regulation to create a European Health Data Space (EHDS) sparked significant discussions in the health sector and beyond. In particular, the parts of the proposal addressing the use of data for so-called secondary purposes and the associated data privacy implications raised concerns.
The goal of the EHDS is to facilitate the use of health data and its protection across the EU, which affects primary and secondary data use as well as electronic health record (EHR) systems at both the national and European level. ‘Primary use’ refers to the use of health data by healthcare providers for healthcare purposes. ‘Secondary use’ pertains to the (re-)use of such data for other purposes including research, policy-making, innovation and regulatory purposes.
In our previous blog post, we explained the purpose, structure and provisions for primary use, secondary use and EHR systems in the initial EHDS proposal. In this blog post, we cover the proposal’s legislative progress and key developments over the past year.
Joint opinion of the EDPB and EDPS
In July 2022, the EU data protection watchdogs – i.e. the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) – provided a joint opinion expressing several concerns about the compatibility of the proposed EHDS regulation with the EU’s General Data Protection Regulation (GDPR). While acknowledging the potential benefits of the proposal in enhancing healthcare delivery, research, innovation and policy-making, the joint opinion highlighted elements of the regulation that could weaken privacy rights of patients.
According to the EDPB and EDPS:
- the interplay between patient rights under the EHDS and data subject rights under the GDPR is unclear;
- limited transparency for data subjects regarding the secondary use of their personal data could impede the ability of data subjects to control their data effectively; and
- given the sensitivity of health data, in-scope health actors (e.g. health institutions or pharmaceutical companies) established in the EU should be required to store health data they hold exclusively in the EU. However, the joint opinion agreed this requirement should not prevent transfers of personal data outside of the EU in accordance with the GDPR.
The joint opinion also recommended that data generated by wellness applications and other digital applications should not be available for secondary use in research and policy-making. Such data could provide highly personal insights regarding relevant data subjects as, for example, religious beliefs could be deducted from food practices or other habits. The EDPB and EDPS suggested that if such secondary uses were permitted, the processing of such data should be subject to prior consent.
Progress within the EU Council
The EU Council, currently led by the Spanish Presidency, is in the midst of finalising its compromise text after intensive debates. It has especially sought to incorporate the views of the EDPB and EDPS as well as the opinions of the European Economic and Social Committee and the European Committee of the Regions.
In May 2023, the Council Presidency revealed a second compromise text reflecting the preliminary result of its consultations and containing significant amendments compared to the Commission’s initial proposal. In particular, that compromise text:
- included an additional right for data subjects to opt-out of the secondary use of their data;
- refined the data categories for secondary use;
- introduced additional requirements for data users from third countries; and
- considered the interplay between rules of the EHDS with other EU acts – for example, to better align the EHDS’ terminology with the Data Governance Act and the Data Act, ‘data holder’ and ‘data user’ were changed to ‘health data holder’ and ‘health data user’.
Progress of the EU Parliament
The draft report (February 2023) of the Committee on the Environment, Public Health and Food Safety (ENVI) and the Committee on Civil Liberties, Justice and Home Affairs (LIBE) (which are each responsible for the EHDS within the EU Parliament) contains a multitude of amendments encompassing large parts of the proposed EHDS regulation. Notably, they suggest:
- an EU storage location requirement for data used for secondary purposes (reflecting the comments of the EDPB and EDPS); and
- a right for data subjects to opt-out to the secondary use of their data (similar to the approach of the EU Council).
However, over 2000 internal amendments have been proposed to that draft report – resulting in many parliamentary debates on fundamental issues. In recent months especially, many parliamentarians have been advocating an opt-in right for patients. Such a right would require patients to give explicit consent before their data may be used for secondary purposes, thereby weighing patient’s data protection higher than the purposes to be achieved by secondary use. Other parliamentarians are concerned though – especially given the problems with data availability during the COVID-19 pandemic – that an opt-in right would result in insufficient health data for certain secondary uses.
What’s next?
It is currently unclear, whether the EU Council will find a compromise by the end of the year. The ENVI and LIBE Committees intend to adopt a position soon that can be voted on in the EU Parliament’s November plenary. The most difficult challenge, however, seems to be finding compromises over the controversial issues regarding the secondary use of health data. On the question of an opt-out or opt-in rightIn particular, European civil rights organisations have been clearly advocating for an opt-in right, whilst European research associations have only indicated this summer that they, in principle, do not object an opt-out mechanism.
Once the EU Council and the EU Parliament have formally agreed determined their respective positions, the interinstitutional negotiations (so-called trilogues) between the EU’s Commission, Parliament and Council can begin. In view of the challenging discussions, it remains to be seen whether the EU legislators will manage to find a compromise before legislative business ceases ahead of upcoming EU elections in June 2024. As these discussions might take some time, it seems not too late for affected organisations to reach out to the EU legislators and engage in the legislative process.
