Red or blue pill Neo, you choose – new opportunities in the secondary use of health data

In a key scene from the iconic film" The Matrix", Morpheus offers Neo two pills: a blue one and a red one. "You take the blue pill... the story ends, you wake up in your bed and believe whatever you want to believe. You take the red pill... you stay in Wonderland, and I show you how deep the rabbit hole goes”. In the area of the use of health data at EU level, member states now have to face a similar choice: either maintain their current fragmented, but already sufficiently established national data management principles and rules or embark on the development of a European data space that could open up new dimensions for the secondary use of health data for research purposes. However, there is still a long road ahead before the adoption of the relevant proposal, in which member states need to clarify and regulate many open questions.

The current situation

When Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), commonly known as GDPR, entered into force, it has fundamentally changed the approach of the EU community to data protection and data processing and has led to significant legislative changes in this area, both at European and Member State level. With the introduction of the GDPR, the role of the fundamental right to the protection of personal data has significantly increased in everyday life, while stricter data protection regulations and standards have been introduced in the Member States, including Hungary as well.

However, based on the experience of the last couple years, it seems that the GDPR has not solved all the problems in the field of use of health data in the EU, moreover, further questions have been raised in connection with the regulation, particularly regarding the secondary use of health data, to which the community should definitely give an adequate answer in the near future.

Error in The Matrix – what are the problematic points in relation to the current regulation?

In simple terms, the secondary use of health data means that the competent bodies compile a data set from the health data collected from natural persons in the course of some kind of medical intervention or treatment, where individual natural persons, whom the data was collected, cannot be identified, but the collected data facilitates various health research (e.g., concerning the fight against cancer).

The TEHDAS working group- which is a project group involving 25 European states that will support the European Commission in building a European health data space and developing principles for the secondary use of health data - published a report on March 1, 2023, in which it mentioned the following critical points in relation to the current legislation:

a)      The GDPR does not provide a common European interpretation of what constitutes ‘sufficient anonymization’ and ‘pseudonymization’, not to mention the fact that the different procedures and technical solutions applied by the Member States make it extremely difficult for such data to be used at community level for secondary purposes.

b)     There is no common European interpretation of what is, and what is not, ‘secondary use’ of data.

c)      European countries have national laws/rules on health and research data in addition to GDPR.

d)     European countries have the ability to set their own derogations under GDPR.

e)     European countries have different preferences as to the choice of legal basis for processing under GDRP.

f)       Health data is considered sensitive data e.g., special category data under GDPR and is treated differently from other types of data when it comes to health data ethics, management and use.

Overall, the above can be considered as critical points because, in the absence of uniform regulations, national regulations become fragmented by taking only national circumstances into account, in addition divergent regulations and national standards significantly complicate the exchange of data between member states, which may also jeopardize the success of international health research.

Where the way out of the rabbit hole leads: the European Health Data space

The European Community is therefore faced with a choice in the field of secondary use of health data: either to maintain the current functioning regulation at Member State level, which makes international cooperation very difficult, or to create a new, standardized regulation at European level, which will apply to all Member States in the future.

As a result, the European Parliament and the Council finally adopted a proposal for a regulation on the European health data space, which is expected to take Member States ' cooperation in the management and use of health data to a new level.

As regards the secondary uses of health data, the proposal sets out minimum categories of health data that can only be used for the purposes set out in the proposal, while also indicating the cases (such as advertising or marketing activities directed at health professionals, health organizations or natural persons, or decisions concerning natural persons or groups of natural persons to exclude them from insurance contracts or to modify their premiums and contributions, etc.) for which secondary uses of health data are explicitly prohibited.

The proposal also provides for the designation and establishment of the competent bodies for access to health data, establishing their tasks and obligations towards natural persons. It also defines the obligations of the so-called ‘data owners’ (mostly healthcare institutions in this case), fees to be paid for access to data, penalties to be applied by competent bodies in the event of breaches of standards, conditions for requesting authorization for secondary use and minimum standards for data sets. The proposal also provides for the establishment of a cross-border infrastructure for the secondary use of health data.

To sum up, it can be seen that the proposal, as a whole, contains very forward-looking measures for the secondary use of health data, and if adopted, Member States will have the opportunity to change the paradigm, to create an environment that facilitates the sharing and making available of data for secondary use, building on trust between their government and the citizens and on common EU principles. The proposal will also give Member States the opportunity to unlock the potential of the health data economy. However, there is still a long way to go before the proposal enters into force, while Member States still have a lot of details to discuss on the regulation, in order to ensure that the rules laid down in the proposal deliver the expected results in practice.

Images: Hersson Piratoba, internet