LSHC Horizons Brochure 2024 - Flipbook - Page 18
Hogan Lovells | 2024 Life Sciences and Health Care Horizons | Digital Health and AI
18
Striking the right balance between data protection and research
and innovation in the EHDS
On 3 May 2022, the European Commission
(Commission) published the first draft of the
Proposal on the European Health Data Space
(EHDS). The EHDS aims to expand the use of
electronic health data (eHD) to deliver health
care (primary use), and to enhance research,
innovation and policy making by processing
eHD initially collected in connection with the
provision of health care (secondary use). With
regard to the latter, ‘data holders’ are obliged, if
certain requirements are met, to make requested
eHD in anonymized or pseudonymized form
available for ‘data users’ for secondary use
purposes (e.g., AI development).
One of the most contested questions is the
level of control the EHDS should grant to
the affected natural persons with regard to
sharing of their personal data for secondary
use. This question is immensely explosive
since data subject rights (DSRs), such as object
rights (opt-out), or even the condition of prior
consent (opt-in), may impede the availability
and utilization of eHD for secondary use which
is a fundamental legitimate interest of industry
stakeholders but also the public health.
Examining the Commission’s proposal
and the subsequent proposals of the Council
of the European Union (7 December 2023)
and the European Parliament (13 December
2023) from this standpoint, significant
differences can be observed.
David Bamberg
Counsel
Munich
Pursuant to the latest version of the European
Parliament, data subjects shall have an
unconditional right to opt-out of the processing
of any of their eHD for secondary use (and for
human genetic and other sensitive data types
secondary use requires mandatory consent),
which would significantly strengthen their
position compared to the DSRs under the EU’s
General Data Protection Regulation (GDPR).
In contrast, the Council’s proposal does not
stipulate a specific opt-out, but leaves it up to
the Member States, which "may" cater for a
specific right to object to secondary use. Such
right would complement the GDPR right to
object of Art. 21(1) GDPR. At the other end
of the spectrum is the first Proposal of the
Commission, which provides neither a specific
opt-out right nor a consent requirement for
secondary use at all.
Striking the right balance between data
protection and the promotion of scientific
research, is a challenging and important
task. However, considering that due to the
pseudonymization or even anonymization
requirement for secondary use provided in
all proposals eHD of individuals are already
significantly protected, it is questionable
whether strengthening DSRs beyond the
GDPR is a reasonable approach in light of
the legislative goal of the EHDS of enhancing
research and innovation.
Dr. Karolin Hiller
Counsel
Munich, Berlin
Santiago De Ampuero
Castellanos
Senior Associate
Madrid
