The European Health Data Space: What room for citizens' rights and freedoms in the draft Regulation?
In 2020, the European Commission developed a data strategy. One of its objectives is the creation of a common European space for health data and more broadly the creation of a European Health Union. On May 3rd 2022, the European Commission published a proposal for a regulation on the European Health Data Space (EHDS).
The aim of the EHDS is to enable the sharing and exchange of electronic health data for both primary and secondary use cases. In the case of primary use, these data are collected and used for diagnosis and treatment, while in the case of secondary use, the data are reused for the benefit of scientific research, for the development of health policies or to develop personalized medicine.
From the study and analysis of these data, it is possible to obtain information that can be used to solve a scientific or medical problem, to develop artificial intelligence algorithms or to improve existing processes or devices. Through their use, health data can be valued and should therefore be considered as real intangible assets.
The creation of value from data implies that the data used should be reliable, accurate and of high integrity so that meaningful results can be generated.
In the usage of a dataset, the data user may have to correct, annotate or enrich the dataset. All these actions require human and financial efforts as well as time. On this point, Article 37 of the proposed Regulation provides that the body responsible for access to the data has the obligation "to provide, free of charge, to the data holder (...) a copy of the corrected, annotated or enriched dataset, as appropriate, and a description of the operations carried out on the original dataset".
At the same time, Article 41 of the proposal provides that when the data holder receives an enhanced dataset, he must make it available to other users unless he considers it inappropriate.
With regard to these provisions, the European Commission wishes to encourage the joint work of the data holder and the data user to ensure that the data are as complete, relevant and accurate as possible.
For secondary use of health data, an organization responsible for access to health data is identified and acts as an intermediary between the data holder and the user of the data. In France, this role has been assigned to the Health Data Hub (Plateforme nationale de données de santé).
When a legal or natural person, public or private, wishes to access and use health data for secondary purposes, it is incumbent upon them to submit a request for access to the data in accordance with the purposes listed in Article 34 of the proposed Regulation. For example, the purpose of the request for access may be to conduct scientific research or for development and innovation activities of medical products and services.
If the request is complete, the natural or legal person obtains an authorization for data processing. From this point on, the person will become a data user. This means that the user will deploy time, financial and human resources to use these data to produce valuable results.
Regarding this topic, the draft Regulation provides, in Article 46, that data users must "make public the results or outcome of secondary use of electronic health data, including information relevant to the provision of health care, no later than 18 months after the completion of the processing of EHRs or after the receipt of the response to the data request (...)".
Given this article, it is legitimate to ask whether this constraint of public opening of results is likely to discourage data users from requesting EHRs for their projects? Doesn't this constraint of public opening risk altering the EHDS project?
In the specific case where data users are start-ups whose capital valuations are generally based on the data they hold and the associated results, is there not a risk of losing this value if these same enriched data and the results produced are made public? In view of these elements, what is the probability that many actors will really use and enrich data by employing time and material and financial means if no organizational, strategic, competitive or economic advantage is likely to benefit them?
With all of these questions remaining, it is legitimate to assume that the secondary use of data, as planned by the European Commission, has many challenges ahead to ensure that the final strategy is understood by all, and that it is truly federative of the ecosystem.
The European Health Data Space: What room for citizens' rights and freedoms in the draft Regulation?
Advertising purposes and non-compliance of consent or how Apple is fined by the CNIL
The return of the Privacy Shield: The Jedi!
The one who is a physician and want to appoint a DPO
Patient experience & informed consent (the real opt-in!)
Whoever wants "Isalid", a solution that can not lie
The one who wants to re-use the data and inform its patients
Consent by blockchain: how does it work?
The one who wanted to escape the GDPR thanks to anonymization