The European Health Data Space: concerns and opportunities following ongoing trilogues

EUCOPE’s Position

Determined to make this Europe’s ‘‘Digital Decade’’, the European Commission’s key priority with the proposal of the European Health Data Space (EHDS) is to promote the digital transformation of Europe’s health sector and improve EU healthcare systems.

EUCOPE continues to support the creation of the EHDS for purposes such as research, innovation, patient safety and personalised medicine. Its common network of health data sharing has the potential to lower barriers for small and mid-sized enterprises to use and reuse high-quality health data sets for research and innovation purposes that could contribute to better health outcomes, support public health and health research and innovation activities in the EU that ultimately could also bolster research in the area of rare diseases.

However, with the inter-institutional negotiations moving forward, the EHDS’ success depends on the outcome of the discussions between the Council, Parliament and Commission. This article, written in collaboration with Hogan Lovells which can be accessed here, provides an overview of EUCOPE’s perspective with respect to the different proposals that are currently subject to the trilogue negotiations between the EU institutions. Here we outline EUCOPE’s perspective on challenges and opportunities associated with each version of the legislative text.

Secondary use of health data

Fundamental issues have not been addressed satisfactorily in the legislative positions that form the bases for the interinstitutional negotiations. The outcome depends to a large extent on the way how three issues are regulated by the proposal:

1. Ensure sufficient safeguards for intellectual property (IP) rights and the protection of trade secrets.

The EHDS should provide measures to protect commercially confidential information in order to protect private trade secrets and intellectual property. Data containing trade secrets or commercially confidential information should not be part of the EHDS dataset catalogues and it should always provide a mechanism for data holders to prevent such publication of their data.

2. Location of data processing and international data transfers.

The EHDS should avoid excessive data localisation and international health data transfer requirements that go beyond the requirements of the GDPR’s framework. International data transfers are not only essential to the interest of EU healthcare companies, but also for EU patients. It is also crucial for the development of innovative as well as personalised medicines

3. Opt-out and/or opt-in.

Regulate the opt-out or opt-in rights of individuals in the EHDS. It should avoid any opt-in and only incorporate an opt-out mechanism as long as it does not lead to inconsistent implementation, increased health data disparities and excessive administrative burdens. The relevant legal bases under the GDPR should be leveraged and applied in a harmonised way across Member States.

Scope and definitions

The EHDS must set forth clearer and more coherent definitions (e.g. on ‘electronic health data’, ‘data holder’, ‘electronic health record system’). The first question that every company operating in the healthcare and life sciences sector with direct or indirect links to the EU is likely asking themselves is “am I a data holder in the sense of the EHDS?” and “what health data do I have to make available for secondary use?”.

While all three proposals try to answer the first question either by defining the scope of the EHDS (as in the Commission and EP proposals) or by specifying the definition of “data holder”, the answer to the second question is not addressed at all. The definition should allow clear identification of who falls under its scope and ensure legislative consistency with other EU legal acts. In addition, the EHDS must clarify its interaction with other applicable legal frameworks (including GDPR, Data Governance Act, Data Act, Medical Devices Regulation). It must must harmonise rules, reduce legal fragmentation and ensure that the regulation can be implemented consistently across the EU.

Safeguards on IP right and trade secret protection

From the perspective of a private company, the decision to allow the HDABs to have sole responsibility in determining which data are to be protected by IP rights or protected as trade secrets is very concerning. HDABs do not have the expertise to evaluate if datasets constitute trade secrets.

It should always be the role of the data holder to determine whether such datasets constitute trade secrets. If at all, it is only acceptable if the EHDS provides sufficient guardrails for identifying the required procedural steps and organizational and technical measures for protecting commercially confidential information (e.g., identified by the data holder as such based on reasonable grounds) and to prevent the single national HDAB from deviating too far from other views in its interpretation of the applicable EHDS provisions.

Data localisation and international transfers 

The EHDS should avoid excessive data localisation and international health data transfer restrictions that go beyond the requirements of the GDPR’s framework. International data transfers are not only essential to the interest of EU healthcare companies, but also for EU patients. Data flows are crucial for the development of innovative as well as personalised medicines. Therefore, the EHDS must limit the obligation to process health data within the EU only (or exceptionally also in third countries, provided they are covered by an adequacy decision pursuant to Art. 45 GDPR) to the hosting of the EHR system and the processing of health data for both primary and secondary use within this EHR system.

The approach that a third country must be recognised by the Commission as a country where health data are sufficiently secured and protected of any infringement of the legitimate interests of the natural person concerned has already proven successful in the context of the GDPR. It is important that the legal requirements for a third country to be included on the Commission’s list are sufficiently clear and adequate under a EHDS specific perspective and scope.

Opt-out/ opt-in rights for natural persons

The EHDS should avoid any opt-in and only incorporate an opt-out mechanism as long as it does not lead to inconsistent implementation, increased health data disparities and excessive administrative burdens. The relevant legal bases under the GDPR should be leveraged and applied in a harmonised way across Member States.

There are significant concerns about the risks associated with an uneven implementation of the opt-out / opt-in mechanism including potential setbacks and associated costs. The implementation of the EHDS already carries additional costs for all Member States. Any ambiguity in the objection/ consent mechanism will likely lead to disharmony in the sharing of datasets and will unnecessarily increase the implementation costs of the EHDS in the Member States. The Council’s approach to leaving the decision up to the individual Member States whether citizens can opt out from secondary use only leads to more fragmentation, which goes against the very grain of the purpose of the EHDS.

The strict approach of an opt-in mechanism for specific data categories would likely lead to health data disparities and foster that certain minority groups, but also young and generally healthy people exercise the right more often which increases the risk of scientific underrepresentation and undermine the reliability of data-driven health interventions. Against this backdrop, only a uniform opt-out mechanism is acceptable. The same opt-out mechanism should be applicable by all HDABs across all Member States in order to limit the scope of national derogation and ensure that the technical specifications are aligned all over Europe.

Call to action

EUCOPE is concerned that the draft legislative texts proposed by the institutions do not provide a necessary degree of legal certainty on the above-mentioned issues. We therefore invite co-legislators to strongly consider the key provisions and recommendations outlined in this article to avoid unintended negative consequences.

Please read the full version here:

Common statement EUCOPE_Hogan Lovells EHDS

For any questions or further information on the EHDS, please contact Leander Vranken (EUCOPE, vranken@eucope.org)
or Dr. Karolin Hiller (Hogan Lovells LLP, karolin.hiller@hoganlovells.com).