The EHDS is about data, not bodily material. The Dutch draft Bodily Material Act is about material, not data. This might lead one to believe there's no overlap. But if you extract data from material, you're doing something with both data and material. That's why I'm discussing my thoughts on the draft act here. Spoiler alert: it's not good.
When does the EHDS come into effect with regard to secondary use?
Primary use in 2027, secondary use in 2029
The EHDS requires considerable preparation. A Health Data Access Body must be established, various software and hardware components must be built or connected, and supplementary legislation must be drafted. Therefore, the EHDS will enter into force in several phases. The provisions regarding primary use will already take effect on March 26, 2027. Chapter IV, on the reuse of health data, will not apply until March 26, 2029. These are the broad outlines, but some parts of Chapter IV will also enter into force on March 26, 2027, while others will come into effect later.
A number of steps still need to be taken, by March 2027. The Member States must inform the European Commission who will be its Health Data Access Body. It must also inform the European Commission who will be the the digital gateway that links the Dutch Health Data Catalogue to the other European catalogues (the Netherlands has already decided that this will simply be the HDAB itself). The European Commission, in turn, must:
1. Establish models for requesting access to health data (a permit or a statistical request);
2. Establish the requirements that Secure Processing Environments must meet;
3. Establish further requirements for the HealthData@EU system;
4. Establish which metadata dataset holders must provide for the health data catalogue;
5. Establish quality and usage labels for datasets.
Subsequently, the bulk of Chapter IV will enter into force on March 26, 2029, meaning that users of health data can then apply for permits or submit statistical queries, while data holders are required to provide data. The Health Data Access Body (plus the national contact point) must then be fully operational. Furthermore, the European Commission’s 2027 determinations will then come into effect (see above).
However, the EHDS does not yet apply to the beneficial reuse of all types of EHDS data. Only on March 26, 2031, will the EHDS also apply to these more sensitive data:
1. Data on factors that influence health, including socio-economic, environmental, and behavioral determinants of health;
2. human genetic, epigenomic, and genomic data;
3. other human molecular data, such as proteomic, transcriptomic, metabolomic, lipidomic, and other “-omic” data;
4. data from clinical trials, clinical studies, clinical trials, and performance studies;
5. data from research cohorts, questionnaires, and health-related surveys, once the related results have been published.
Later again (26 March 2035), Article 75 paragraph 5 will also come into force, which provides that third countries or international organisations can join as participants in the European Health Data Space.
The initial obligations must therefore be fulfilled by the first quarter of 2027. The legislative process to make this possible will therefore begin in Q2 2025. It is therefore important that every stakeholder in the EHDS immediately considers their priorities regarding the correct interpretation and, above all, the optimal implementation legislation. It would be beneficial to use this law to resolve as many problems as possible simultaneously and constructively, for the benefit of public health.
The Ministry of Health, Welfare and Sport will soon determine who will become the HDAB; who will be the source of permits for the beneficial reuse of health data. Who can be this, and who cannot? And what will this HDAB be responsible for?
Under the EHDS, work must be performed in a Secure Processing Environment (SPE). Scientists don't receive data, but access it in a SPE that meets the strict technical and security standards established under the EHDS. What does this entail? And will everyone be required to work in such a SPE from now on? Will it become a supercomputer containing all our health data?