The EHDS is about data, not bodily material. The Dutch draft Bodily Material Act is about material, not data. This might lead one to believe there's no overlap. But if you extract data from material, you're doing something with both data and material. That's why I'm discussing my thoughts on the draft act here. Spoiler alert: it's not good.
Why the EHDS Regulation?
EHDS stands for European Health Data Space. It is a European law that will apply directly in the Netherlands, just like the GDPR. The European Union introduced the free movement of people, goods, capital, and services decades ago. Internal borders within the EU were abolished as much as possible. The goal of this was economic growth, in addition to, among other things, complicating war. Brussels quickly realized that this free movement would not function properly without the free flow of data. Therefore, a European, borderless data space was also needed. The GDPR was the first step in this process; to achieve the free flow of data, data protection had to be standardized in Europe. Countries can protect privacy themselves, but achieving the free flow of data required uniform data protection.
A data legislation matrix
A European data strategy was subsequently developed, best described as a legislative matrix. On the one hand, there are rules governing all data, regardless of content. These can be found in the GDPR, the Re-use of Government Information Act, the Data Regulation, and the Data Governance Regulation. On the other hand, there are (and will be) rules governing certain types of data. Nine Data Spaces have been designated for this purpose, including financial data, transport data, and therefore also healthcare data. Therefore, when reading the EHDS, one must remember that this law can only be properly understood as a cog in a larger system of laws that complement each other: European laws such as the GDPR and other data legislation, but also Dutch legislation such as the General Administrative Law Act.
An economic perspective on healthcare
The EHDS aims to improve healthcare in Europe by realizing the free movement of patients, healthcare providers, and medical scientists. It was expected that the free movement of goods would lead to economic growth and better products, and this proved to be true. Supporting regulations were developed, such as the two-week return policy for online orders throughout the EU. This gives consumers the confidence that they can order directly from anywhere in Europe. A reputable Italian organic farmer can thus serve the wine market in Wassenaar; prices will decrease, and quality will increase. Similar benefits are also expected to be realized in healthcare. The goal is for Dutch radiologists, for example, to be able to assess MRI scans from across the EU. Brussels expects this will make healthcare cheaper and better.
Broader data availability
In addition, the EHDS aims to stimulate innovation by making health data available for beneficial reuse. Universities, businesses, and citizens will soon be able to apply for a permit to work with health data. Whether you receive this permit will be assessed based on whether you are pursuing a useful purpose, such as education, scientific research, statistics, but also developing new products or training AI systems. If necessary, you can submit the decision on your application to a judge, who can assess it against, among other things, the prohibition on discrimination or scientific freedom. For example, it will no longer be permitted for an academic hospital to share data with physicians but not with scientists from the computer science faculty.
Within strict legal frameworks
Carelessness with health data is inconvenient, unethical, and unlawful. According to the GDPR, sharing is only permitted if there are sufficient “technical and organizational safeguards.” The EHDS prescribes what this entails. A permit must be requested (with some exceptions) from the Health Data Access Body, a new government body. The permit specifies the precise conditions, and the EHDS also contains a list of things that may not be done with the data. Violation of these conditions is punishable by fines. In such cases, the data is not given, but access to it in a secure processing environment. This should make more knowledge available securely throughout the Union. After all, in addition to a right to data protection, we also have a right to information.
The Ministry of Health, Welfare and Sport will soon determine who will become the HDAB; who will be the source of permits for the beneficial reuse of health data. Who can be this, and who cannot? And what will this HDAB be responsible for?
Under the EHDS, work must be performed in a Secure Processing Environment (SPE). Scientists don't receive data, but access it in a SPE that meets the strict technical and security standards established under the EHDS. What does this entail? And will everyone be required to work in such a SPE from now on? Will it become a supercomputer containing all our health data?