No separate ethical assessment alongside the EHDS

Posted on 13 april 202628 april 2026 by Antoinette

No separate ethical assessment

EHDS allows a separate ethical assessment

The European Health Data Space (EHDS) forms a fundamental pillar of the European data strategy and has the explicit goal of significantly increasing the availability of health data for useful reuse. It promises to put an end to the legal fragmentation and reluctance to share data that have hampered cross-border research for years. The EHDS introduces a harmonised system with Health Data Access Bodies (HDABs). However, the regulation contains a political compromise: Member States retain the power to require an additional ethical assessment for an EHDS permit. They would do well not to make use of this option. Here is why a separate assessment by an ethics committee would solely do harm.

The HDAB as a comprehensive gatekeeper

An analysis of the rules shows that an additional ethical layer is superfluous. The new HDABs are required under the EHDS and the GDPR to conduct an extensive assessment:

EHDS assessment : The HDAB checks whether the goal of the applicant is one of the recognized purposes, such as scientific research aimed at public health, whether this is not prohibited use, and whether there is a broader public interest. It checks whether the applicant possesses the appropriate qualifications and whether the proposed research is scientifically sound.
Privacy and GDPR compliance: The HDAB acts as a gatekeeper for the GDPR and continuously verifies the lawful basis, proportionality, and subsidiarity of the data processing.
Strict security: Data is not transferred directly but may only be processed within a controlled Secure Processing Environment (SPE), which serves as the primary technical safeguard for patient rights.
Patient participation: The HDAB manages the complex assessment regarding opt-out and opt-in regimes, depending on national legislation.

An additional assessment has no purpose

The rules on how to write laws in many countries stipulate that if legislation is prescribed, an extensive analysis must be conducted to determine whether a problem actually exists and how it can best be resolved. An ethical review is therefore only permitted if the HDAB’s review leaves a gap that must be filled by national legislation. However, this does not appear to be the case. Because physical risks to the patient are absent in data research (unlike in clinical trials), and privacy aspects are fully covered by the HDAB, there is no remaining ‘ethical vacuum’ that a separate committee would need to fill.

Instead an extra assessment could be harmful

Sometimes, current ethics committees impose requirements that the EHDS is explicitly abolishing: such as the requirement that the data holder be listed as a co-author, or a payment that significantly exceeds the costs of making the data available. Moreover, an ethics committee has legal disadvantages: a decision on an EHDS permit application is an administrative decision. It must therefore comply with, among other things, the principle of legal certainty. And if it is not strictly defined what that ethics committee must still assess, then that requirement has not been met. Moreover, the ethics committees will make different decisions per country, thereby restricting the free movement of data; which therefore directly contradicts the intent of the EHDS Regulation.

Consequences for innovation and science

The development of precision medicine and the treatment of rare diseases requires enormous statistical power, which necessitates the aggregation of multinational cohorts. If Member States adopt their own, divergent ethical criteria, this directly undermines the fundamental objective of the EHDS: a seamless, pan-European ecosystem for health data. It reintroduces the administrative friction that often made important studies unfeasible under the old system. Member States must therefore refrain from adding extra national safeguards on top of this unified European framework. The most effective strategy is not to duplicate decision-making, but to integrate the expertise of members of existing ethics committees into the structure of the HDAB. This prevents conflicts of interest, guarantees legal certainty, and ensures that the cross-border potential of the EHDS can be fully utilized.

Would you like to know more about the HDAB assessment and the EHDS? Contact Antoinette Vlieger.

The concept of Science in the Omnibus

How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.

Long live AI, says AI!

Many people are afraid that their jobs are at risk due to AI. I decided to turn the question around and asked Gemini: which jobs are you going to take over, in a way that make us happy? Here is her own optimistic answer.

The EHDS, PFAS and marriage counseling

The EHDS has been in effect for a year. From PFAS to chronic complaints: this is how the reuse of health data works in practice.

The concept of Science in the Omnibus

Posted on 13 april 202628 april 2026 by Antoinette

The definition of science in the Digital Omnibus

Debate on science versus good science

A new debate is brewing around the proposed Digital Omnibus Act, specifically concerning how the EU should define ‘scientific research’. In a recent paper, Evert-Ben van Veen sharply criticizes the European Commission’s proposed definition and offers an alternative. While I appreciate the critical look at the EC’s drafting, I fundamentally disagree with his proposed solution. In his paper, Van Veen argues that a definition of scientific research should include normative criteria, such as adhering to “applicable regulations” and “generally accepted standards of research integrity,” in order to distinguish “good science from bad science.” From a dogmatic and strategic legal perspective, this is a dangerous conflation of two very different things. Here is why we shouldn’t overload the definition of ‘scientific research’:

Three reasons why not to define like this

1️⃣ Ontology vs. Normativity: Defining what an activity is, is fundamentally different from defining how it should be lawfully executed. We do not need a restrictive, normative definition of “science” to prevent bad data practices.

2️⃣ We already have the regulatory tools: If a researcher wants to use health data unethically or excessively, that project shouldn’t be stopped by claiming “this isn’t science.” It should be stopped because it violates the core principles of the GDPR (proportionality, subsidiarity, purpose limitation), fails ethical committee (METC) reviews, or doesn’t meet the stringent funding criteria of bodies like ZonMw or Horizon Europe.

3️⃣ Academic Freedom: Article 13 of the EU Charter guarantees the freedom of the arts and sciences. If the legislator starts defining ‘science’ based on vague, politically sensitive criteria like contributing to societal “wellbeing” or adhering to fluid “ethical standards”, we risk encroaching on academic freedom. The state regulates the lawful use of data; it should not hold the monopoly on defining what constitutes legitimate knowledge creation.

Let’s keep definitions neutral and rely on the actual legal frameworks (GDPR, EHDS) to ensure compliance.

No separate ethical assessment alongside the EHDS

The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.

Long live AI, says AI!

The EHDS, PFAS and marriage counseling

The EHDS has been in effect for a year. From PFAS to chronic complaints: this is how the reuse of health data works in practice.

Long live AI, says AI!

Posted on 13 april 202620 april 2026 by Antoinette

Long live AI, says AI

Here goes my job?

Many people are afraid that their jobs are at risk due to AI (see, for example, the ‘most exposed’ list from Anthropic, among others). I decided to turn the question around and asked Gemini: will AI takes over tasks in a way that actually make us happy? Here is her own optimistic answer.

1. AI takes over tasks we'd rather not do

AI is taking over tasks that waste human capital. Consider the administrative tsunami in healthcare or education. Soon, AI will be listening in on a doctor and updating the file in real time. Or think of sifting through 10,000 pages of contracts or solving impossible staffing schedules. Humans lose their chores and free up their hands for real human work, such as applying a bandage and comforting a child.

2. Problems we cannot solve ourselves

Humans are biased—consciously or unconsciously. A well-calibrated AI can serve as a 100% blind, objective scale for job applications or permits, precisely to eliminate human bias. AI can also handle complex systems that exceed the capabilities of our brains, such as balancing our overloaded power grid down to the second or discovering patterns for hyper-personalized medicines.

3. Solutions we did consider possible

AI will not only optimize, but invent fundamentally new things. Think of designing proteins that filter PFAS from our water; definitively breaking the global language barrier with real-time, lifelike translations; or making economically impossible things possible, such as giving every child in the world – from Amsterdam to Timbuktu – a personalized private tutor on a tablet.

Time for humanity

Gem’s own conclusion? “If you look at the work being eliminated, humans are primarily losing the role of ‘flesh-and-blood robot’. When AI takes over tasks, what we get in return are tools to solve the biggest bottlenecks of our species, plus time for the quintessentially human interactions.”

Are you in (health)care and would you like to work with a tech-optimist to answer your legal questions? Contact Antoinette Vlieger.

No separate ethical assessment alongside the EHDS

The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.

The concept of Science in the Omnibus

How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.

The EHDS, PFAS and marriage counseling

The EHDS has been in effect for a year. From PFAS to chronic complaints: this is how the reuse of health data works in practice.

The EHDS, PFAS and marriage counseling

Posted on 13 april 202628 april 2026 by Antoinette

The EHDS, PFAS and marriage couseling

Three questions that merged

This morning, three things happened to land on my plate together: a new assignment on the useful reuse of health data, an article about the bizarre increase in symptoms of depression among women in their fifties, and a theory from a doctor friend about PFAS: it disrupts hormones, potentially causing our daughters to be shorter. In my mind, this merged into one big research question. If PFAS has such an impact on hormones, does that perhaps also explain why menopause seems so intense these days? And if we speculate a step further: do women divorce during menopause—by chance—or do they divorce due to symptoms triggered by hormonal factors (or environmental pollution)?

Combining PFAS and mental healthcare data

The answer is: nobody knows. Why not? Because at this moment it is virtually impossible to link mental health care data to other datasets on a large scale. Due to the stigma – and enormous legal apprehension – they remain under lock and key. And this is therefore typically a matter for the European Health Data Space Regulation. The fact that the EHDS has now been in force for a year makes me hopeful as a lawyer. Soon, as a scientist, you will be able to apply to the national Health Data Access Body (HDAB) for a permit to investigate these kinds of pressing questions. You will then gain access to pseudonymized data in a highly secure environment (a Secure Processing Environment). This way, for example, you can finally safely combine health data on menopausal symptoms with geographical data on the spread of PFAS.

EHDS will thus bring a lot to society.

Of course, the strictest security safeguards apply (rightly so), especially to mental healthcare data. But we are definitely moving from ‘data sharing is a favor’ to ‘data for research is a right’ due to the enormous societal importance. For if it turns out that environmental damage leads to an increase in divorces or burnouts via our hormones, then society needs something other than marriage counseling.

No separate ethical assessment alongside the EHDS

The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.

The concept of Science in the Omnibus

How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.

Long live AI, says AI!

The free flow of health-ICT

Posted on 13 april 202620 april 2026 by Antoinette

The free flow of health ICT

Ontwerp van Zorg-adressering

The Dutch Ministry of Health, Welfare and Sport (VWS) recently opened a consultation on the concept Global Technical Design (GTO) of the Generic Function Addressing: a kind of address book for healthcare providers. This is an important step for Dutch healthcare, but if you view this document through a European lens, I do see some tension.

National health law versus EU free flow of services

The Ministry of Health, Welfare and Sport (VWS) seems to argue, based on health law (Article 168, paragraph 7 TFEU & the autonomy of Member States to organize their healthcare systems), that this structure is permissible. The system relies on typically Dutch anchors: the Chamber of Commerce (KvK) and the UZI/DEZI register. However, my legal intuition tells me that we are overlooking broader European market rules here. Doesn’t this technical design erect a wall for foreign ICT suppliers?

Can a Dutch CC registration be mandatory?

If a German software developer (e.g. of an EHR solution) is forced to have a Dutch Chamber of Commerce registration in order to connect their systems to the LRZa, this directly infringes upon Article 56 TFEU (the free movement of services) and the European Services Directive, which prohibits Member States from forcing foreign service providers to register in a local or national register in order to be allowed to provide their digital services. Furthermore, such a closed national approach seems to me to be at odds with the intended beneficial effect of the eIDAS Regulation and the European Health Data Space (EHDS). After all, these exist precisely to break down cross-border digital friction and vendor lock-in at the national level.

Which other Ministry knows more about this?

Are there experts in European law and/or the Services Directive who recognize this tension? Is the Netherlands building a legally untenable digital border here? I would like to brainstorm with someone knowledgeable about the free movement of ICT services to see if my intuition is correct and whether it makes sense to respond to this consultation together. Perhaps someone from the Ministry of Economic Affairs and Climate Policy? I look forward to hearing your thoughts and suggestions for experts.

No separate ethical assessment alongside the EHDS

The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.

The concept of Science in the Omnibus

How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.

Long live AI, says AI!

The Dutch Bodily Material Act must be rewritten

Posted on 26 augustus 202528 april 2026 by admin

The draft Bodily Material Act (WZL) must be rewritten

The WZL versus the EHDS

The European Health Data Space Regulation concerns data, not bodily material. The draft Bodily Material Act (WZL) concerns material, not data. Therefore, based on the names of the two laws, one might assume there is no overlap. Therefore, there would be no reason to discuss the WZL on this website. I will discuss it anyway, because there is more overlap than one might think. When you extract data from material, you are doing something with both data and material. Moreover, the Guidelines for Regulations (rules on how to write laws) stipulate that new laws must always be carefully considered to determine their true necessity. Moreover, they must be harmonized with existing regulations as much as possible. Moreover, many (incorrectly) believe that the WZL does indeed concern data from material, while the EHDS explicitly does. For these three reasons, I will discuss the draft WZL here. Spoiler alert: it’s rubbish.

Why the WZL?

First, a little background on the WZL. Scientists are usually concerned with data from the material, not the material itself (unless, for example, they need material for a surgery class). They find this so logical that the two get confused. For lawyers, bodily material is completely different from data from the material. Previously, these were clearly legally separated. The WGBO (Dutch Medical Treatment Contracts Act) contains a statutory provision on the reuse of material (7:467 BW) and a statutory provision on the reuse of patient data (7:458). Because people often want to extract data from material, the law states: “Research with anonymous substances and parts separated from the body is understood to mean research in which it is guaranteed that the bodily material to be used in the research and the data to be obtained from it cannot be traced back to the person.”

So, as soon as you extract patient data from the material, you no longer fall under the article about the material, but under the article about data. This prevented duplication, and that was perfectly arranged. The problem is that over time, the legal article about material has been interpreted differently. Some believed that if traceable data were extracted, consent was always required (perhaps based on invalid a contrario reasoning applied to Article 7:467 of the Dutch Civil Code?), while the other legal article (Article 7:458 of the Dutch Civil Code) states: consent unless unreasonable.

What is anonymous?

Moreover, bodily material was previously generally considered anonymous: you can’t tell who a drop of blood belongs to. But now that DNA can be extracted from a drop of blood, it was argued that bodily material is essentially no longer anonymous. This conflicts with European (GDPR) case law regarding when something is considered personal data. This is based on a relative concept. Whether privacy is at stake and therefore whether the GDPR applies depends on who is processing the data and what that processing entails. This (case law on the) GDPR is relevant because, when the GDPR Implementation Act was drafted (Article 24), specific reference was made to the Medical Treatment Contracts Act (WGBO): these articles were intended to provide the same framework. However, this relative approach to personal data seems to have had no effect on how bodily material is treated. This may be because the experts cited in this regard are medical scientists, not lawyers. They will have concluded that material is never technically anonymous again, but that is a different matter from the question of whether it is legally anonymous.

All those biobanks...

Because the law stipulates that one can opt out of material unless it is not anonymous, many now believe that bodily material is never anonymous and therefore (almost) always requires consent. This is often difficult for scientists to handle. In my opinion, this difficulty lies in a misreading of the legal provisions, and in this regard, a legislative amendment was therefore unnecessary. However, this doesn’t change the fact that the House of Representatives simultaneously became uneasy about the fact that a large amount of material (from millions of Dutch people) was now being stored in biobanks, with little oversight. A law was therefore necessary, and that argument hasn’t been dismissed yet: and therefore, “a” WZL (Wiseness of the Authorization of Bodily Material) is necessary. However, the confusion about material versus data from that material has only increased with this draft law on the control of bodily material.

Double rules

The WZL itself explicitly states, “This law applies to procedures involving bodily material (…).” This is problematic in itself. Firstly, because the article in the WGBO stipulated: this article applies to bodily material, unless (traceable) data is extracted from it, in which case you fall under the article on data. This “unless” provision is not in the WZL. This means that if personal data is extracted from bodily material, it will soon fall under the WZL because it involves bodily material, and it will also fall under the GDPR (and soon the EHDS) because it involves personal data (and health data). This means that under the WZL, you must check whether an objection has been filed (via a separate system), while under the EHDS, you must also check whether an objection has been filed in the National Control Register.

This is despite the fact that the intention is to reduce the administrative burden, and the Guidelines for Regulations stipulate that harmonization must be as high as possible. Why the WZL isn’t aligned with the EHDS is therefore a mystery to me. Moreover, it’s unacceptable to choose to have data extraction from material fall solely under the WZL, as that is a Dutch law that cannot override the European GDPR. It should be the other way around: it should be explicitly stated that if personal data is extracted from material, it no longer falls under the WZL but under the GDPR. This is currently lacking.

But the WZL is not about the data itself

But it’s also problematic because it escapes almost everyone’s attention that the WZL concerns actions with material (including data extraction), but not with that data itself. Even the Council of State recently wrote in an advisory opinion: “A regulation will also be introduced for the (further) processing of personal data (health-related) for this situation.” That’s not the case. But if even the Council of State is confused about this, then so must be almost the entire field. It becomes even more serious when one examines precisely when the law will apply: “This law applies to actions with bodily material that has been (…) collected (…) in connection with medicine (…) and which actions are intended for a purpose other than (…) assessing the patient’s state of health.”

Bodily material (such as drops of blood or a piece of skin) is often collected for the care of a specific patient. Afterward, it is stored, still for that specific patient, due to the obligation to keep records of what is done and why. The WZL will therefore not apply in this case, while the article from the WGBO (Dutch Medical Treatment Contracts Act) on material will be repealed. This means that as long as no scientist is interested in the material, no regulations apply. But it gets even stranger. Because if a scientist becomes interested in the material after three years, the WZL will apply, and it will then stipulate (in 2028) that information must be provided to the patient when collecting it. But that was three years earlier, in 2025. How can a law now stipulate that it will apply in 2028, which then prescribes that something must be done three years earlier? I really don’t get it.

Nobody owns it

Another problem is that the bill appears to be based on incorrect assumptions. The Consultation Version of the Second Amendment Memorandum to the Bill on Control of Body Material, dated June 10, 2024, refers four times to a report. This report contains several remarkable statements. For example, on page 55 it states: “Our law primarily considers materials separated from the body as ‘substances susceptible to human control’ (Article 3:2 of the Dutch Civil Code). Ownership can then be considered. The person from whom the body material originates becomes the owner of that material.” This is incorrect. Article 3:2 of the Dutch Civil Code states: “Things are tangible objects susceptible to human control,” to which Article 5:1 of the Dutch Civil Code adds: “Ownership is the most comprehensive right a person can have in a thing.”

This “possession” does not imply that every thing is subject to ownership. You can only own something if it is also subject to possession, because you can only become an owner through transfer of possession, taking possession, or possession plus prescription. Everything “outside of commerce,” as it has been defined for centuries, is not subject to possession and therefore also not subject to ownership. If too much skin is wrongly removed, this may be abuse, but you cannot report theft to the police. No one owns bodily material, just as no one owns health data (one cannot own “the sun is hot,” and therefore also not “the patient has a fever.”).

Provide control, but harmonize

Intuitively, we feel that patients should perhaps have some control over their bodily material, but this is separate from the concept of ownership. Similarly, under the GDPR, patients have control rights over data to protect their privacy, which are therefore entirely independent of the question of ownership. The GDPR stipulates that a balance must always be struck between the interests of privacy and the interests of data use. And this should also be the case with bodily material. Therefore, the WZL should, where possible, align as closely as possible with the GDPR and the upcoming EHDS, and the subtle balance sought in these two regulations between the interests of privacy and the interests of data freedom. However, the WZL wrongly fails to align with the EHDS at all. In that regard, the recent report from the Council of State was indeed correct. Such a lack of harmonization violates Article 2.45 of the aforementioned Guidelines for Regulations, which stipulates that this should be pursued as much as possible.

Physical integrity not at stake

The decision not to align fully with the GDPR and the EHDS also appears to be related (besides the confusion of data and material) to the confusion of body and bodily material. The moment material is taken from a patient, at that moment, bodily integrity is compromised. This is no longer the case when a sample is retrieved from an archive for research five years later. Three situations can be distinguished regarding collection: collection for care, collection for care and research, and collection solely for research. The Medical Research Involving Human Subjects Act (WMO) applies to this third issue. This Act contains strict safeguards to protect the patient’s health and bodily integrity. There was some uncertainty about the extent to which this law also applied in the second situation: when an additional tube of blood is collected. In that case, too, the patient’s body is at stake, and ethical questions arise. However, if an existing sample is retrieved for research, only privacy issues arise.

So why an ethical assessment?

Despite this, the WZL stipulates that material managers must always have regulations that have been approved by an ethics committee. But this is very odd for a situation in which there are no ethical questions at all: the situation in which material was collected solely for healthcare purposes. If one only realizes afterward that this material might also be useful for research, bodily integrity is not at stake at all. The only question then is whether the patient’s privacy is sufficiently protected, which is already addressed by the GDPR and the EHDS. Why a Medical Ethics Review Committee needs to be involved in this is incomprehensible. These review committees are extremely valuable in medical research involving human subjects. Patients who think they might die say yes to everything. And then a review committee has to look into whether the risk to the patient is not too great, or whether the chance of a beneficial effect from the research is not too small. This ethical constellation is completely irrelevant when a piece of skin taken three years earlier is used. Therefore, it is incomprehensible why the ethics review committee needs to be involved in this.

In short: back to the drawing board

All in all, the WZL is an incomprehensible law, while the Explanatory Memorandum precisely states that it aims to provide clarity. Furthermore, the WZL is not in line with the Guidelines for Regulations because it is not optimally aligned with the GDPR and the EHDS. Therefore, the draft WZL must simply be scrapped. No minor adjustments, as was previously the case. A completely new WZL needs to be written (i) that precludes the dual application of rules to the same action, (ii) that aligns as closely as possible with the GDPR and the EHDS, (iii) that regulates control through the National Control Register, (iv) that, following the GDPR, opts for a risk-benefit assessment, and (v) that omits the ethical review if privacy is at stake but physical integrity is not.

No separate ethical assessment alongside the EHDS

The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.

The concept of Science in the Omnibus

How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.

Long live AI, says AI!

The rule of law for medical scientists

Posted on 10 juni 202514 april 2026 by admin

The rule of law for medical scientists

We nowadays have a (fairly) well-functioning government. It’s sometimes forgotten that this used to be different, or that it still isn’t the case in many other countries. Lawyers learn during their training that it’s important to continue to defend the rule of law, so we never revert to dictatorship. As a medical scientist, you might think this isn’t your job, that you don’t need to know anything about it. Nothing could be further from the truth. Understanding the Trias Politica, for example, is important for knowing when to ignore the Data Protection Authority. It’s also helpful to understand that a lobbying campaign starts with the question of whether the Ministry of Health, Welfare and Sport is the right place to be. Therefore, I’ll outline some basic principles for medical scientists here.

The Data Protection Authority is sometimes wrong

A key element of our constitutional state is the separation of powers, the Trias Politica. The legislative branch establishes the rules (a Ministry drafts a law, but Parliament decides). If the rules are vague or there are exceptions, the judiciary provides further detail. In addition, we have the executive branch, which also includes enforcement authorities. They can impose fines. To prevent abuse of power, they may only implement rules and not establish or interpret them. This means that an authority like the Dutch Data Protection Authority cannot determine what the law entails (as also stated by Zwenne and Hallinan, p. 27).

The Data Protection Authority (DPA)’s position is similar to that of a police officer. While they can prioritize burglaries over public urination, for example, they cannot themselves determine that children on fat bikes will henceforth receive a fine. Similarly, the DPA may consider something to be part of its remit, but if the GDPR doesn’t stipulate that, no fine can be imposed. Even what’s stated on the DPA’s website isn’t necessarily correct. Just like the “opinions” of the EDPB, they are just that: opinions, ultimately up to a judge to determine their correctness. Similarly, it’s useful to question whether the IGJ’s code of conduct clearly stems from a law. If not, then, based on the principle of legality, no fine can be imposed for ignoring such rules. A critical attitude isn’t civil disobedience, but an important safeguard of the rule of law.

Trial Process Foundation useful for clarity

Related to this is the following point: if a problem is identified, a solution must be requested from the appropriate source. For example, the GDPR is a very unclear law. The medical-scientific sector is eagerly looking to the Ministry of Health, Welfare and Sport for clarification. But this Ministry cannot provide any explanation for an existing law, which, moreover, did not originate with it. The GDPR could be rewritten, but only the European Parliament can do that.

There’s also not always point in a governmental body paying someone to write codes of conduct. Because if they’re not actually used by judges to give substance to a vague law, then those codes simply have no legal standing. The GDPR can only be clarified by judges, but that would require submitting specific questions to the court. Generally, people are averse to litigation, but from a societal perspective, litigation serves an important function: it clarifies the law. That’s why it would be much more useful if, for example, the Royal Netherlands Academy of Arts and Sciences (KNAW) and the Dutch Trade Union Federation (FNV) established a foundation for test cases for medical scientists.

Furthermore, law isn’t a hard science. In many conflicts, both sides have a point; otherwise, litigation wouldn’t often go all the way to the highest court. It’s a high-level argumentation theory. Parties who understand this know that professors’ arguments carry considerable weight, which is why they sometimes open their wallets to appoint a special professor; it’s simply a form of lobbying.

And check whether you are adressing the right Ministry

If you want a new law, you also have to contact the correct Ministry. For example, there are complaints that scientists are not (or not always?) allowed to use the Citizen Service Number (BSN) to link files. (Pseudonymized) name and address data are regularly used, but this is worse from a privacy perspective and also leads to more errors. Therefore, there is lobbying for a change in the law at the Ministry of Health, Welfare and Sport (VWS). However, the BSN ban is in the implementing act for the GDPR. Therefore, it also makes sense to include a rule in that same act that scientists may use the BSN. After all, it doesn’t make sense to write different rules for medical scientists than for social scientists or criminologists. The Ministry of Justice is responsible for the GDPR, and therefore the Ministry of Justice is the right place to lobby for a change in the law. And if you can’t agree on the right Ministry for a draft law, remember that all laws are ultimately passed by Parliament. Lobbying the House of Representatives (which can add something to a bill that is already on the table) therefore makes more sense than lobbying the Ministry of Health, Welfare and Sport when it comes to addressing the BSN issue.

Conflict rules and logical reasoning

It’s also worthwhile to occasionally reflect on the broader legal system and its precise division of roles. For example, there are the conflict of laws rules. These days, many people use the term “lex specialis.” They call something a special law, which therefore takes precedence. That’s too simplistic. First, one must check whether there are two distinct rules pointing in different directions. Without conflict, the conflict of laws rules do not apply. Then, it’s important to establish that there is a sequence in the conflict of laws rules: (i) higher law always takes precedence over lower law, (ii) special law takes precedence over general law, and (iii) new law takes precedence over old law.

The second rule, the lex specialis rule, is therefore only applied if the first rule fails. Consequently, a special but lower-ranking law (such as the Medical Treatment Contracts Act) can never override European law. What is possible is for a national law (the Police Data Act) to apply instead of the GDPR, because the GDPR itself stipulates that it does not apply to police data. But that doesn’t make the Police Data Act a lex specialis. Also, beware of invalid reasoning. If a law stipulates that a file must be retained for two years, then there is nothing stipulated about what must happen in the third year. The law doesn’t state that the file must be destroyed after two years; that depends on whether, after those two years, there is a good reason other than the law for retaining it.

The Dutch WGBO is contract law

It’s also worthwhile to occasionally consider the broader legal system. For example, it’s often overlooked that the WGBO (Dutch Healthcare Act) is part of contract law; it’s simply included in the Civil Code, between tenancy law and employment law. This entails three things: first, it’s as soft as butter. Contract law is replete with open-ended standards such as reasonableness and fairness and good faith. What a care agreement entails in a specific case is therefore not determined purely by the letter of the WGBO, but equally by the circumstances of the case and what the parties could reasonably expect from each other. Moreover, as part of contract law, the WGBO constitutes a “right of redress.” This means it was written in case one party fails to comply with the agreement.

For example, suppose a doctor has made data available for research without asking permission. This can be brought before a judge, but the judge will simply assess: is there a breach of contract? Check. Has there been any damage? Probably not, except that it is considered annoying. And is there evidence of a causal link between the breach of contract and the damage? You will understand that the patient cannot always rely for remedies on the medical confidentiality obligation in the Medical Treatment Contracts Act (WGBO) while he can rely on the Individual Healthcare Professions Act. This is especially true because they may be able to receive €250 in damages, but the procedure (without legal aid) quickly costs €5,000. Contrary to popular belief, the WGBO is only enforced by the civil courts. After all, the governmental agencies overseeing health care must, based on the principle of speciality, limit themselves to those laws that state that they are enforced by that agency, and that is not the case with the WGBO. In short, don’t be blinded by the content of a single rule; always assess it within the larger system.

No separate ethical assessment alongside the EHDS

The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.

The concept of Science in the Omnibus

How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.

Long live AI, says AI!

The existing free flow of health data

Posted on 2 juni 202514 april 2026 by admin

The (already existing) free flow of health data

My data in my country?

In discussions about the reuse of health data, national borders are often discussed. This secondary use requires a proper balance between privacy on the one hand and the importance of, for example, scientific research or being able to assess the effectiveness of a certain policy on the other. Privacy advocates often believe that “our” data should not be allowed to cross borders when reused, or that you should at least be able to indicate in the National Register of Authorities that this is not permitted with “your” data. Scientists, on the other hand, argue that, for example, with rare diseases, they can only do their work effectively if data from different countries can be used. Therefore, they welcome the EHDS, which stipulates, among other things, that they will be able to request data from all over Europe. What both parties overlook is that the free flow of health data within the EU has long existed.

European law on data

One of the objectives of the EHDS is to support the free movement of health data. It says “support” because this free movement already exists. Completely unnoticed is the provision in Article 1 of the GDPR: “The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.” The GDPR only applies to personal data (where one can reasonably identify the individuals concerned). Therefore, alongside it exists the completely unknown Regulation 2018/1807 on “the free movement of non-personal data within the European Union.” The Open Data Directive 2019/1024 further stipulates: “The conditions for the re-use of documents shall not discriminate against comparable categories of re-use, including re-use across national borders.”

Scientists can already use this

The free movement of goods and services within the EU began in 1993 with the introduction of the internal market. It soon became clear that the internal market was not possible without the free movement of data. Data protection can easily be regulated in the law of an individual member state, but free movement required harmonization (alignment) of legislation. The free movement of data was precisely a key objective of the GDPR, hence its inclusion in Article 1. This means that people can already request data directly from, for example, FinData. This request may not be treated differently from requests from Finnish researchers, as there is also a prohibition on discrimination between Europeans. Therefore, no distinction may be made between Dutch or Finnish scientists in a request. The EHDS will soon make it possible to request data from all over Europe with a single request to the Dutch HDAB. However, it would be helpful if scientists and statisticians were aware that it is already prohibited to hold data at an internal border (a border between EU countries). They can therefore immediately submit requests to work with health data throughout Europe.

Data Subject control the same for the entire EU

And patients will soon be able to object to certain reuses of data about them via a National Control Register. The Ministry of Health, Welfare and Sport (VWS) must now determine the exact structure of this register. However, European law prohibits structuring this register in such a way that Dutch scientists can work with “our” data, but not Belgian scientists. Considering that these scientists are trying to find a cure for cancer, for example, a cure that will then become internationally available, it makes perfect sense for a legislator to ensure that every scientist in the EU has access to data, not just those from our own academic hospitals. Moreover, under the GDPR, data may already flow to countries for which the EU has issued an adequacy decision. This means that Brussels believes that privacy is adequately protected in countries like Japan. Countries like Japan may eventually join the EHDS, but because they are not part of the EU, you may be asked in the National Register of Control whether you object to data about you also being sent to such non-EU countries.

So the BSN may not be withheld either

Note: this free flow of data was intended to support the free movement of goods and services within the EU. The idea behind it was: the larger the market, the more competition, which will lead to higher quality at lower borders. Brussels wants a good winegrower in Italy to be able to sell directly to people in Wassenaar. Similarly, a good radiologist should be able to directly assess MRI scans in Greece. This will make better care available in Europe at a lower price. The underlying data traffic shouldn’t stand in the way of this. In the Netherlands, some people believe that the Citizen Service Number (BSN) cannot be used across the border because the law doesn’t say otherwise. But that seems to me to be a typical situation that, if Dutch law were to actually entail this, would be invalid under Article 1 of the GDPR. Personal data may not be withheld at an internal EU border, and that also applies to the Citizen Service Number (BSN).

No separate ethical assessment alongside the EHDS

The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.

The concept of Science in the Omnibus

How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.

Long live AI, says AI!

When can you ignore medical codes of conduct?

Posted on 1 juni 202521 november 2025 by admin

When can you ignore medical codes of conduct?

On LinkedIn, doctors and medical researchers regularly complain about unworkable rules. For example, as a radiologist, you have to ask the patient’s permission to use an MRI scan performed by someone else, and that permission is only valid for 72 hours. My response is: if it’s not in the law, then you can probably ignore it. Then I get a flood of responses. Dentists and pathologists explain to me that these are codes of conduct that the IGJ also uses and that “therefore” cannot be ignored. Here’s an explanation for them as to why and when certain (but not all) codes of conduct can indeed be ignored.

Soft law is not law

Codes of conduct are soft law, and contrary to what the name suggests, they (like ethics) are not law. They are rules based on ethics, mutually agreed-upon behavior, or contractual agreements that people adhere to, but they are not law. Soft law is used, for example, when one cannot enact or enforce laws, as in international law. It is also used when one does not want to enact formal law, because it is more flexible and one wants to wait and see how a new social phenomenon will develop (such as with franchising). Soft law is also chosen when the sector itself has considerable expertise and good intentions. In such cases, the sector is asked to draw up rules. Soft law is excellent for all of this. However, with soft law, you cannot ignore the rule (Article 5:4 of the General Administrative Law Act) that stipulates that the authority to impose a fine exists only insofar as it is granted by or pursuant to law.

There must be an open norm

But within healthcare, soft law is treated as part of the law. Sometimes this is correct, but sometimes it isn’t. Soft law can only become law if it includes an open standard. An example of such an open standard is: “The healthcare provider offers good care.” What constitutes good care? That means something different for a child psychiatrist than for a heart surgeon, and it’s different in 1995 than in 2025. Therefore, there are all sorts of codes of conduct and protocols by which (disciplinary) judges interpret the concept of good care. But, for example, the Coreon Code of Conduct requires that a medical ethics committee be consulted if there is a suspicion that research may raise privacy concerns, which is the case if personal data is used without consent. There is no open standard anywhere in the law that could lead to this, and therefore this rule is not part of the law.

There must be a judge who applies this

The second thing needed to turn soft law into law is a (disciplinary) judge who actually uses those codes of conduct to give substance to the open standard. Consider the Trias Politica: the legislature can write laws, the judiciary dictates how this should be implemented in practice. The executive branch implements, but cannot write rules. For example, the police cannot decide for themselves that children riding fat bikes will now receive fines. And the Dutch Data Protection Authority may have some opinions on how the GDPR should be interpreted, but that’s all it is. The European Court of Justice recently said precisely that about the European Data Protection Board: an “opinion” is simply an opinion. The IGJ, therefore, also only has an opinion and cannot write rules. The IGJ can indeed impose fines based on codes of conduct, but it is then up to the judiciary to verify whether the fine is justified or whether it should be overturned.

And it must comply with administrative law

And in that test, the judge examines whether there is an open standard that could be fulfilled with a code of conduct. Moreover, the judge assesses whether all administrative law principles, such as the principle of legal certainty and the principle of legality, have been met. Or how about the rule: no punishment without guilt? Wasn’t there also an emergency or an exception? A judge assesses all of that, but of course, your doctors and researchers have to submit it to that judge. He can’t take action on his own. So if you believe the IGJ or the AP is going too far, just take a stand and appeal to the administrative court. After all, the court is there to protect you and the rule of law. When assessing whether a code of conduct might be non-binding, pay close attention to whether we’re talking about the Medical Treatment Contracts Act (WGBO) or administrative law. The Dutch Contracts Act (Wgbo) is part of contract law, and its content is as soft as butter: the supplementary effect of reasonableness and fairness always applies there, meaning there’s always an open standard by which soft law can become part of the law. However, in administrative law (anything that can lead to a fine), the principle of legality applies, and therefore there’s much less room for soft law.

And if not, then you may ignore it

In short: certain codes of conduct or protocols are indeed part of the law, but that doesn’t apply to all codes of conduct. When are you, as a physician or medical researcher, required to follow a code of conduct? (i) If the law contains an open standard, such as “good healthcare provider,” which is much more often the case in contract law than in administrative law; (ii) if a (disciplinary) judge has actually used those codes of conduct to give substance to the open standard; and (iii) if all of this is lawful, predictable, and the violation of the rule was also culpable, meaning there was no emergency situation or anything like that. Isn’t all of that the case? Then ignore the code of conduct if it makes you a lesser healthcare provider. Because that’s ultimately what it’s all about: trying to be a good healthcare provider.

No separate ethical assessment alongside the EHDS

The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.

The concept of Science in the Omnibus

How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.

Long live AI, says AI!

The law is not the same as ethics

Posted on 1 juni 202521 november 2025 by admin

The law is not the same as ethics

Is ethics superior? Or is the law?

To properly understand our legal system and what the EHDS will bring us, it’s important to make a clear distinction between law and ethics. Morality is the question of whether we believe something is right, and the basis for that is ethics (although they are also referred to collectively as ethics). It is therefore a reasoned value judgment. Law, on the other hand, is the set of rules that determine what we may or may not do. Some believe that ethics is superior to law, more important, and more valuable. Others believe that ethics is simply an opinion, while law has been established by the majority of society through the democratic process. It is therefore more valuable than ethics. The question of who is right is irrelevant, as long as the difference is properly understood, and how they relate to each other.

Law is rules plus application

These rules of law are established by the legislature and then applied by courts in a specific case: for example, in the question of whether someone must pay damages. Law is therefore the totality of rules as applied by courts in specific cases. The system is structured in such a way that the highest court is always right; what the highest court declares to be law is, by definition, law. This ensures consistency in the application of law, allowing society to adjust its behavior accordingly. If the law is very clear, the court adds little, but rules are often somewhat vague; judges then elaborate on them. Law is therefore a sum of applied rules.

Ethics complements and forms new law

Ethics can be used by judges to flesh out open-ended norms, as is the case with the terms “good care” or “reasonableness and fairness.” Such vague terms are explained using interpretative methods such as dogmatics (what professors think), legislative history (what has been discussed in parliament), a purely linguistic application, or simply ethics. But when there is no open-ended norm, when it is crystal clear what a rule entails in a specific case, then ethics cannot really play a role; for example, with a statutory term of three years. Ethics is therefore used to give substance to open-ended norms. Moreover, ethics is an important guideline in determining what future law should look like. It then serves as an argument for legislative amendments. In this way, in a democratic society, law and ethics are achieved without significant differences, but that is not necessarily the case. Law is sometimes called “solidified ethics” in healthcare. But that’s only the case if ethics influenced the creation or interpretation of law. The rules on how to establish a private limited company are not solidified ethics, and the law of Nazi Germany was law, but not ethical.

A description of the law is not unethical

In discussions about the law surrounding medical research, which often has ethical implications, ethics and law are often confused. This complicates the discussions, which is why it’s important to clearly distinguish between them. One might feel that you should have a property right to data about yourself, for example, but as long as there’s no legal provision or case law (court rulings) that creates such a right, you don’t have one. One might argue on ethical grounds that an opt-in for secondary use of data would be preferable, but once the EHDS comes into effect, this European law will stipulate that an opt-out is sufficient. Lawyers who explain the law are sometimes accused of being unethical. But they don’t make any pronouncements on ethics; they merely explain how certain rules (probably or certainly) should be interpreted.

This is what the European Parliament thought

Ethics is thus used to define open standards. It also serves as a basis for drafting new laws. This also applies to legislators in Brussels. All Europeans have been patients at some point. They voted collectively on who should sit in the European Parliament. It was recently decided there that an opt-out is sufficient. Apparently, the majority considered this ethical.