The Dutch Bodily Material Act must be rewritten

Posted on 26 augustus 202521 november 2025 by admin

The draft Bodily Material Act (WZL) must be rewritten

The WZL versus the EHDS

The European Health Data Space Regulation concerns data, not bodily material. The draft Bodily Material Act (WZL) concerns material, not data. Therefore, based on the names of the two laws, one might assume there is no overlap. Therefore, there would be no reason to discuss the WZL on this website. I will discuss it anyway, because there is more overlap than one might think. When you extract data from material, you are doing something with both data and material. Moreover, the Guidelines for Regulations (rules on how to write laws) stipulate that new laws must always be carefully considered to determine their true necessity. Moreover, they must be harmonized with existing regulations as much as possible. Moreover, many (incorrectly) believe that the WZL does indeed concern data from material, while the EHDS explicitly does. For these three reasons, I will discuss the draft WZL here. Spoiler alert: it’s rubbish.

Why the WZL?

First, a little background on the WZL. Scientists are usually concerned with data from the material, not the material itself (unless, for example, they need material for a surgery class). They find this so logical that the two get confused. For lawyers, bodily material is completely different from data from the material. Previously, these were clearly legally separated. The WGBO (Dutch Medical Treatment Contracts Act) contains a statutory provision on the reuse of material (7:467 BW) and a statutory provision on the reuse of patient data (7:458). Because people often want to extract data from material, the law states: “Research with anonymous substances and parts separated from the body is understood to mean research in which it is guaranteed that the bodily material to be used in the research and the data to be obtained from it cannot be traced back to the person.”

So, as soon as you extract patient data from the material, you no longer fall under the article about the material, but under the article about data. This prevented duplication, and that was perfectly arranged. The problem is that over time, the legal article about material has been interpreted differently. Some believed that if traceable data were extracted, consent was always required (perhaps based on invalid a contrario reasoning applied to Article 7:467 of the Dutch Civil Code?), while the other legal article (Article 7:458 of the Dutch Civil Code) states: consent unless unreasonable.

What is anonymous?

Moreover, bodily material was previously generally considered anonymous: you can’t tell who a drop of blood belongs to. But now that DNA can be extracted from a drop of blood, it was argued that bodily material is essentially no longer anonymous. This conflicts with European (GDPR) case law regarding when something is considered personal data. This is based on a relative concept. Whether privacy is at stake and therefore whether the GDPR applies depends on who is processing the data and what that processing entails. This (case law on the) GDPR is relevant because, when the GDPR Implementation Act was drafted (Article 24), specific reference was made to the Medical Treatment Contracts Act (WGBO): these articles were intended to provide the same framework. However, this relative approach to personal data seems to have had no effect on how bodily material is treated. This may be because the experts cited in this regard are medical scientists, not lawyers. They will have concluded that material is never technically anonymous again, but that is a different matter from the question of whether it is legally anonymous.

All those biobanks...

Because the law stipulates that one can opt out of material unless it is not anonymous, many now believe that bodily material is never anonymous and therefore (almost) always requires consent. This is often difficult for scientists to handle. In my opinion, this difficulty lies in a misreading of the legal provisions, and in this regard, a legislative amendment was therefore unnecessary. However, this doesn’t change the fact that the House of Representatives simultaneously became uneasy about the fact that a large amount of material (from millions of Dutch people) was now being stored in biobanks, with little oversight. A law was therefore necessary, and that argument hasn’t been dismissed yet: and therefore, “a” WZL (Wiseness of the Authorization of Bodily Material) is necessary. However, the confusion about material versus data from that material has only increased with this draft law on the control of bodily material.

Double rules

The WZL itself explicitly states, “This law applies to procedures involving bodily material (…).” This is problematic in itself. Firstly, because the article in the WGBO stipulated: this article applies to bodily material, unless (traceable) data is extracted from it, in which case you fall under the article on data. This “unless” provision is not in the WZL. This means that if personal data is extracted from bodily material, it will soon fall under the WZL because it involves bodily material, and it will also fall under the GDPR (and soon the EHDS) because it involves personal data (and health data). This means that under the WZL, you must check whether an objection has been filed (via a separate system), while under the EHDS, you must also check whether an objection has been filed in the National Control Register.

This is despite the fact that the intention is to reduce the administrative burden, and the Guidelines for Regulations stipulate that harmonization must be as high as possible. Why the WZL isn’t aligned with the EHDS is therefore a mystery to me. Moreover, it’s unacceptable to choose to have data extraction from material fall solely under the WZL, as that is a Dutch law that cannot override the European GDPR. It should be the other way around: it should be explicitly stated that if personal data is extracted from material, it no longer falls under the WZL but under the GDPR. This is currently lacking.

But the WZL is not about the data itself

But it’s also problematic because it escapes almost everyone’s attention that the WZL concerns actions with material (including data extraction), but not with that data itself. Even the Council of State recently wrote in an advisory opinion: “A regulation will also be introduced for the (further) processing of personal data (health-related) for this situation.” That’s not the case. But if even the Council of State is confused about this, then so must be almost the entire field. It becomes even more serious when one examines precisely when the law will apply: “This law applies to actions with bodily material that has been (…) collected (…) in connection with medicine (…) and which actions are intended for a purpose other than (…) assessing the patient’s state of health.”

Bodily material (such as drops of blood or a piece of skin) is often collected for the care of a specific patient. Afterward, it is stored, still for that specific patient, due to the obligation to keep records of what is done and why. The WZL will therefore not apply in this case, while the article from the WGBO (Dutch Medical Treatment Contracts Act) on material will be repealed. This means that as long as no scientist is interested in the material, no regulations apply. But it gets even stranger. Because if a scientist becomes interested in the material after three years, the WZL will apply, and it will then stipulate (in 2028) that information must be provided to the patient when collecting it. But that was three years earlier, in 2025. How can a law now stipulate that it will apply in 2028, which then prescribes that something must be done three years earlier? I really don’t get it.

Nobody owns it

Another problem is that the bill appears to be based on incorrect assumptions. The Consultation Version of the Second Amendment Memorandum to the Bill on Control of Body Material, dated June 10, 2024, refers four times to a report. This report contains several remarkable statements. For example, on page 55 it states: “Our law primarily considers materials separated from the body as ‘substances susceptible to human control’ (Article 3:2 of the Dutch Civil Code). Ownership can then be considered. The person from whom the body material originates becomes the owner of that material.” This is incorrect. Article 3:2 of the Dutch Civil Code states: “Things are tangible objects susceptible to human control,” to which Article 5:1 of the Dutch Civil Code adds: “Ownership is the most comprehensive right a person can have in a thing.”

This “possession” does not imply that every thing is subject to ownership. You can only own something if it is also subject to possession, because you can only become an owner through transfer of possession, taking possession, or possession plus prescription. Everything “outside of commerce,” as it has been defined for centuries, is not subject to possession and therefore also not subject to ownership. If too much skin is wrongly removed, this may be abuse, but you cannot report theft to the police. No one owns bodily material, just as no one owns health data (one cannot own “the sun is hot,” and therefore also not “the patient has a fever.”).

Provide control, but harmonize

Intuitively, we feel that patients should perhaps have some control over their bodily material, but this is separate from the concept of ownership. Similarly, under the GDPR, patients have control rights over data to protect their privacy, which are therefore entirely independent of the question of ownership. The GDPR stipulates that a balance must always be struck between the interests of privacy and the interests of data use. And this should also be the case with bodily material. Therefore, the WZL should, where possible, align as closely as possible with the GDPR and the upcoming EHDS, and the subtle balance sought in these two regulations between the interests of privacy and the interests of data freedom. However, the WZL wrongly fails to align with the EHDS at all. In that regard, the recent report from the Council of State was indeed correct. Such a lack of harmonization violates Article 2.45 of the aforementioned Guidelines for Regulations, which stipulates that this should be pursued as much as possible.

Physical integrity not at stake

The decision not to align fully with the GDPR and the EHDS also appears to be related (besides the confusion of data and material) to the confusion of body and bodily material. The moment material is taken from a patient, at that moment, bodily integrity is compromised. This is no longer the case when a sample is retrieved from an archive for research five years later. Three situations can be distinguished regarding collection: collection for care, collection for care and research, and collection solely for research. The Medical Research Involving Human Subjects Act (WMO) applies to this third issue. This Act contains strict safeguards to protect the patient’s health and bodily integrity. There was some uncertainty about the extent to which this law also applied in the second situation: when an additional tube of blood is collected. In that case, too, the patient’s body is at stake, and ethical questions arise. However, if an existing sample is retrieved for research, only privacy issues arise.

So why an ethical assessment?

Despite this, the WZL stipulates that material managers must always have regulations that have been approved by an ethics committee. But this is very odd for a situation in which there are no ethical questions at all: the situation in which material was collected solely for healthcare purposes. If one only realizes afterward that this material might also be useful for research, bodily integrity is not at stake at all. The only question then is whether the patient’s privacy is sufficiently protected, which is already addressed by the GDPR and the EHDS. Why a Medical Ethics Review Committee needs to be involved in this is incomprehensible. These review committees are extremely valuable in medical research involving human subjects. Patients who think they might die say yes to everything. And then a review committee has to look into whether the risk to the patient is not too great, or whether the chance of a beneficial effect from the research is not too small. This ethical constellation is completely irrelevant when a piece of skin taken three years earlier is used. Therefore, it is incomprehensible why the ethics review committee needs to be involved in this.

In short: back to the drawing board

All in all, the WZL is an incomprehensible law, while the Explanatory Memorandum precisely states that it aims to provide clarity. Furthermore, the WZL is not in line with the Guidelines for Regulations because it is not optimally aligned with the GDPR and the EHDS. Therefore, the draft WZL must simply be scrapped. No minor adjustments, as was previously the case. A completely new WZL needs to be written (i) that precludes the dual application of rules to the same action, (ii) that aligns as closely as possible with the GDPR and the EHDS, (iii) that regulates control through the National Control Register, (iv) that, following the GDPR, opts for a risk-benefit assessment, and (v) that omits the ethical review if privacy is at stake but physical integrity is not.

The Dutch Bodily Material Act must be rewritten

The EHDS is about data, not bodily material. The Dutch draft Bodily Material Act is about material, not data. This might lead one to believe there's no overlap. But if you extract data from material, you're doing something with both data and material. That's why I'm discussing my thoughts on the draft act here. Spoiler alert: it's not good.

The Health Data Access Body

The Ministry of Health, Welfare and Sport will soon determine who will become the HDAB; who will be the source of permits for the beneficial reuse of health data. Who can be this, and who cannot? And what will this HDAB be responsible for?

The EHDS and the Secure Processing Environment

Under the EHDS, work must be performed in a Secure Processing Environment (SPE). Scientists don't receive data, but access it in a SPE that meets the strict technical and security standards established under the EHDS. What does this entail? And will everyone be required to work in such a SPE from now on? Will it become a supercomputer containing all our health data?

The EHDS and the Secure Processing Environment

Posted on 10 augustus 202521 november 2025 by admin

The EHDS and the secure processing environment

Technical Requirements of the European Commission

Under the EHDS, work must be carried out in a Secure Processing Environment (SPE). Scientists will not receive data, but will have access to it in a SPE that meets the strict technical and security standards established under the EHDS. The exact nature of these requirements is not yet known. They will be established by the European Commission by March 2027 (see timeline). The European Commission will also assist Member States in promoting the security and interoperability of the various SPEs. Such security requirements cannot be prescribed in the EHDS itself. Risks and security evolve faster than new European legislation.

HDAB and Trusted Data Holders monitor

Please note: there are parties who claim that there will only be one single BVO, managed by the HDAB. This would then become a supercomputer containing all Dutch healthcare data. This is not the case. The EHDS clearly speaks of multiple SPEs. Every Trusted Data Holder (TDH) must also have an SPE, and it is likely that all the academic hospitals, among others, could become such. The HDAB and the TDHs must always monitor what exactly happens in their SPE, so that scientists are only granted access in line with the exact conditions of their permit.

Therefore, those who hold an SPE must be able to enforce compliance with both the GDPR and the EHDS. Scientists may not simply grant access to another scientist who is not also listed on the permit. And only non-personal data (i.e., anonymous or aggregated data) may be downloaded from such a SPE. They may, of course, be transferred from one SPE to another, for which interoperability must be achieved. The log data of processing operations within the SPE must be retained for at least one year to verify compliance with the permit conditions. In this way, the SPE is an essential safeguard for protecting the rights and freedoms of patients with regard to the processing of their health data for secondary use.

The SPE should always be mandatory

There is criticism (in The Netherlands) of the EHDS, which aims to make more health data available for beneficial reuse. It is important to keep in mind that the idea of this law is to make more data available, precisely by making it more secure; in the certified SPEs. It is important to note here that there are people who think that you will soon be able to freely choose whether to apply for a data permit, and that you will thereby ensure that you fall under the EHDS. It follows that you would also be able to choose whether or not you are obliged to work in a SPE. That you can choose whether you are obliged to do something seems an untenable position to me. But if it turns out that I am wrong, and people can indeed freely choose whether to apply for a permit, then the implementing legislation should include that working in a SPE (as described by the European Commission) will always be mandatory from 2029, even if one does not follow the route via the HDAB.

The Dutch Bodily Material Act must be rewritten

The Health Data Access Body

The EHDS and the Secure Processing Environment

The EHDS leads to greater health (data) safety

Posted on 10 augustus 202521 november 2025 by admin

The EHDS actually leads to more health (data) safety

The introduction of the EHDS is causing public unrest. Will our health data still be safe? The regulation will indeed make more data available for beneficial reuse, such as scientific research. But the idea behind the regulation is to make more data available precisely by improving its security. To this end, the permit is being introduced and an HDAB must be established as a health data police. Moreover, the EHDS includes a list of prohibited uses, which could have far-reaching consequences for the tobacco industry, among others.

Permit required

First of all, the EHDS stipulates that working with health data requires a permit. There’s debate about whether one can choose whether to apply for one, as the Ministry of Health, Welfare and Sport (VWS) states. I find this a strange position: you can’t choose whether to apply for a tree-felling permit, a building permit, or a catering permit. The whole point of the permit is to allow the government to monitor the process, ensuring compliance with all (safety) regulations. As I read the regulation, a permit will almost always be required. The EHDS then stipulates that health data may only be used in accordance with the conditions stipulated in the permit. These conditions must include, among other things, the exact names of the researchers authorized to access the data. If a person isn’t listed in the permit, they can’t access the data. Moreover, it’s strictly forbidden to determine who the (anonymous or pseudonymous) data relates to.

HDAB supervises

The permit is being requested from the Health Data Access Body. In the Netherlands, they are currently busy designing all sorts of ICT tools for this HDAB. But anyone who carefully studies the EHDS will see that the newly established government agency will primarily act as the health data police. Failure to comply with the permit conditions or other legislation can result in the HDAB imposing substantial fines (up to €20 million or 4% of annual turnover). Moreover, interested parties can submit enforcement requests to the HDAB, forcing the government to take action if health data is handled too carelessly. You might think the Dutch Data Protection Authority already had this capability, but the EHDS goes much further. It contains a particularly interesting list: prohibited uses.

The following is prohibited under the EHDS:

taking decisions which adversely affect a natural person or a group of natural persons on the basis of their electronic health data; in order to be qualified as ‘decisions’ for the purposes of this point, they must produce legal, social or economic effects or significantly affect those natural persons in a similar manner;
taking decisions with regard to a natural person or a group of natural persons regarding job vacancies, offering less favourable terms for the supply of goods or services, including refusing to grant such persons or groups an insurance or credit agreement, changing their contributions and insurance premiums or loan terms, or taking other decisions with regard to a natural person or a group of natural persons which result in them being discriminated against on the basis of the health data obtained;
Carrying out advertising or marketing activities;
Developing products or services that may be harmful to individuals, public health, or society in general, such as illegal drugs, alcoholic beverages, tobacco and nicotine products, weapons, or products or services designed or modified in such a way that they lead to addiction, are contrary to public order, or pose a risk to human health;
Carrying out activities that violate ethical provisions laid down in national law.

Let what’s written here sink in: you may not use health data to develop addictive products. As mentioned, there’s some confusion about when the EHDS applies. The Ministry of Health, Welfare and Sport’s interpretation is that you can choose whether to apply for a permit and therefore whether you fall under the EHDS. This also allows the tobacco industry to choose whether to adhere to the prohibited list. That seems like an untenable position to me. The EHDS states: users of health data may only access and process health data for secondary use in accordance with a data permit. It seems to me that a permit is always required in that case (unless the EHDS does not apply under Article 1, which contains some exceptions). If my interpretation is correct, the effect of the list of prohibited uses will be significant! Because then it will be prohibited from now on to use health data to develop any addictive product whatsoever. Kudos to the authors of this regulation.

So the EHDS is great!

The introduction of the EHDS is causing social unrest. There are fears, for example, that secondary use could lead to someone losing insurance or a job. This shows that people haven’t read the EHDS, because this is explicitly stated in the list of prohibited uses. Because the EHDS is very beneficial to medical scientific research, it can be useful to emphasize that the EHDS explicitly prohibits all sorts of things. Another advantage of the list of prohibited uses is that the newly established HDAB is designated as the authority that must enforce it, and where enforcement requests can therefore also be submitted. But above all, we must realize that the EU seems to have, in a roundabout way, given us a legal tool against the tobacco industry. So far, it has not succeeded in banning tobacco, but it does seem to have succeeded in prohibiting research into how to make tobacco even more addictive. Time will tell how much pleasure we will get from this prohibited list. Perhaps it can also be used to combat the addictiveness of apps? Will HDAB soon get my child off social media? I’m eagerly anticipating the fantastic benefits EHDS can bring us.

The Dutch Bodily Material Act must be rewritten

The Health Data Access Body

The EHDS and the Secure Processing Environment

The existing free flow of health data

Posted on 2 juni 202521 november 2025 by admin

The (already existing) free flow of health data

My data in my country?

In discussions about the reuse of health data, national borders are often discussed. This secondary use requires a proper balance between privacy on the one hand and the importance of, for example, scientific research or being able to assess the effectiveness of a certain policy on the other. Privacy advocates often believe that “our” data should not be allowed to cross borders when reused, or that you should at least be able to indicate in the National Register of Authorities that this is not permitted with “your” data. Scientists, on the other hand, argue that, for example, with rare diseases, they can only do their work effectively if data from different countries can be used. Therefore, they welcome the EHDS, which stipulates, among other things, that they will be able to request data from all over Europe. What both parties overlook is that the free flow of health data within the EU has long existed.

European law on data

One of the objectives of the EHDS is to support the free movement of health data. It says “support” because this free movement already exists. Completely unnoticed is the provision in Article 1 of the GDPR: “The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.” The GDPR only applies to personal data (where one can reasonably identify the individuals concerned). Therefore, alongside it exists the completely unknown Regulation 2018/1807 on “the free movement of non-personal data within the European Union.” The Open Data Directive 2019/1024 further stipulates: “The conditions for the re-use of documents shall not discriminate against comparable categories of re-use, including re-use across national borders.”

Scientists can already use this

The free movement of goods and services within the EU began in 1993 with the introduction of the internal market. It soon became clear that the internal market was not possible without the free movement of data. Data protection can easily be regulated in the law of an individual member state, but free movement required harmonization (alignment) of legislation. The free movement of data was precisely a key objective of the GDPR, hence its inclusion in Article 1. This means that people can already request data directly from, for example, FinData. This request may not be treated differently from requests from Finnish researchers, as there is also a prohibition on discrimination between Europeans. Therefore, no distinction may be made between Dutch or Finnish scientists in a request. The EHDS will soon make it possible to request data from all over Europe with a single request to the Dutch HDAB. However, it would be helpful if scientists and statisticians were aware that it is already prohibited to hold data at an internal border (a border between EU countries). They can therefore immediately submit requests to work with health data throughout Europe.

Data Subject control the same for the entire EU

And patients will soon be able to object to certain reuses of data about them via a National Control Register. The Ministry of Health, Welfare and Sport (VWS) must now determine the exact structure of this register. However, European law prohibits structuring this register in such a way that Dutch scientists can work with “our” data, but not Belgian scientists. Considering that these scientists are trying to find a cure for cancer, for example, a cure that will then become internationally available, it makes perfect sense for a legislator to ensure that every scientist in the EU has access to data, not just those from our own academic hospitals. Moreover, under the GDPR, data may already flow to countries for which the EU has issued an adequacy decision. This means that Brussels believes that privacy is adequately protected in countries like Japan. Countries like Japan may eventually join the EHDS, but because they are not part of the EU, you may be asked in the National Register of Control whether you object to data about you also being sent to such non-EU countries.

So the BSN may not be withheld either

Note: this free flow of data was intended to support the free movement of goods and services within the EU. The idea behind it was: the larger the market, the more competition, which will lead to higher quality at lower borders. Brussels wants a good winegrower in Italy to be able to sell directly to people in Wassenaar. Similarly, a good radiologist should be able to directly assess MRI scans in Greece. This will make better care available in Europe at a lower price. The underlying data traffic shouldn’t stand in the way of this. In the Netherlands, some people believe that the Citizen Service Number (BSN) cannot be used across the border because the law doesn’t say otherwise. But that seems to me to be a typical situation that, if Dutch law were to actually entail this, would be invalid under Article 1 of the GDPR. Personal data may not be withheld at an internal EU border, and that also applies to the Citizen Service Number (BSN).

The Dutch Bodily Material Act must be rewritten

The Health Data Access Body

The EHDS and the Secure Processing Environment

What is a DPIA, what not?

Posted on 14 mei 202521 november 2025 by admin

What is a DPIA, what not?

A DPIA is a Data Protection Impact Assessment. It is mandatory under the GDPR in certain cases. What is it and what isn’t it? When is it mandatory? And what is the role of the Data Protection Officer?

What is the DPIA?

The DPIA is the report of a thorough brainstorming session. A plan has been made to do something with personal data, but this could pose risks with regard to privacy. Therefore, the DPIA outlines step by step exactly what processing operations are planned and for what purpose; what the risks are; whether these risks can be adequately covered; whether everything complies with the GDPR; whether any remaining risks that cannot be covered are proportionate to the purpose; and whether, based on all of this, the plans may or may not be implemented. In other words, it is a comprehensive, step-by-step analysis of whether certain plans are actually such a good idea, in light of privacy. Under certain circumstances, data subjects, such as patient associations or employees (via the Works Council), must be involved in this process.

What is the DPIA not?

The DPIA isn’t some sort of ritual. Model DPIAs are often used. There’s nothing wrong with them if they’re used correctly, namely as a tool for a thorough analysis. However, when the model is used as a form that simply has to be filled out, things go wrong. The DPIA isn’t intended to ensure that something is permitted, but to answer the question of whether something is permitted. Moreover, the DPIA isn’t a marketing tool. It’s intended for internal consideration, not to externally demonstrate the enormous importance one attaches to the GDPR. Furthermore, it’s unwise to conduct DPIAs before answering the question of whether one is actually a controller. A processor is someone who processes personal data on behalf of someone else; the controller. The processor may not make themselves a controller. By conducting DPIAs on data for which one is not a controller, one runs the risk of becoming one.

When is it required?

The DPIA must be carried out “when a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing.” DPIAs are required in particular for:

A systematic and extensive assessment of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or significantly affect certain individuals in a similar manner;
2. Large-scale processing of special categories of personal data or criminal record data;
3. Systematic and large-scale monitoring of publicly accessible spaces;
4. Everything that has been placed on the DPIA list by the Data Protection Authority.

Note that processing special personal data does not always require a DPIA. This is only the case if processing is on a large scale. What is typically done by individual healthcare providers is not covered.

When is it not required?

A DPIA is required for processing operations that are “likely to pose a high risk,” but if it is clear that there are no risks, it is not necessary. Moreover, it is not necessary to conduct a DPIA every time for similar processing operations; if an academic hospital regularly conducts medical research with its own health data in its own secure processing environment, a DPIA does not need to be conducted every time. The data set may be different, but the processing operations are similar. A DPIA is also not required if there is a legal obligation or a statutory task, provided that an impact assessment was already conducted when that law was drafted (unless, of course, that law subsequently requires a DPIA).

Role of the Data Protection Officer

Contrary to popular belief, the DPIA is not carried out by the Data Protection Officer (DPO). However, the controller must consult the DPO (if they have one). If there is indeed an obligation to conduct a DPIA, appointing a DPO will usually also be mandatory. The DPO themselves do not know exactly what the controller has in mind regarding high-risk processing. This must therefore be explained to the DPO, outlining the plan and its rationale, the perceived risks, and the security measures envisioned. The DPO then advises whether the planned measures appear sufficient and whether they appear to comply with the GDPR. However, the DPO does not perform the analysis themselves, nor does it decide whether a plan can proceed. And the DPO certainly does not have the role of simply handing out green checks.

The Dutch Bodily Material Act must be rewritten

The Health Data Access Body

The EHDS and the Secure Processing Environment

GDPR, purpose limitation, science and corona

Posted on 14 mei 202521 november 2025 by admin

GDPR, Purpose Limitation, Science and Corona

Medical scientists trying to gather data for (undeniably useful) research are sometimes faced with rejection due to “purpose limitation.” For example, someone had collected data for research into unexplained excess mortality after COVID-19. When she subsequently wanted to use that same data for research on Long-Covid, it was denied. Purpose limitation! But is that correct?

The principle of purpose limitation can be found in the GDPR. It states that (1) personal data may only be collected for specified and legitimate purposes, and (2) it may not subsequently be used in a way “incompatible with those purposes.” The latter is the principle of purpose limitation, and it logically follows from the first. Prescribing that you may only collect data for specific, legitimate purposes is pointless if you can then do something completely different with it. Whether there are valid “purposes” must be assessed against the GDPR article that sets out the “grounds.” This is often taken for granted, while it simply boils down to the question: do you have a legitimate and good purpose for doing what you’re doing?

The GDPR article on lawful purposes or conditions, also explains when you’re allowed to do something slightly different with that data; if there’s a compatible purpose. For example, Netflix primarily collected customers’ personal data to provide paid streaming services. However, the company is also allowed to use that data to take action against subscription abuse. These are sufficiently connected, and customers can reasonably expect such a thing to happen. That’s therefore “compatible” use of personal data. If that’s not the case, if it’s not sufficiently connected, then there are three possibilities: a law prescribes that it’s allowed anyway, you have permission, or you simply have to collect new data.

The latter is, of course, a problem for scientists. Because if data has been collected to provide care to someone with complaints, that’s quite different from using that data to investigate whether AI can help identify someone’s condition sooner. The connection becomes even more remote if you’ve collected data to track down cybercriminals, and then criminologists want to study that data to investigate why someone becomes a cybercriminal in the first place. Can such a thing be prevented? Then the use is truly no longer related to the previous purpose, nor is it use that the data subjects could reasonably expect. Asking those cybercriminals for consent is a rather hopeless mission, but so is generating new data. Therefore, a law is needed that stipulates that such a thing is permitted.

The good thing is that they’ve already addressed this in the GDPR itself. The article on purpose limitation immediately states: further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes is not considered incompatible with the original purposes. In simpler terms: the principle of purpose limitation simply doesn’t apply to science and statistics.

Of course, this doesn’t mean that everything is suddenly permitted under the guise of science, statistics, or archiving. Although there is a general exception to the principle of purpose limitation for scientific purposes, specific research can still be prohibited. After all, you must also meet other requirements of the GDPR, such as taking sufficient technical and organizational measures to secure everything; for example, anonymization or pseudonymization, or working in a highly secure processing environment that you can only access with a crowbar (as criminologists have devised).

If the data you’re working with is special personal data (which is what health data is), you also need an exception to the prohibition on using it. This prohibition is essentially medical confidentiality. It’s not in healthcare law, but in the GDPR. It doesn’t apply to people with a specific profession, but to everyone, with regard to certain types of data. Very useful. One such exception to medical confidentiality is: you may use health data for medical research if you’ve asked for consent, unless that’s unreasonable. When it comes to big data research, that’s unreasonable, and consent isn’t required.

All this means: if you’re conducting big data research on, for example, excess mortality and long-term COVID, if the government funds it because it’s well-designed and genuinely useful, and if the requirements are met because you’re working in a highly secure processing environment, then the principle of purpose limitation doesn’t apply. In that respect, you don’t need consent. You might still need consent to breach (universal) medical confidentiality, but that’s a different matter. And in that case, consent isn’t required if the data involves a large amount of data. Incidentally, the rules regarding consent will change under the EHDS. However, the GDPR will remain in effect, and the rule that there’s a general exception to the principle of purpose limitation for the purposes of science and statistics remains unchanged.

The Dutch Bodily Material Act must be rewritten

The Health Data Access Body

The EHDS and the Secure Processing Environment

Pseudonymization and the GDPR

Posted on 30 maart 202521 november 2025 by admin

Pseudonymization and the GDPR

Pseudonymisation is a term from the GDPR that causes a lot of confusion. Is this personal data, and therefore does the GDPR apply to it, or not? As is so often the case, the answer from lawyers is: it depends. That’s because pseudonymous data is not a category or type of data. Pseudonymisation is only listed in the GDPR as a technique: Article 4(5) states: “Pseudonymisation” is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.”

Simply put, pseudonymization means replacing “Antoinette Vlieger” with, for example, the number “1973.” The difference with anonymization is that there’s still a key or list that allows you to determine that number 1973 is Vlieger. In medical science, you almost always want to pseudonymize rather than anonymize. This allows findings to be relayed back to the treating physician if necessary, or additional information can be requested if it later proves necessary for the research.

But keep in mind that there’s always a difference between everyday language and legalese (like lawyers explaining at parties: this wasn’t murder but manslaughter, while for everyone around them it was murder). In everyday language, pseudonymization is therefore the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information. However, the GDPR adds another component: “provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.” It must also be recorded who has (exclusive) access to the key.

Does the GDPR apply to pseudonymous data?

So does the GDPR apply to such data or not? That depends on whether it is “personal data,” and the term “personal data” is a relative term. The GDPR applies when someone’s privacy is at stake, because the data can be traced back to a specific person. If an academic hospital is conducting research on patient number 1973, and they themselves have the list indicating that this concerns Vlieger, then that data is personal data for that hospital. If they provide this data (to train an AI tool) to mathematicians who do not have the list, then it is not personal data for those mathematicians; the GDPR does not apply. If the same set of data is given to Statistics Netherlands (CBS)—which also does not have the list, but can combine the data with its own data, making it clear who the data concerns—then the data is personal data for CBS. And even more complicated: if the mathematicians, for whom the data is not personal data, post the data on a public website, allowing Statistics Netherlands (CBS) to access it (for whom the data is personal data), then when it is made public it is again personal data and therefore the GDPR does apply; this also applies to the mathematicians.

The GDPR therefore applies to personal data; held by specific individuals and in a specific context. Pseudonymous data is sometimes personal data, and sometimes not. And you should be equally careful with the concept of anonymous data. Absolutely anonymous data is anonymous to everyone. This is not personal data, and the GDPR does not apply to it. But there is also relatively anonymous data; anonymous to me, but not to Statistics Netherlands (CBS). To avoid confusion, it is better to refer to only absolutely anonymous data as anonymous. The GDPR does not apply to this anyway. However, with regard to relatively anonymous data and pseudonymous data, the applicability of the GDPR must be assessed each time.

Is this confirmed in case law?

Many people are eager to know if the European courts have confirmed the above. However, there’s no case law on the concept of pseudonymization itself. While there is case law that does address pseudonymized data, it consistently applies the case law on the concept of “personal data.”

The judgment in SRB/EDPS (CJEU, 26 April 2023, T-557/20, ECLI:EU:T:2023:219) clearly illustrates how the European Court of Justice addresses this issue. The EDPS states that the data the SRB shared with Deloitte were pseudonymized and therefore personal data (paragraph 32). The SRB argues that, for the recipient, Deloitte, the data are not pseudonymous but anonymous, since the SRB did not share with Deloitte the information that could be used to re-identify the data (paragraph 76). It is striking that the judges in the judgment do not address whether the data were pseudonymous or anonymous, but only whether they were personal data. And that is the end of the matter. The case is now on appeal and the Advocate General makes a clear statement on this (6 February 2025, C-413/23P, ECLI:EU:C:2025:59) in recital 52: It is not the case that pseudonymised data are automatically not personal data, because “under certain conditions” they are personal data; but not always.

EDPB Directive 01/2025 on pseudonymisation, of 16 January 2025, similarly states (recital 22): If pseudonymised data and additional information may be combined taking into account the means reasonably used by the controller or by another person, the pseudonymised data constitute personal data.

Is pseudonymization always mandatory?

So, sometimes the GDPR applies to pseudonymous data, sometimes not. But if you haven’t yet done so, is it mandatory under the GDPR? The legal answer to that, too, is: sometimes yes, sometimes no. The short answer is: if it’s possible, it must be done (and as quickly as possible), but if it’s not possible, you can still use the data, depending on the circumstances; for a compelling purpose and provided it’s very well secured.