The existing free flow of health data
The free movement of health data is not a novelty of the EHDS: it is enshrined in Article 1 of the GDPR, among other. Dr. Vlieger explains which rights scientists can already claim.
My data, my country?
The EHDS stands for European Health Data Space—a European area where health data can flow freely, akin to the free movement of persons and services; there are no longer any internal borders. This core concept often seems to be misunderstood. The Ministry of Health, Welfare and Sport describes the EHDS as an accelerator for the national policy agenda—something otherwise relevant only in exceptional cases involving cross-border care. Privacy activists argue that while scientific research is important, "our" data must not cross borders. Scientists counter that, particularly in the case of rare diseases, they can only effectively do their work if data from various countries can be utilized. They therefore welcome the European Data Space, as it will allow them to access data from across Europe for their research. However, what both parties overlook is that, from a legal standpoint, the free movement of health data within the EU has long been a reality.
European law on data
One of the objectives of the EHDS is to support the free movement of health data. The word "support" is used because this free movement already exists. Often going entirely unnoticed is the provision in Article 1 of the GDPR: "The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data." The GDPR applies only to personal data (where the individuals concerned can reasonably be identified). Consequently, there also exists the virtually unknown Regulation 2018/1807 regarding "the free flow of non-personal data in the European Union." Furthermore, the Open Data Directive (2019/1024) stipulates: "The conditions for the re-use of documents shall be non-discriminatory for comparable categories of re-use, including cross-border re-use." And the Dutch Data Protection Authority should oversee this free flow of personal data.
Scientists can already use this
The free movement of services and goods within the EU was established in 1993 with the introduction of the internal market. It soon became apparent that this internal market could not function without the underlying free movement of data. While data protection can certainly be regulated by the laws of individual Member States, the free movement of data required the harmonization of legislation. Indeed, the free movement of data was a key objective of the GDPR—which is why it is enshrined in Article 1. This means that it is already possible to request data directly from entities such as FinData. Such requests must be treated no differently than those from Finnish researchers, as discrimination between Europeans is prohibited; consequently, no distinction may be made between Dutch and Finnish scientists when a request is submitted. In the future, the EHDS will enable researchers to request data from across Europe through a single application to the Dutch HDAB. However, it is worth noting that, even now, blocking the movement of data at an internal border (a border between EU countries) is prohibited. Scientists can therefore submit requests to work with health data across Europe with immediate effect.
Data Subject control the same for the entire EU
And patients will soon be able to object to certain reuses of data about them via a National Control Register. The Ministry of Health, Welfare and Sport (VWS) must now determine the exact structure of this register. However, European law prohibits structuring this register in such a way that Dutch scientists can work with “our” data, but not Belgian scientists. Considering that these scientists are trying to find a cure for cancer, for example, a cure that will then become internationally available, it makes perfect sense for a legislator to ensure that every scientist in the EU has access to data, not just those from our own academic hospitals. Moreover, under the GDPR, data may already flow to countries for which the EU has issued an adequacy decision. This means that Brussels believes that privacy is adequately protected in countries like Japan. Countries like Japan may eventually join the EHDS, but because they are not part of the EU, you may be asked in the National Register of Control whether you object to data about you also being sent to such non-EU countries.
The free movement of healthcare professionals must not be impeded
It is worth noting that the free movement of data was intended to support the free movement of persons and services within the EU. The underlying rationale—then as now—is that a larger market fosters greater competition, leading to higher quality at lower costs. Brussels wants a skilled Italian winemaker to be able to sell directly online to consumers in Wassenaar; the winemaker gets a better price, and the wine drinkers get better quality. Similarly, a skilled radiologist from the AUMC should be able to directly assess MRI scans from Greece online. This makes better healthcare available across Europe as a whole at a lower cost. The underlying data flow must not stand in the way of such arrangements. Consequently, neither the Dutch nor the Spanish government is permitted to introduce conditions—such as a requirement to register with the national Chamber of Commerce—that would make this impossible. Doing so would violate Article 56 TFEU, a provision of primary European Union law.
The free movement of healthcare ICT
Just as there is already free movement of health data, scientists, patients, and healthcare providers, there is—legally speaking—already free movement of healthcare ICT. The EHDS does not introduce this concept but rather supports something that is currently failing to gain sufficient traction. In this regard, too, the government is prohibited from issuing rules (as is already the case) that favor Dutch companies like Chipsoft while making things difficult for a company like Italy’s Dedalus. Notably, under European law, even subsidy recipients such as Stichting MedMij, Nictiz, or Vecozo are prohibited from taking any action that would hinder foreign ICT providers from entering the Dutch market. In this context, it would be beneficial for health law experts to examine rulings such as Fra.bo, in which the European Court held that European provisions on free movement also apply to private-law organizations when they engage in standardization and certification activities (see also the dissertations by Mirjam Elfrink and James Elliot Construction). National requirements that impede free movement are unenforceable.
In short: the EHDS acts as an accelerator for the European agenda.
The EHDS introduces many new elements, such as a data permit. However, it also encompasses various aspects that are not new at all but are currently simply not being fully realized. Contrary to the claims made by the Ministry of Health, Welfare and Sport (VWS), the EHDS is by no means an accelerator for the Dutch health data agenda. Rather, it accelerates European primary law—specifically regarding the internal market and the free movement of data. This means the EHDS is not intended to support national agendas, but to sweep them aside and replace them with a single European agenda.