Why the EHDS?
What is the EHDS and why does it exist? Dr. Vlieger explains the background, the European data strategy, and the objectives of the regulation.
The free flow of health data
EHDS stands for European Health Data Space. It is a European law that will apply directly in the Netherlands, just like the GDPR. Decades ago, the European Union introduced the free movement of persons, goods, capital, and services. Internal borders within the EU were abolished as much as possible. The aim was to foster economic growth and—among other things—make war more difficult to wage. Brussels soon realized that this free movement would not function effectively without the free movement of data. Consequently, a borderless European data space was required. The GDPR (and its predecessors) represented the first step in this direction; achieving the free flow of data necessitated the harmonization of data protection across Europe. While individual countries are capable of protecting privacy on their own, uniform data protection was essential specifically to enable the free movement of data. The FFD established similar provisions for non-personal data.
A data legislation matrix
Subsequently, a European data strategy was developed that is best described as a three-dimensional legislative matrix. First, there are rules regarding data protection; these are found in the GDPR, as well as in legislation such as the Database Directive and the Trade Secrets Directive. On the other hand, there are rules designed to stimulate data usage and create a healthy data market; these include the Open Data Directive, the Data Act, and the Data Governance Act. Thirdly, there are (and will be) rules concerning specific types of data content. To this end, nine "data spaces" have been designated, covering areas such as financial data, transport data, and—crucially—health data. When reading the EHDS, therefore, one must bear in mind that the regulation can only be fully understood as a component of a broader, complementary legal framework—encompassing European laws like the GDPR and other data legislation, as well as Dutch laws such as the General Administrative Law Act.
An economic perspective on healthcare
The EHDS aims to improve healthcare in Europe by enabling the free movement of patients, healthcare professionals, and medical researchers. It was anticipated that the free movement of goods and services would lead to economic growth and better products—an expectation that proved correct. Supporting regulations were introduced, such as the rule allowing consumers to return products ordered online from anywhere in the EU within two weeks. This instills the confidence that one can order directly from across Europe. For instance, a quality Italian organic farmer can serve the wine market in Wassenaar; prices drop while quality rises. Similar benefits are expected in the healthcare sector. The aim is for Dutch radiologists, for example, to be able to interpret MRI scans from across the EU. Brussels anticipates that this will make healthcare both cheaper and better, which is why the free movement of services—including healthcare services—is being enforced.
Broader data availability
In addition, the EHDS aims to foster innovation by making health data available for beneficial reuse. Universities, companies, and citizens will all be able to apply for a permit to work with health data. Whether a permit is granted depends on whether the applicant is pursuing a beneficial purpose—such as education, scientific research, or statistics, as well as the development of new products or the training of AI systems. Decisions regarding applications can be challenged in court, where they can be reviewed against criteria such as the prohibition of discrimination and academic freedom. For instance, it would no longer be permissible for a university hospital to share data with medical professionals while withholding it from researchers in the computer science department.
Within strict legal frameworks
Careless handling of health data is problematic, unethical, and unlawful. Under the GDPR, sharing is permitted only if there are sufficient “technical and organisational safeguards” in place. The EHDS prescribes what this entails. With certain exceptions, a permit must be obtained from the Health Data Access Body, a new government agency. The permit sets out the exact conditions, and the EHDS also lists actions that are prohibited with regard to the data. Violating these conditions carries penalties. Instead of receiving the data itself, one is granted access to it within a secure processing environment. The aim is to make more knowledge available securely across the entire Union; after all, in addition to a right to data protection, we also have a right to information.