GIS Act: why the HDAB needs legal personality
The Draft GIS Act (concerning the EHDS) creates a supervisory body whereby the State imposes fines on itself. Without its own legal personality and separate from VWS, the GDA is not the independent HDAB required by the EHDS. This article explains why — and proposes an alternative.
The GIS Act: a government fining itself?
The Ministry of Health (VWS) is publicly inviting input on the draft GIS Act (in effect the EHDS implementing act). From a European and administrative-law perspective, however, this proposal contains a structural flaw concerning the independence of the new Health Data Authority (GezondheidsData-Autoriteit, GDA).
The GDA will be given the enforcement tasks for secondary data use and will therefore be the body that the EHDS designates as the HDAB. It will become an administrative authority with the power (and thus, in principle, also the duty) to impose fines. Yet the Explanatory Memorandum states explicitly that it is not necessary to give the GDA its own legal personality; the authority will simply remain part of the State.
One pocket to the other / independence
This leads to an administrative-law absurdity. If, for example, the RIVM (also part of the State) infringes the EHDS, the State will be imposing an inter-administrative fine on the State. Legally speaking this is possible, but it is a classic case of moving money from one pocket to the other, since the proceeds flow straight back into the State's own coffers. The deterrent effect is therefore virtually nil.
VWS will no doubt seek to counter this with the argument that the GDA is to become an independent administrative body (zelfstandig bestuursorgaan, ZBO), so that the Minister is kept at arm's length. As a matter of European law, however, that defence is insufficient. In respect of this supervisory authority (the HDAB), the EHDS expressly requires the following: "In carrying out their tasks [...] the bodies shall avoid any conflicts of interest. The staff [...] shall act in the public interest and in an independent manner."
A paper ZBO status offers no genuine independence for as long as the GDA remains wholly dependent on the VWS mothership for its budget, its IT infrastructure and its staffing (as central government civil servants of VWS). It is untenable for a supervisory authority to be organisationally entangled with the very parties (such as the RIVM) over which it must exercise critical supervision.
How is this done at other ministries?
How it could be done properly can be seen, for instance, in the Dutch GDPR Implementation Act (Uitvoeringswet AVG): "There shall be a Dutch Data Protection Authority. The Dutch Data Protection Authority has legal personality." That really is necessary in order to safeguard the strict European independence requirements.
Moreover, the question arises whether the GDA (HDAB) should fall under VWS at all. After all, the EHDS can hardly be called European health law. It is above all European data law. It is about the internal market, the free movement of data, scientific innovation and economic growth. It is a lex specialis in relation to all the other data rules, such as the GDPR, the Open Data Directive, the Interoperable Europe Regulation and so on.
While the Jetten government is currently centralising the digital portfolios at the Ministry of Economic Affairs at a rapid pace, VWS is keeping the EHDS firmly in its own grip. It is time, however, that we started treating the EHDS for what it is: European market regulation that calls for independent and watertight supervision. As far as I am concerned, the draft GIS Act is therefore an excellent occasion to transfer everyone at VWS who deals with data flows, together with the entire EHDS dossier, to Economic Affairs. There they can do their work independently and, moreover, benefit from the expertise already present at Economic Affairs.
A legal person and a different ministry
That would be far more efficient, especially given that the intention is for us to gain access to our own patient records via the European Digital Identity Wallet before long. In addition, the healthcare sector has been complaining for years about the market power and vendor lock-ins of large IT players such as Chipsoft. VWS has proved unable to do anything about it. The Ministry of Economic Affairs, with decades of experience in the field of market forces and competition, may well succeed where VWS did not.
My proposal is this: the GDA must indeed be given its own legal personality. But above all, this authority should fall under the Minister of Economic Affairs.