Patient control over health data under the EHDS
Health data may currently be used for research with consent. Under the EHDS, this will become an opt-out. What will this look like? Who will oversee this? Is that ethical?
Nobody owns data
The European Health Data Space will bring about major changes regarding patient control over the reuse of health data (as noted by the Dutch Data Protection Authority). To understand this section properly, a few terms must first be explained. Although health data concerns a patient, it does not belong to the patient. Nor does the hospital own the data. Health data consists of facts; just as one cannot own the fact that "the sun is hot," one cannot own the fact that "the patient has a fever." Consequently, the patient holds no property rights over the data. However, the patient does have a right to the protection of data concerning them, based on their right to privacy. Patients can exercise these rights themselves in various ways (alongside the actions taken by the Dutch Data Protection Authority). On the one hand, for instance, they have the right to access data held about them and to have that data corrected. On the other hand, there may be scope for exercising control prior to any potential use of patient data.
Three types of control
There are three forms of this. The first form involves no control; this is the case, for instance, with data collected by Statistics Netherlands (CBS). Such data concern large numbers of people and are essential for the government to perform its duties. In this instance, there is no control, based on the premise that every citizen desires a well-functioning government—something only achievable through the use of data. The second possibility is opt-out control (where no objection has been raised), and the third is opt-in control (requiring prior consent). Dutch law currently applies an opt-in arrangement for scientific research and statistics, unless doing so would be unreasonable. Consent therefore implies an opt-in, which is a form of prior control. The EHDS stipulates that, regarding the beneficial and secure reuse of health data, an opt-out approach will henceforth apply in principle. However, national law in a Member State may mandate an opt-in for particularly sensitive data. Additionally, for specific processing activities, it may be determined that no control can be exercised at all—for example, due to a high risk of unreliable research outcomes.
The National Control Register
With regard to certain sensitive data, national legislation may therefore opt for an "opt-in" approach. This applies, for instance, to genetic data, data from wellness apps, and data derived from biological material. It should be noted, however, that this applies only when the information constitutes personal data within the meaning of the GDPR—that is, when the data subject can reasonably be identified. This stands to reason: if it is impossible to reasonably determine whose data is involved, it is equally impossible to verify whether control has been exercised. The Dutch legislature must now work out the practical details of how this control is to be exercised. Discussions are currently underway regarding a National Control Register, where individuals could object to specific forms of data reuse. Additionally, this register could potentially serve as a platform for granting consent for the reuse of sensitive data, should the legislature decide that separate consent for each individual study is not required. Once exercised, this control applies to all subsequent data permits until such time as the objection might be withdrawn. The objection does not have retroactive effect; once a permit has been issued, the data may be used until the study concludes.
The Privacy Authority & the HDAB
What, then, is the division of tasks between the Health Data Access Body and the Privacy Authority? The EHDS aims to strike the right balance between privacy protection and the utility of data availability—an approach the EU describes as "as open as possible, as closed as necessary." The GDPR remains fully applicable, and the Privacy Authority retains all its enforcement powers regarding privacy. The HDAB is the new government body to be established, tasked with serving the counterbalancing interest: data availability. Given this division of roles, it makes sense that the Privacy Authority—not the HDAB—is the one to take enforcement action if the exercise of control rights within the National Control Rights Register is not properly observed. However, the HDAB does monitor compliance with the GDPR; should a violation occur, it informs the PA. Consequently, the two bodies must collaborate. Additionally, the PA oversees the HDAB regarding the latter's own direct processing of personal data. Yet, because the AP already supervises health data and will soon be assisted in this by the HDAB, its workload under the EHDS could actually decrease (contrary to KPMG's claim that the Privacy Authority needs to expand).
The free flow of data
Some people believe that the National Data Sovereignty Register should allow individuals to specify that their data must not cross national borders; however, this conflicts with European law regarding the free movement of data—a principle also enshrined in Article 1 of the GDPR. Moreover, the EHDS is explicitly named the "European Health Data Space" because the aim is to establish the free movement of health data within Europe, mirroring the existing free movement of persons (including patients and scientists) and services (including healthcare). Furthermore, EU rules prohibit discrimination between, for instance, Dutch and Belgian scientists. Anyone who disagrees with these principles would effectively be advocating for the Netherlands to leave the European Union.
Control under the EHDS and ethics
Some people believe that the EHDS is unethical, partly due to the opt-out mechanism. First of all, it should be noted that legal experts describing the law do not make pronouncements on ethics; law and ethics are not the same thing. Indeed, ethics is primarily taught in philosophy departments, not in law schools. It is worth noting, however, that the EHDS is a European law adopted by the democratically elected European Parliament. The current Dutch government has also stipulated in its coalition agreement that an opt-out is sufficient. From this, one can infer that the majority of society does not consider the opt-out to be unethical—a view confirmed by research conducted by organizations such as the Patients' Federation.