The EHDS is about data, not bodily material. The Dutch draft Bodily Material Act is about material, not data. This might lead one to believe there's no overlap. But if you extract data from material, you're doing something with both data and material. That's why I'm discussing my thoughts on the draft act here. Spoiler alert: it's not good.
The EHDS actually leads to more health (data) safety
The introduction of the EHDS is causing public unrest. Will our health data still be safe? The regulation will indeed make more data available for beneficial reuse, such as scientific research. But the idea behind the regulation is to make more data available precisely by improving its security. To this end, the permit is being introduced and an HDAB must be established as a health data police. Moreover, the EHDS includes a list of prohibited uses, which could have far-reaching consequences for the tobacco industry, among others.
Permit required
First of all, the EHDS stipulates that working with health data requires a permit. There’s debate about whether one can choose whether to apply for one, as the Ministry of Health, Welfare and Sport (VWS) states. I find this a strange position: you can’t choose whether to apply for a tree-felling permit, a building permit, or a catering permit. The whole point of the permit is to allow the government to monitor the process, ensuring compliance with all (safety) regulations. As I read the regulation, a permit will almost always be required. The EHDS then stipulates that health data may only be used in accordance with the conditions stipulated in the permit. These conditions must include, among other things, the exact names of the researchers authorized to access the data. If a person isn’t listed in the permit, they can’t access the data. Moreover, it’s strictly forbidden to determine who the (anonymous or pseudonymous) data relates to.
HDAB supervises
The permit is being requested from the Health Data Access Body. In the Netherlands, they are currently busy designing all sorts of ICT tools for this HDAB. But anyone who carefully studies the EHDS will see that the newly established government agency will primarily act as the health data police. Failure to comply with the permit conditions or other legislation can result in the HDAB imposing substantial fines (up to €20 million or 4% of annual turnover). Moreover, interested parties can submit enforcement requests to the HDAB, forcing the government to take action if health data is handled too carelessly. You might think the Dutch Data Protection Authority already had this capability, but the EHDS goes much further. It contains a particularly interesting list: prohibited uses.
The following is prohibited under the EHDS:
- taking decisions which adversely affect a natural person or a group of natural persons on the basis of their electronic health data; in order to be qualified as ‘decisions’ for the purposes of this point, they must produce legal, social or economic effects or significantly affect those natural persons in a similar manner;
- taking decisions with regard to a natural person or a group of natural persons regarding job vacancies, offering less favourable terms for the supply of goods or services, including refusing to grant such persons or groups an insurance or credit agreement, changing their contributions and insurance premiums or loan terms, or taking other decisions with regard to a natural person or a group of natural persons which result in them being discriminated against on the basis of the health data obtained;
- Carrying out advertising or marketing activities;
- Developing products or services that may be harmful to individuals, public health, or society in general, such as illegal drugs, alcoholic beverages, tobacco and nicotine products, weapons, or products or services designed or modified in such a way that they lead to addiction, are contrary to public order, or pose a risk to human health;
- Carrying out activities that violate ethical provisions laid down in national law.
Let what’s written here sink in: you may not use health data to develop addictive products. As mentioned, there’s some confusion about when the EHDS applies. The Ministry of Health, Welfare and Sport’s interpretation is that you can choose whether to apply for a permit and therefore whether you fall under the EHDS. This also allows the tobacco industry to choose whether to adhere to the prohibited list. That seems like an untenable position to me. The EHDS states: users of health data may only access and process health data for secondary use in accordance with a data permit. It seems to me that a permit is always required in that case (unless the EHDS does not apply under Article 1, which contains some exceptions). If my interpretation is correct, the effect of the list of prohibited uses will be significant! Because then it will be prohibited from now on to use health data to develop any addictive product whatsoever. Kudos to the authors of this regulation.
So the EHDS is great!
The introduction of the EHDS is causing social unrest. There are fears, for example, that secondary use could lead to someone losing insurance or a job. This shows that people haven’t read the EHDS, because this is explicitly stated in the list of prohibited uses. Because the EHDS is very beneficial to medical scientific research, it can be useful to emphasize that the EHDS explicitly prohibits all sorts of things. Another advantage of the list of prohibited uses is that the newly established HDAB is designated as the authority that must enforce it, and where enforcement requests can therefore also be submitted. But above all, we must realize that the EU seems to have, in a roundabout way, given us a legal tool against the tobacco industry. So far, it has not succeeded in banning tobacco, but it does seem to have succeeded in prohibiting research into how to make tobacco even more addictive. Time will tell how much pleasure we will get from this prohibited list. Perhaps it can also be used to combat the addictiveness of apps? Will HDAB soon get my child off social media? I’m eagerly anticipating the fantastic benefits EHDS can bring us.
The Ministry of Health, Welfare and Sport will soon determine who will become the HDAB; who will be the source of permits for the beneficial reuse of health data. Who can be this, and who cannot? And what will this HDAB be responsible for?
Under the EHDS, work must be performed in a Secure Processing Environment (SPE). Scientists don't receive data, but access it in a SPE that meets the strict technical and security standards established under the EHDS. What does this entail? And will everyone be required to work in such a SPE from now on? Will it become a supercomputer containing all our health data?