The EHDS is about data, not bodily material. The Dutch draft Bodily Material Act is about material, not data. This might lead one to believe there's no overlap. But if you extract data from material, you're doing something with both data and material. That's why I'm discussing my thoughts on the draft act here. Spoiler alert: it's not good.
The EHDS-request and the post-Covid rule of law
The EHDS is perceived by those who distrust the government as a manipulative tactic: the coronavirus pandemic would be used to learn everything about us citizens. The striking thing is that even these suspicious people will be enormously helped by the EHDS, even in times of a pandemic, and even if they don’t understand much about statistics. Besides a data permit, the EHDS also includes a request: a request for an answer to a statistical question. Anyone can request such a request, which is therefore excellent for our constitutional state, because it allows citizens to independently verify whether certain policy choices were a good idea.
No data to researcher, but answer to requestor
In addition to the health data permit, the EHDS also includes a request. This is translated as “vraag” (request) in the Dutch version. It might have been clearer if this had been translated as “EHDS vraag” (question). The result is simply receiving an answer. The EHDS stipulates that for a permit application that may not be granted, it must always be checked whether it can be treated as a question. You can also decide not to apply for a permit, but to submit a question instead. This option is related to privacy, which must be protected as much as possible. The idea is to—where reasonably possible—not make data available to researchers, but only to provide the answer to their question. Currently, there is no legal way to enforce such an answer to a question. Under the Open Government Act or the Reuse of Government Information Act, you can request electronic data, but not an analysis of it. Under the EHDS, however, you can request that someone perform a specific calculation for you. This makes potential knowledge much more widely available. The EHDS question should therefore be seen as a major step forward (although it will obviously not be for free).
Who will take this on? Free market against distrust
Surprisingly, there’s no consideration at all of who will carry out this process in the Netherlands. The decision on such an EHDS request is an administrative decision that the Health Data Access Body itself must make. However, generating the substantive answer (performing the analysis) is a practical task that can also be outsourced. The HDAB could, therefore, outsource this to a single government agency with experience analyzing health data, such as Statistics Netherlands (CBS) or the RIVM (National Institute for Public Health and the Environment). Alternatively, it could choose to allow some market forces to operate. Under the EHDS, the questions must be answered in a secure processing environment. All reliable data holders (which likely includes academic hospitals) also have such an SPE. Some market forces generally benefit price and quality, so it would be beneficial if the HDAB gave everyone with (access to) an SPE the opportunity to submit a bid for answering EHDS questions. Ideally, the applicant would also be given the opportunity to choose who would generate the answer to their question. That would be beneficial in countering suspicion in society. The EHDS, which is often seen as a trick of the evil government, could actually help reduce this distrust.
The Ministry of Health, Welfare and Sport will soon determine who will become the HDAB; who will be the source of permits for the beneficial reuse of health data. Who can be this, and who cannot? And what will this HDAB be responsible for?
Under the EHDS, work must be performed in a Secure Processing Environment (SPE). Scientists don't receive data, but access it in a SPE that meets the strict technical and security standards established under the EHDS. What does this entail? And will everyone be required to work in such a SPE from now on? Will it become a supercomputer containing all our health data?