European privacy regulators recommend some improvements to a new European legislative proposal for making health data available. This is contained in an opinion issued by the AP and the other national privacy supervisors, united in the European Data Protection Board (EDPB). They did so together with the European Data Protection Supervisor (EDPS), which supervises European Union (EU) institutions.
It is an opinion on a European Commission bill, the European Health Data Space. This bill has two goals. The first goal is to increase the availability of health data for medical treatment of people in Europe. The data can also contribute to scientific research, innovation and policy.
The European Commission had asked the EDPB and the EDPS for an opinion on this proposal. The EDPB and the EDPS see the need to promote the availability of health data for healthcare and other purposes.
They welcome the bill's provisions that strengthen citizens' rights around their health data. At the same time, they see points where the bill still needs improvement. The EDPB and EDPS opinion therefore contains a number of recommendations.
The bill adds yet another layer to the already complex health data processing legislation.
Therefore, it is important that the relationship between the European Health Data Space and the AVG, national legislation in European member states and other European legislative proposals is clear. This is not the case now.
The bill aims to facilitate the use of data for purposes other than medical treatment, such as scientific research, innovation and policy. But regulators see that the proposal is not always clear exactly for what purposes health data may be used.
Because the data involved is very sensitive, it is necessary. They therefore ask the Commission to clearly state in the proposal in which cases health data may and may not be used for other purposes.
The level of protection of personal data in the EU is higher than in most other countries. To ensure that when personal data is transferred to countries outside the EU, there is no reduction in the protection of citizens, the AVG sets requirements for such a transfer.
To complement this, regulators are now advocating for an obligation - as a main rule - to process health data within the EU.
