Guideline for Health Data Access Bodies on implementing opt-out from the secondary use of health data

This TEHDAS2 expert guideline supports the implementation of the European Health Data Space (EHDS).The overall objective of T8.1 of the TEHDAS2 Joint action is to provide guidance to Health Data Access Bodies (HDABs) on their obligations under Article 71 of the European Health Data Space (EHDS)Regulation, regarding the right of natural persons to opt out from the secondary use of their personal electronic health data. While this guideline is primarily intended for HDABs, some recommendations may also be relevant to other stakeholders, among others, data holders and data users. It aims to support HDABs by setting out the requirements and procedures for the effective implementation and administration of the opt-out mechanism, and by providing guidance on citizen engagement and the promotion of public trust to enable data sharing for secondary use. It is important to note that this guideline is not intended to directly inform people of their right to opt out, nor to guide data users on how to manage data impacted by the exercise of this right. The document outlines the high-level responsibilities of HDABs and gives recommendations for addressing the right to opt-out from secondary use of health data, based on the current legal and policy landscape. More specifically, the guideline: Offers a clarification on the scope and implications of the opt-out right from secondary use of health data, under Article 71 EHDS, in contrast to the right to opt-out in primary use Article 10 (1). Highlights certain important data protection issues, with a focus on the difference between right to opt out, informed consent and the right to object, and the characteristics of personal electronic health data falling under opt-out, as well as the impact of anonymisation on the right to opt-out from secondary use. Acknowledges that the Regulation allows Member States (MS) to introduce more granular opt-out mechanisms (as opposed to a general opt-out), acknowledging that differences in legal traditions, cultural expectations, and societal sensitivities across the EU may justify varying levels of granularity at national level. Provides recommendations on the national mechanism of opt-out via centralised or decentralised national systems and highlights key legal principles, areas of national discretion, and structural limitations (including cross-border considerations), while clarifying that this guideline does not define detailed national workflows or technical solutions. Provides recommendations on how to balance the protection of the rights of individuals with the pursuit of societal benefits, and on how to foster public trust to ensure the success and wide acceptance of the EHDS. The following areas fall outside the scope of this guideline: Does not provide implementation timelines, operational use cases, or country-specific mappings, as such examples or technical architectures would risk pre-empting national choices and future implementing acts. Does not offer authoritative legal interpretations of the interactions between the General Data Protection Regulation (GDPR) and the EHDS Regulation. This guideline aims to better prepare HDABs to fulfil their responsibilities towards natural persons regarding the right to opt-out from the secondary use of personal electronic health data under the EHDS Regulation. The guideline also provides further areas of recommendations to support the alignment of national EHDS structures and to contribute to a harmonised approach to secondary use of health data across Europe. This document is part of a broader set of TEHDAS2 guidelines aimed at supporting MS readiness and promoting consistent EHDS implementation. This guideline forms part of the initial, foundational layer of the EHDS implementation, providing a harmonised high-level framework to support MS preparedness, while recognising that more detailed operational guidance will emerge through future implementing acts, governance structures, and practical experience.