Legal bases for effective secondary use of health and genetic data in the EU: time for new legislative solutions to better harmonize data for cross-border sharing?

The secondary use of health and genetic data between different actors and countries can be medically and scientifically rewarding, but it requires a solid legal framework to enable responsible cross-border and cross-sector access to such data. From an EU data protection law standpoint, such secondary use requires a legal basis under Article 6(1) and a permission under Article 9(2) of the EU General Data Protection Regulation (GDPR). However, we argue that, in practice, a suitable legal basis is not always available to all stakeholders to process health and genetic data for secondary uses. The EU has recently proposed a European Health Data Space (EHDS), which is the first common EU ‘data space’ in a specific area to emerge from the ‘European strategy for data’. Among other aims, the EHDS seeks to provide a consistent, trustworthy, and efficient system for reusing health and genetic data for research, innovation, policy-making, and regulatory activities (ie, secondary use). Yet, the EHDS does not account for the different phases in the data reuse lifecycle in a sufficiently encompassing manner, resulting in missing or insufficient GDPR legal bases for undertaking certain crucial processing operations. As a result of the dependency on legislative acts and the varying nature of stakeholders involved, we find that there can be significant hurdles for secondary use, and some actors can even be excluded from participation entirely. Consequently, we advocate new data protection legislative solutions to harmonize data for cross-border sharing. In today’s data-driven world, organizations rely on growing amounts of personal data. Health and genetic data are no exception, and indeed these are often the most valued personal data of all, both by individuals who view them as, generally speaking, more other of and which them to and other of data. and these data such and organizations that data from organizations in the of such health to a or undertaking a However, there is a growing that such for a specific use, significant for and for to the is often of the As there is no to the of of but for the of we to of personal health data in a that use of the data the for which the data or are in which secondary organizations data for new or them for a However, the most from data available to in a and who can use these data for are for the and of or a of the of genetic and health data for reuse is Data organizations is of for data of and of In secondary of data for in health and for regulatory are to health and genetic data to Among other secondary use new or of data or who be from for and in data and data secondary for research, which is a area of has by the not to and for data and but by and these cross-border by of European such the and the European are even by EU to data the in the European proposed the European Health Data Space a to and the to enable secondary use of health data for a of research, and of the of the of the EHDS Regulation is not of the EHDS is to data that are not available for secondary use in and of the that on a between the European and the to data protection the has not some stakeholders the of the proposed data of these the European ‘European strategy for the of which is to enable the of data the the of the data for the of As is the secondary use of which health and genetic data and data protection and and more to the processing of health and genetic data of personal In the the General Data Protection Regulation is the of the legal framework the processing of personal of the GDPR are in the data protection of the EU the GDPR and the and data protection legal framework in legal framework is by and in the of health and genetic legal acts the of and the of is by the law of the of of the European As we argue in in the responsible secondary use of health and genetic data is by an of from the different legal or the of an encompassing legal framework for the secondary use of these the proposed EHDS However, we on to the EHDS Regulation does not provide a to these data protection law In the and the of legal to the of for which these data are to be be by legal and the in which reuse significant The hurdles for secondary use of health data by a by the European and in the on to cross-border of health data for secondary use of the a the However, these not provide an of the legal under the GDPR for secondary use of health and genetic data. to we on the of research, and to a reuse of health and genetic other to data As the of legal in the of cross-border secondary use of health we to the of legal basis the of 6(1) and 9(2) a legal basis to process personal data is the of GDPR we to which GDPR legal bases are available to the actors in the health and genetic data reuse an of the GDPR legal we the that the the legal basis for processing these data for secondary use EU which is for and data As a result of the dependency on legislative the varying nature of we find that there can be significant hurdles for secondary use and some actors can even be excluded from participation entirely. these can be EU and to the legislative the proposed EHDS that the proposed EHDS Regulation is an in the of the of a legal basis under the However, we that the GDPR legal bases in the proposed EHDS Regulation are insufficient for of secondary use of the data reuse lifecycle and are insufficient for data which a by European legislative that the EHDS Regulation by the to a GDPR legal basis for personal data for secondary the for secondary use of health and genetic data and the of the EHDS we by there is often a of a suitable legal basis for health and genetic data available for secondary use the requires to the for secondary use under the GDPR to the and of the legal bases available under Article 6(1) GDPR for secondary use of personal health and genetic data. The data from data by an for to the data reuse by for the can be in Data reuse be the to the in processing Data and Data that these are not legal in EU but the that we find for the data reuse lifecycle in to secondary use for these in a specific which can not be are that the EU legislative such the Data and the proposed EHDS not in the secondary use of data. in the of we the proposed EHDS Regulation and the Data in the a of the the of we the Data an that health genetic data for and that to the data available for secondary use to Data for a the Data to the data available to Data The can in or GDPR for the of data to the on a to data or not the and can certain and of data and to be can be for Data to data to a or Data can a is to that from an of a is not for the of data available by Data to Data Data can to to data for secondary of the and of all the of available to for secondary uses. of such are in the European the and the The of a in the EHDS and are in of the of European or in the area of data. The European European for the reuse of health and data is the European has on the a for and of and data for the of or in the of The in the are for reuse in the organizations data available the access to and use of the data The The is a proposed the of data data available and in a The is by EU the and to a a process for is that the and data in the these available for a of other research, and health by the in under a Health the the of in and and is the which access to the data in the in a processing organizations data are to or the data to the organizations no in access and use in to the the the of on the of the has data access and secondary use to the of However, that of the data in the is of it is that and for other of secondary be in the Data a to use, for the personal health data available by the Data the data reuse lifecycle is a of processing on personal data. The nature of the processing not on the and of the that the Data is but data and other the nature of the from Data the of processing or not of data to a data the data to to a data by the or the data to certain access and use or the of the data by Data it be to and other to the in the data reuse specific processing be on the personal nature be by the of and the data of a data reuse lifecycle is processing on the personal data the In are of for processing on personal the be the for which the processing is the data for the and a GDPR legal basis in which the processing is in the secondary use of health and genetic data in of the first the of the processing and data for the processing In we are in the which in the legal we of the under Article 6(1) in of the under Article 9(2) GDPR of personal data be health and genetic is the of the to that processing has a legal basis and in the of personal a the of a GDPR legal basis be in view of all of the the nature and of the specific for which the processing is and the legal and the of of the basis is a for missing or insufficient legal basis is the most in GDPR by Yet, the in a data reuse lifecycle data are for secondary use that all the a legal basis is in a significant and the of the EU data protection is we the and other legal and to there are no legislative we to the we to argue not provide a legal basis for all processing to secondary In we the in a legal basis for secondary use of health and genetic data. on the of research, but it can be some to other such health and we in the In the legal bases to legal of a in the and of these in in the health that be an legal basis to the secondary use of health and genetic data. is to the of a legal basis to process personal data the to for participation in health in the has the As a is a common in some be to that the processing of personal data is on the of Article 6(1) However, we to legal basis in a of and that it a by the for a to to secondary use in the the of which is in a legal basis in the GDPR has to data the of them to data or not be be and and it be for the data to the The has to that is for a The has by that be specific Article that a can be for an and not for an by and GDPR the processing has be for all of Article that for which the to process personal data be the data to to to processing for that Article that processing is on the be to that the data has to processing or personal data’. In the of health or genetic data processing that on the legal basis be to that has from the data that is to the processing by be in of that for to be in the of Article the to be to the data In the of research, on the of can be In GDPR the in is often not to the of personal data processing for the of data data be to to certain of in for Data the to to certain of or of to the by the has to for from to secondary has the to However, a more that there are to the that to be by GDPR be in to the by a the secondary is in the of the The in GDPR is to a not the of data by a that the to be to a certain and more to that the be sufficiently to the of the processing by the In other the be in a that, a for the data data in the of data and to a certain the data to be from the data the of the data to the processing the which can to a of the always to data protection by and of Article to the a is In other the is the and processing the data a and to be to data secondary use, on the other is and there are no processing it the of data and Article that for a the of processing is a crucial that a that is not to processing be always be to the data a processing In of the European Data Protection to a in on and not the for data processing a be the an that the be a more The GDPR the of the processing not be under the is a between and secondary use of data to processing by the it is to the of the processing the of such from the nature of the of an to the is a the on the health and of the is an to the the of secondary use in on the other the to the is to the that the are not is a a that does not the of the processing a the legal basis has to be the processing The for to be for specific a not be the is the of to it is to the specific the that the GDPR for that are not the to to that be the In the of secondary use, the to on the of the of be a the for new does not to be that can be a to the of of that the to an to in the for activities that are not the of always to that processing for a that not the processing for a new by the in the of the data reuse lifecycle in processing under the data processing by the Data The that not all can be the of is not specific to it to other secondary uses. the that the by be that is in to the use of data in the the nature of the is such that it the from the in a manner, the of data In the of be the of to a not for of that more all by that there is a between the and the for which the Yet, for processing a processing for that a no can be that in is be the of the processing for which be in the GDPR that has to be for all In of we find that the secondary use of personal data for by the is a processing that does not to the of the As in to be in the secondary use data processing The of data available to be for secondary use in can be a by the that the data from the data The the of processing by the to the and of the data access The of the processing the of for data the to processing the data the a specific and from the data encompassing these that data are in the the of is specific for processing which can even a to a that the to the access such is sufficiently in the However, is not to be it be can the data are in a and there is a or of between the data and the is often the are to find a for are other of an such are the and processing for or to for reuse in health In research, access is a of processing personal data by the on to of data be by the in the of in and and by and a is for in for data for a Data The that or permission to reuse the data for a requires a specific by the data has to the of for that data to the reuse of personal data in by a the for a has in some European such and be that in a of between the data available by the and the responsible for the data the has the data for the to the data to Data be a of the that is not the of the be speaking, the is not in the research, it can be is all to the the does not the and does not in the even the of is to be in the of the the of an to the the of to the a from the data for of data to Data in of the of However, even to the processing of the the that is them in the is a The in that be on is proposed a the of the specific data use for which data be to be more is to be in view of the of a and a or that the to the processing of data to the data does not to be a a on to the data and an from the data that not is it be for the to that the data has the and is in the that that the does not the In data are the be to process data for a to the a of an by the data it be that the of a or the of a is a specific However, a it that there can be on the of that to be such in the processing and the data to be Data who access to the data for or for reuse for to be the of the be the Data such a the of the or the acts the for the permission to use the data. is the Data has no for the data the Data to a the the or the Data can the Data in the has the and to enable the the that the new is for the specific by the Data and that the data is the (ie, the Data of the In the of a under the GDPR the on the legal basis under and and an that to and a and a in the available However, even we that on a legal basis of data for secondary uses. is for a to be the data the to the the of for processing health and genetic data it an legal basis in the of secondary data use we to the view the that a the of data which for that the to a new on legal bases to processing of personal data of the data reuse However, these legal bases we on to argue that or is EU is a legal basis the processing is by a or law to which the is can be no on the of the or to the law provide the which be sufficiently specific to which processing is or is not In on Article a legal basis be the most the the to a legal is the law provide for the under Article 9(2) and suitable and specific such in the of health organizations such and are to certain of data to countries or to which organizations are to and health data of the in often a of the system but a legal to the data to of Data is to be that reuse of data in such is The legal basis for the to Data in these is Article The is that data to Data a data that requires a and by the to to the data. not a suitable legal basis to the of data to are in the legal bases in the proposed EHDS The to the Data there is no legal on the of the Data to a the Data has to the even the of be of the to the by the processing of personal data for the of health is a an it is not to the processing to the of for Article in Article to Article to rely on a in the a legal the basis of the processing has to be in or law to which the is However, in a a is by the which there is to the that are by the The is often of the to an by a or in health In all the be to that the processing is to the by The to the of the for the or is in the who the data for such a specific to the data available for Data stakeholders for a to However, data available or a or data to the Data in the does in research, but is often not the of by is by the to the which are and of data Data is in the of some organizations these are in health such and EU to enable the of the health data to enable data for the a legal to personal data by certain organizations the to for the and other under a law on Article on to the processing of personal data by a Data to Article the law an for the from the under Article 9(2) in to data for the Data In these more recently a of is a new legislative data However, these a legal basis to the data to the Data not be to the data available which can data are to be in a a on the by the not be it acts a for the However, even is in data more available not be for for the data framework of the be the data has are that provide access to cross-border that on and that a common data for in the The of a suitable legal basis to in such cross-border has a on that can be a access are to the of European health data in them a of access to a different data framework by and by the for data to Data the the legal basis under Article is a for the of these are in the to them by it is the use of and reuse of has the of an from the can rely on a in the legal the other other of not be by the legal in most them from on Article legal is can be under Article in of the nature of the the of a or of in the does not to the processing of of such health and genetic data. is that the processing under Article 9(2) be in to the Article 6(1) legal most EU the under Article GDPR in to the processing of of data for such a to be which can be on an by a and other to the access use of health and genetic data for often from the in the GDPR in Article that can the processing of health and genetic data the in legislative acts to the processing of of data. some for the data in the of in the of a and the of the GDPR legal In some both of be a of legal has that countries in and generally a on even a Data can rely on the Article GDPR legal basis to research, Data significant to the data the the for data under a more legal Data from the under Article health to but in some Article (ie, of a is a legal is in the or and is by the under Article the under Article However, a that often and the of the of Article are to the of a a The of a processing data of processing is not to but is not in most to legal to can use the personal data of not under in to the or of legal generally for such is Article is specific acts on that not personal health the of the system and that personal data of other can be and in the rely on Article a legal the be to and or a and of a that it is to under Article an is a and can be under an However, the be and to activities or a in the that are not be The to in a that does not on the and of the data of the is data are for such and and that data are under and a of (ie, and to the data a to or to of the However, legal basis is not available to in the of in data available for secondary use can be for stakeholders who to data from and by the on or a reuse and is The of in certain cross-border such the not be other such reuse or are not in the of a stakeholders in health in most be to is to an Article basis from the to provide data for secondary use, which a and in the data. In it is not the that the but that of the a which to provide data to Data in and health from the to the the for the to a in the The be different in to the data available a certain by the data the by the data to be the of the in data to Data for The in the of the data in be the and no the legal basis be available to and stakeholders it not be available to that under law and that the data in the of in Article to rely on Article or Article of legal basis is the to a to a suitable Article 9(2) from the on the processing of health and genetic data. processing of personal data in Article does not the to rely on law the is not the to the Article 9(2) of personal data are in to rely on a Article 9(2) such Article in Article the be to process of data on or law on of the legal a law the of of personal data available for secondary use in the the in a for which data available for use in Yet, to be to a can it data for a even that processing in is not or to countries provide more more to the of which does not to activities to by other the In for health and genetic and or in is not As secondary use other are there is to be in the In the to and the of such legislative acts that not provide a to health and genetic data available for secondary The to the the of health and genetic data to the Data the or the has a and an in health and genetic data to Data secondary use Article is a that the is not a However, the from the of that enable the to use of an Article 9(2) GDPR The to the that the from the of Article is for the of in most However, does not always find it to in view of the on the use of Article by other to the use of personal such by other health the is even the of Article the is to the of in the reuse of health and genetic data in the the Article not be data are not from a a data by the or a that acts the for the data the Data the to the of the a the in the is to be the of the in the the in the proposed EHDS Regulation and can legal hurdles in secondary use of data in health data are The in the GDPR legal bases for processing health and genetic data for secondary of by who the of the GDPR legal bases European significant in 6(1) and 9(2) GDPR legal bases on which rely to process personal health that in the of cross-border secondary use of health and genetic result in not all the data reuse lifecycle a legal basis for the processing are in is a to and of such data for secondary in data be for secondary use the the the data legislative are to the of a GDPR legal basis for all the in the data reuse In legislative can both the and the EU However, from a of it is the that The of the GDPR in of GDPR 6(1) and that in of in to a more the of GDPR legal bases for cross-border secondary use of health data is EU in the health is a for data The for a by the by the of the the proposed EHDS in by the European of the of the proposed Regulation is to the legal hurdles for secondary use of health and data from the in the and of the GDPR in the other the insufficient of 6(1) and 9(2) GDPR legal bases for the data processing the data reuse the proposed EHDS the EU has to access and secondary use health to all of data to health data. In the of the secondary use of health the most legal by the proposed EHDS on the most the of are of the Health Data the Health Data and the Health Data EHDS to the the Data the the is a and can the Data to the and the Data In we use the EHDS The legal framework is for secondary use, of the proposed EHDS Health Data under a legal GDPR a suitable under Article 9(2) process personal health data for the of the data and to the the of a data under a in the GDPR a suitable under Article 9(2) and data in the of a data access Health Data are to legal basis under Article GDPR or Article GDPR on but the Article 9(2) GDPR to process health and genetic data is the legal framework of the that the of GDPR legal bases by the EHDS Regulation in the proposed EHDS is in to all for an efficient cross-border use of health and genetic