Governing Health Data for Research, Development, and Innovation: The Missteps of the European Health Data Space Proposal
By Enrique Santamaría
Together with the Data Governance Act (DGA) and the General Data Protection Regulation (GDPR), the proposal for a Regulation on the European Health Data Space (EHDS) will most likely form the new regulatory and governance framework for the use of health data in the European Union. Although well intentioned and thoroughly needed, there are aspects of the EHDS that require further debate, reconsiderations, and amendments. Clarity about what constitutes scientific research is particularly needed.
Scientific research in the DGA and EHDS proposal
The notion of “scientific research” consistently appears in the wording of the DGA and the EHDS where it performs a triple function: 1. It is a general interest purpose for data altruism (Art. 2(16) DGA); 2. a legitimate purpose for the secondary use of electronic health data (Art. 34(e) EHDS.); and 3. a functional factor for the identification of the data holders who should make health data available for secondary use (Recital 40 EHDS and Art. 33 par. 3 EHDS). Despite the centrality of the notion of scientific research in this regulatory framework, neither the DGA nor the EHDS shed light on its meaning.
The General Data Protection Regulation (GDPR) already included “scientific research” as an exception for the requirement of consent from the data subject for secondary uses of sensitive data (e.g. health data). Indeed, Art. 9(2)i-j GDPR allows the processing of data without the consent of the data subject if it is necessary for reasons of public interest in the area of public health, for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes.
This exemption sparked a lively academic debate on its scope and limits: What is research and what is “public interest”? Is research in the interest of the public domain an activity exclusively developed by academic or healthcare entities, or can it be carried out by industry (pharmaceutical, biotechnology, technology companies, medical technology industries, and insurance providers)? If so, how?
According to some commentators, industry can conduct research in the public interest. However, some others have been more cautious and have warned about the difficulties of distinguishing between genuine research and other types of research, which serve private interests. The reasons for these difficulties rest on the multiple and complex linkages between industry and academia, which include funding, sponsoring, and the development of joint research projects.
Although the debate around the GDPR research exemption stressed the necessity of clear criteria for the determination of what constitutes research, the EHDS proposal not only misses a golden opportunity to shed some light on this matter — for example by resorting to the principle of solidarity — but also further complicates the regulatory panorama by introducing additional non-scientific justifications for the secondary use of health data. These are — among others — development and innovation activities, algorithmic and AI projects (whatever these terms might mean), and applications of personalized health care (Art. 34 (1)f-g EHDS).
These activities are not, according to the proposal, a form of “scientific research”. Instead, they fall within a new and self-standing ground for data applications. The proposal thus exempts health-related algorithmic or AI projects from the robust ethical and methodological standards that apply to scientific research. Consequently, powerful private enterprises that possess the computational capacity to conduct such projects would not have to worry about establishing their research endeavors on grounds of public interest. And, because algorithmic projects are viewed as “innovative activities,” accessing and handling data in that context is subject to more liberal — perhaps even libertarian — regulation. Conversely, those who engage in “[scientific] research activities” must abide by stringent ethical strictures and high epistemic standards.
Conclusion
In light of the foregoing, we suggest the EHDS:
- Provide a clear definition of scientific research strongly anchored in the principle of solidarity and the common good.
- Rethink and amend Art. 34 to include provisions that explicitly link scientific research undertaken through the EHDS with the public interest. For this to happen, “algorithmic training, testing, and evaluation” needs to be brought under the “scientific research” basis or removed altogether to be discussed at a later stage following the same epistemic and methodological scrutiny of the rest of the scientific endeavors.
Enrique Santamaría is a postdoctoral researcher at the Erasmus School of Law, Erasmus University Rotterdam and associate fellow at the Jean Monnet Centre of Excellence on Digital Governance.
