Introduction
With the adoption of the Regulation on the European Health Data Space (Regulation (EU) 2025/327, known as EHDS), the European Union (EU) has established a new legal framework to harness the potential of data and data-driven technologies in the sector of health. 1 The Regulation is the first legislation of its kind, giving binding legal effect to the political vision of creating a Common European Data Space.
The EHDS Regulation sits at the intersection of law, health sciences, computer science, ethics, and economics, making it a complex and multifaceted piece of legislation. The underlying concept and structure of the EHDS, together with the lessons drawn from its implementation, are likely to enrich and shape the global debate on health data governance. For such debate — across disciplines and across jurisdictions — to be informed and meaningful, a solid, shared understanding of the Regulation is essential.
This explanatory paper seeks to make the new legal framework accessible to a broad international and interdisciplinary audience. It will first situate the Regulation in its broader political and legal context, highlighting the preconditions that shaped the negotiations and ultimately determined its final form. It will then introduce the structure and core concepts of the Regulation. Particular attention is given to the regime for secondary use, as it constitutes an entirely new legal framework at EU level, and the insights gained from its design may inform the development of future Common European Data Spaces. Building on this, the paper examines the patient opt out regimes under the EHDS as a case study to illustrate the persistent challenges the framework faces in balancing rights and values, such as patient autonomy, data protection, and the tension between individual and collective interests, with innovation- and market-friendly objectives, all against the backdrop of divergent national preferences. Finally, it will conclude by summarizing the remaining challenges and future considerations.
I. Key Drivers and Controversies Shaping the Regulation
Over recent years, the EU has increasingly recognized data as a foundation for economic growth, competitiveness, innovation, job creation, and broader societal development. To harness the transformative capabilities of data for Europe’s economy and society, the EU launched the European Strategy for Data in February 2020, proposing the creation of Common European Data Spaces. 2 These data spaces target essential sectors such as health, agriculture, cultural heritage, energy, finance, the green deal, language, manufacturing, media, mobility, public administration, research and innovation, skills, and tourism. 3 The overarching aim of the initiative is to ensure that data from across the EU can be securely accessed and exchanged in a trustworthy environment.
The decision to establish the European Health Data Space as the first Common European Data Space was driven by several factors. On the one hand, the existing infrastructure for health data sharing has increasingly proven to be inadequate. 4 The COVID-19 pandemic has vividly highlighted the urgent need for greater interoperability, illustrating how better data integration could improve the ability to address public health challenges effectively. On the other hand, the existing legal framework presents significant hurdles for health data sharing across borders and the secondary use of health data for research and innovation. 5 Particularly, the EU data protection framework imposes substantial constraints. 6
The urgence and ambition to establish the European Health Data Space and harness the potential of data and digitalization in health were therefore strong.Reference Ganna 7 Equally significant, however, were the political, legal, and practical controversies that had to be overcome during the legislative process.
A. Member State Authority and Differing National Approaches
One of the most fundamental challenges concerns the question of legal authority: the balance of power between the European Union and its Member States. Under Article 6 of the Treaty on the Functioning of the European Union (TFEU), the Union holds only supporting competences in the protection and improvement of human health. 8 Responsibility and authority rest primarily with the Member State, with the EU able to act only to support, coordinate, or complement their actions. Beyond this, the Union has shared competences only in limited areas, such as certain aspects of public health safety. 9 The EU can therefore drive initiatives and set frameworks; however, health service delivery and care remain primarily a national responsibility.
During the negotiations on the EHDS, differing national approaches to both health system organization and data governance came into conflict.Reference Abboud 10 The significant national divergence in levels of digitalization across health sectors created friction: frontrunners in digital health were compelled to reconcile their ambitions with the realities of Member States still at the early stages of digital transformation. 11 Social norms and values also differ across Member States:Reference de Frutos Lucasa and Haugo 12 While, for instance, Nordic countries generally exhibit a receptive approach to data sharing and reuse, grounded in relatively high levels of institutional trust, this degree of confidence is not uniformly shared across other Member States.Reference Hoeyer 13 Member States with traditionally strict interpretations of data protection law had to find common ground with those adopting a more flexible stance. 14
As a result, the legislative process proved demanding. Contentious issues, including the overall implementation timeline, the scope for patient opt outs, and diverging national preferences, had to be negotiated and aligned in order to secure agreement. Ultimately, the legislators adopted a final version of the Regulation incorporating a substantial number of opening clauses. These clauses represent a last-resort political compromise, maintaining national flexibility in implementation within a harmonized framework.Reference Mišćenić and Hoffmann 15 One prominent example of this approach is the opt out regimes, which will be examined later in this paper as a key illustration of how national discretion continues to be preserved within the overarching framework.
This outcome is striking, given that similar deviations under EU data protection law were a primary factor in creating the fragmented regulatory landscape the EHDS was designed to overcome. It illustrates a recurring structural dilemma in EU legislation: 16 by relying again on opening clauses that preserve Member State discretion, the EHDS risks reproducing the very problem it was meant to solve.
B. Challenges Under Existing EU Data Protection Law
The General Data Protection Regulation (Regulation (EU) 2016/679, also known as GDPR) is the primary legal point of reference governing the processing of personal data in the EU. 17 Under the GDPR, data concerning health 18 is classified as a special category of data. 19 Compared to normal personal data, special category data is subject to a significantly stricter legal regime, requiring enhanced safeguards and measures for its protection.
Historically, the notion of “data concerning health” is interpreted broadly, including not only data processed within the distinct medical context, but also health-related data processed outside such settings. 20 Unlike in other jurisdictions, a wide range of health-related data in the EU is therefore classified as health data and treated as sensitive, falling under the stringent legal regime applicable to special category data.Reference Malgieri and Comandé 21
According to prevailing legal doctrine, the processing of special category data requires both a legal basis under Article 6(1) of the GDPR and compliance with one of the exemptions from the general prohibition of processing special category data set out in GDPR Article 9(2). 22 In the health and care sector, explicit consent pursuant to Article 9(2)(a) of the GDPR remains one of the most prominent exemptions. However, explicit consent entails significant practical limitations, particularly with regard to secondary use for research and innovation purposes.Reference Donnelly and McDonagh 23 Recognizing these limitations, the GDPR provides alternative exemptions specifically designed for the processing of health data, as set out in Articles 9(2)(g)-(i); nevertheless, public authorities have frequently hesitated to make full use of these flexibilities. 24 As a result, access to health data in the EU has remained constrained for key stakeholders, including patients, health care professionals, researchers, and policymakers.Reference Peloquin 25
Furthermore, the GDPR contains a considerable number of opening clauses, which enable member states to provide for national deviations. 26 One of these opening clauses is GDPR Article 9(4), allowing member states to impose additional conditions or restrictions to the already enhanced requirements for special category data on the processing of genetic, biometric, and health data. This has led to a significantly fragmented EU regulatory landscape for the processing of health data, falling particularly short in effectively enabling the secondary use of health data and in facilitating cross-border data transfer within the Union. 27
By establishing the EHDS as a new legal framework and mandating a harmonized infrastructure for secure, standardized, and cross-border health data sharing across the EU, legislators seek to address and overcome these challenges.
II. Adoption of the General Legal Framework, Technical Specificities to Follow
Following intense political debate, the Regulation on the European Health Data Space (Regulation (EU) 2025/327) was published on March 5, 2025 in the Official Journal of the EU, entering into force on March 26, 2025. 28 The planned period before the Regulation takes full effect is extensive; this reflects the monumental efforts that will be required by all stakeholders in the health sector to achieve full harmonization and establish the mandatory cross-border infrastructures, supporting both primary and secondary use.
It is important to note that the Regulation itself provides only a general legal framework, leaving the technical details unspecified. The first two years, until March 2027, will be devoted to preparing key implementing acts that will define crucial technical specifications. From a mere practical regulatory perspective, this approach is sensible: advancements in technology occur rapidly, and what is considered state of the art today may be obsolete tomorrow. Requiring a full legislative procedure to adapt technological details would risk delaying innovation and quickly rendering the Regulation outdated. From a democratic policy perspective, however, this raises concerns. While Regulations are enacted by democratically accountable bodies (the European Parliament and the Council), Implementing Acts typically do not undergo the same level of legislative debate or scrutiny. They are often drafted by expert committees, agencies, or working groups and then formally adopted. Decisive details may end up being determined not by democratically elected key actors but through processes behind closed doors, with limited transparency about which interest groups are involved and what considerations guide the outcomes. Moreover, a lack of detailed technical specifications from the outset may increase the risk of divergent national solutions among Member States, potentially perpetuating existing problems and inconsistencies between their systems.Reference Raab 29 Leading European health sector interest groups have therefore been calling on Member States to pursue a common interpretation for the implementation of the regulation. 30
Once the technical specifications are adopted, stakeholders have another two years to implement these specifications and ensure their systems are ready. Major parts of the Regulation will thus take effect only in March 2029, including the exchange of the first group of priority categories for primary use (patient summaries, ePrescriptions/eDispensations) and the rules for most data categories for secondary use. 31 From March 2031, the exchange of the second group of priority categories (medical images, lab results, hospital discharge reports) for primary use and the rules for the remaining data categories for secondary use will apply. 32 In March 2035, third countries and international organizations will, under strict conditions, be able to join for secondary use. 33
With the EHDS, the EU seeks to drive a paradigm shift in the way health data is accessed and used across the EU. The core objectives are:
-
• to strengthen the control of patients over defined categories of their data for primary use; 34
-
• to lay down harmonized rules for electronic health records (EHR) systems; 35
-
• and to establish common rules for the secondary use of health data. 36
In contrast to what the name (health data space) might suggest, the EHDS is not a centralized space for data storage — no data will be centrally stored in the EHDS. Rather, with the Regulation the EU has adopted a new legal framework to facilitate point-to-point connection between health data holders 37 and health data users 38 for data pooling, access, sharing, processing, and utilization in a secure and privacy-focused environment through harmonized infrastructures.
III. Primary Use: Strengthening Patient Rights
Chapter II of the EHDS focuses on primary use of data (meaning use of data for the delivery of health care), particularly on patient rights related to primary use. 39 Several of these rights build on the existing framework for data protection, specifically the GDPR. Under the EHDS, these rights are, however, tailored specifically to the context of health data processing. Within its scope, the EHDS therefore specifies and complements the GDPR. 40
The EHDS, for instance, provides natural persons with the right to obtain access to their own health data. 41 This is not an entirely new right; the GDPR already grants data subjects a right of access to their personal data. 42 A comparison between the two demonstrates the extent to which the EHDS will complement and enhance existing legislation: Under the GDPR, the controller, although being obliged to react without undue delay, has up to one month to reply to the data access request. 43 Additionally, under the GDPR, the controller may charge an administrative fee if data subjects exercise their right excessively. 44 In contrast, the right to obtain access under the EHDS will be free of any costs for patients, and the request must be answered immediately. 45 Conversely, the right to access in the EHDS applies exclusively to health data, focusing particularly on the priority categories — as opposed to the GDPR, which applies to all personal data. 46
EHDS Article 4(2) provides natural persons with the right to appoint representatives (e.g. their spouse or another person of their choice) to access their electronic health records on their behalf, or a legal guardian (such as a parent to their child). Article 5 of the EHDS grants natural persons the right to insert information in their own EHR, with the abovementioned priority categories being the main scope. The inserted information will be marked separately and be clearly distinguishable as having been inserted by a natural person or their representative. It will not be possible for natural persons (or their representatives) to directly alter electronic health data and related information inserted by health professionals. EHDS Article 6 (right to rectification) and EHDS Article 7 (right to data portability) build once again on existing data protection rights under the GDPR (Articles 16 and 20 of the GDPR). 47 Notably, the right to data portability under the EHDS gives natural persons the right to request a health care provider to transmit all or part of their personal electronic health data to another health care provider of their choice — immediately, free of charge, and without hindrance.Reference Li and Quinn 48
EHDS Article 8 and 9 lay out the rights to restrict access to personal electronic health data and to obtain information on who accessed it. Natural persons may impose restrictions on all or parts of their data. 49 Recital 17 of the EHDS exemplarily lists “sensitive health issues such as those related to mental or sexual health, sensitive procedures such as abortions, or data on specific medication which could reveal other sensitive issues.” 50 These restrictions will not be visible to health care providers (not even the fact of their existence). Notwithstanding any restrictions, access shall still be possible if necessary to protect vital interests in emergency situations. EHDS Article 9 grants natural persons the right to know who accessed their data and when. Patients have the right to obtain detailed information on any access to their personal electronic health data through the health professional access service in the context of health care. The information shall include who accessed their personal electronic health data, the date and time of access, and which personal electronic health data were accessed. The information must be free of charge and available for at least three years.
The catalog of natural persons’ rights in primary use is complemented by the right to lodge a complaint with a digital health authority. 51
The infrastructure supporting the cross-border primary use of health data (MyHealth@EU) is established as a central interoperability platform designed to facilitate the exchange of personal electronic health data. 52 It builds on the existing MyHealth@EU created under the Cross-border Healthcare Directive (Directive 2011/24/EU), evolving from a voluntary system into a mandatory one. Importantly, while participation in this infrastructure becomes obligatory, it does not interfere with national rules on the provision of care or the organization and management of health care systems — as highlighted before, these competences remain within the authority of the Member States. Member States may extend the use of MyHealth@EU to provide supplementary services. These include facilitating telemedicine, supporting mobile health applications, granting individuals access to existing translations of their health data, and enabling the exchange or verification of health-related certificates, such as vaccination card services supporting public health and public health monitoring or digital health systems. 53
Overall, the EHDS thus provides patients with a set of strengthened and more tailored rights in the context of primary use. Patients will benefit from easier and faster access to their electronic health records across Member States, coupled with enhanced data portability that enables them to share health data with health care providers of their choice, including in cross-border settings. These developments have the potential to strengthen patient empowerment and continuity of care, particularly for mobile citizens. Improved data availability is expected to reduce the duplication of tests and procedures and to support more accurate diagnoses and treatments, including in cross-border health care contexts, thereby contributing to more efficient and patient-centered care. In addition, the EHDS enhances transparency by providing patients with clearer information about who accesses their health data and for what purposes.
IV. Secondary Use: A New Framework for Research, Innovation, and Policymaking
Chapter IV establishes a new governance framework for secondary use of health data in the EU. 54 This framework was a topic of much debate during the trilogue negotiations, with differing positions not only among Member States but also among different interest groups, such as industry, health professionals, patient advocacy bodies, and the consumer protection and data protection communities.Reference Pištorová and Plevák 55 The finally adopted Act introduces complex procedures for accessing health data for secondary use, restricted to specific purposes and under strict conditions, with debatable consequences for patient rights.Reference Reichel 56
Corresponding to the right to lodge a complaint in the section on primary use, there is also a right to lodge a complaint for secondary use. 57
The cross-border infrastructure for secondary use differs from that for primary use. For secondary use, the relevant infrastructure is HealthData@EU. 58 HealthData@EU will enable data users to discover and access health data from multiple sources across Europe. A central service within the HealthData@EU infrastructure will serve as the initial point of contact, enabling dataset discovery through metadata catalogues and directing requests to national nodes in the relevant Member States.Reference Christiansen 59 Once suitable data sources are identified, the user can submit a data access application via the central service to the relevant national coordinating Health Data Access Bodies. Each Member State must designate a single National Contact Point that acts as the organizational and technical gateway for such access.Reference Svingel 60 Through these contact points, Member States connect with one another and with the EU central platform for HealthData@EU, forming a distributed network.
A. Which Data Must be Made Available
Under the EHDS, health data holders must make specific electronic health data available for secondary use. 61 Participation in the EHDS is therefore not voluntary for health data holders. Instead, they are legally obligated to share health data once all conditions are met and a data user has successfully obtained a data permit (see below). 62
The categories of data to be shared are extensive. EHDS Article 51(1) lists the minimum categories. 63 Several of these categories were discussed intensely. For instance, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) advocated for excluding data from wellness applications, arguing that health data from wellness apps is of lesser quality compared to health data from medical devices and that these apps can be highly invasive. 64 Arguably, data obtained from nontraditional sources may contain errors that jeopardize medical treatment and research. 65 The European Consumer Organization BEUC also advocated for excluding data from wellness apps. 66 Additionally, BEUC called for excluding genetic, genomic, and proteomic data, highlighting that these types of data can practically not be anonymized and bear an inherent risk of reidentification.
EU legislators did not exclude either of these categories. However, in response to the concerns raised, they introduced an opening clause, providing that Member States may introduce stricter measures and additional safeguards at national level to protect human genetic, epigenomic, and genomic data; other human molecular data such as proteomic, transcriptomic, metabolomic, lipidomic, and other omic data; data from wellness applications; and health data from biobanks and associated databases. 67
Furthermore, the adopted Act does not integrate wellness apps mandatorily. Rather, manufacturers of wellness apps can claim interoperability with an EHR system.Reference Holmberg 68 By doing so, the wellness app needs to be labelled. 69 In addition, the users must be informed and are required to give their consent before any transmission or sharing of data. 70 Notably, users must be offered a granular consent mechanism and be “able to choose which categories of health data from the wellness application are to be inserted in the EHR system and the circumstances for the sharing or transmission of those categories of data.” 71
B. Allowed and Prohibited Secondary Uses
The EHDS restricts secondary use of electronic health data to specific purposes. The list of allowed purposes in EHDS Article 53 is exhaustive. 72 Article 53 points (a) public interest, (b) policymaking and regulatory activities, and (c) statistics are reserved for public sector bodies and Union institutions, bodies, offices and agencies, including third parties acting on behalf of those public sector bodies or institutions. 73 In contrast, any natural or legal person can apply for access to the data categories (d) education or teaching, (e) scientific research, including development and innovation activities for products or services as well as training, testing and evaluation of algorithms, and (f) optimization of treatment and health care. Both the broad scope of allowed purposes and of potential data users have raised critique and will be discussed in the context of patient opt outs in Section VI.
Article 54 of the EHDS lists the purposes for which seeking access to and processing of electronic health data obtained via a data permit is prohibited. 74 Processing health data for any of these secondary uses is therefore prohibited under the EHDS.
C. How to Get Access to the Data
The procedure for gaining access to the data involves so-called Health Data Access Bodies (HDABs). Their number of tasks and obligations is substantial, and their responsibilities are critical.Reference Quinn 75 Each Member State is required to establish one or more HDABs, serving as gatekeepers, ensuring all requirements are met, and orchestrating the entire procedure. 76 HDABs publish the data set catalogues, assess and decide on applications, monitor and supervise compliance, and report to the public. 77
The requirements for data access applications must include information on the applicant, the data requested, the intended use, any ethical assessments required under national law, and the security measures to be applied. 78 Where an application is approved by the HDAB, a health data permit is issued, granting the applicant — under strict conditions — direct access to data in pseudonymized form, unless anonymized data are sufficient for the stated purpose. 79
Alternatively, if the applicant requires obtaining a response only in an anonymized statistical form, suitable for broader or public interest inquiries that do not require access to personal data, a simplified procedure applies. In such cases, a health data request may be submitted. 80 This regime is less demanding, focusing primarily on applicant identity, intended use, and the safeguards in place, without conferring direct access to personal data.
D. Costs Involved
The Regulation establishes a fee system for the secondary use of health data. 81 HDABs may charge fees for making electronic health data available, provided that the fees remain proportionate to the costs incurred. Member states may stipulate reduced fees for certain categories of users, such as public sector bodies, Union institutions and agencies, public health authorities, university researchers, or microenterprises. Fees may also include a component to compensate health data holders for their costs. Payments are made to the HDAB, which subsequently transfers the relevant share to the health data holder or provider. As a general rule, fees are limited to cost recovery. HDABs are required to ensure that their fee structures are proportionate, well-justified, and transparent. 82
E. Safeguards Under the EHDS
To ensure a level of security commensurate with the sensitivity of health data, HDABs provide access pursuant to a data permit only through a Secure Processing Environment (SPE). 83 SPEs are subject to a stringent regime of technical and organizational safeguards, as well as security and interoperability requirements. 84 Data access is strictly limited to the authorized natural persons named in the data permit, and state-of-the-art measures must be in place to prevent unauthorized modification, access, or removal of data. All activities within the SPE must be logged and monitored for compliance and audit purposes, and the downloading of personal data is categorically prohibited.
The Regulation further emphasizes the principles of data minimization and purpose limitation. 85 Both principles are already established under the GDPR; here, they are tailored to the specific context of health data processing.Reference Finck and Biega 86 Data access is restricted to data that is adequate, relevant, and necessary for the approved purposes.
By default, only anonymized data shall be made available under the EHDS. Access to pseudonymized data is permitted by way of exception, namely where the applicant demonstrates that the intended purpose cannot reasonably be achieved through the use of anonymized data. From a data protection perspective, this distinction between anonymized and pseudonymized data is not merely technical; it entails substantial regulatory consequences. While pseudonymized data remains classified as personal data and is subject to the full set of compliance obligations under the GDPR, 87 anonymized data no longer qualifies as personal data and falls outside its scope. 88
In the context of health research, however, fully anonymized data is frequently considered insufficient for producing scientifically meaningful results, as the process of anonymization can significantly reduce the granularity and analytical value of datasets. As a result, there is concern that the EHDS exception allowing access to pseudonymized data — intended to apply only where anonymized data cannot reasonably achieve the research purpose — may in practice be invoked in a large proportion of cases.
V. EHR Systems: Harmonized Rules
While the provisions on primary and secondary use under the EHDS have been widely discussed by scholars and policymakers, Chapter III (laying down harmonized requirements for electronic health record (EHR) systems) has largely remained under the radar. This relative neglect may be due in part to the absence of detailed technical specifications, which will only be set out in forthcoming Implementing Acts. Nevertheless, the impact of this section of the Regulation is likely to be profound. By establishing harmonized rules, the EHDS effectively creates a single market for EHR systems, with implications for both primary and secondary uses of health data.
EHR systems are legally required to have the following characteristics: 89
-
• A combination of hardware and software or software only;
-
• allowing the storage, intermediation, export, import, conversion, editing, or viewing of priority categories of electronic health data;
-
• intended by their manufacturer to be used
-
○ by health care providers when providing patient care; or
-
○ by patients when accessing their electronic health data.
-
General purpose software used in health care settings does not fall under this definition. For example, an appointment booking system or software processing only administrative data is not considered an EHR system.
In line with the EU’s new framework for product legislation, the EHDS Regulation provides for full harmonization with respect to two specific components of EHR systems:
-
• a European interoperability software component, and
-
• a European logging software component.
Compliance with the applicable requirements is demonstrated through manufacturer self-declaration of conformity, without the need for third-party assessment. 90 Before placing an EHR system on the market, however, manufacturers must use the digital testing environments developed by the European Commission to verify compliance of the harmonized software components. 91 This means that every EHR system must successfully pass an automated test in the digital testing environment. Ultimately, only those systems that integrate the two harmonized components, comply with the common specifications under Article 36, pass the testing environment, and are CE-marked and registered in the database established under Article 49 may be lawfully placed on the market.
VI. Patient Opt Outs at the Nexus of Competing Interests
As outlined in the preceding sections, the EHDS establishes a harmonized legal framework for accessing and sharing health data, both for primary and secondary use. It is designed to enhance transparency and data availability for patients, policymakers, innovators, and researchers alike. However, the legislators’ ambition to simultaneously strengthen patient rights and support Europe’s data-driven innovation capacity renders the legal piece a complex undertaking.Reference Ganna 92 Underpinned by significant competing interests, the Regulation navigates continuously the delicate intersection of individual fundamental rights and values — such as data protection, privacy, and patient autonomy — and broader societal and economic objectives, including research, innovation, and market strategy.
Nowhere are the tensions more clearly crystallized than in the Regulation’s approach to patient opt outs. Accordingly, this section uses patient opt outs as a paradigmatic example to examine the broader frictions and controversies embedded in the EHDS framework.
The notion of patient opt outs under the EHDS is inherently multifaceted, as it engages with a constellation of legal and ethical concepts, including patient autonomy, medical confidentiality, as well as specifically data protection-related notions such as informational self-determination or the right to object to the processing of one’s personal data. These concepts converge around a common concern: the extent to which individuals retain meaningful control over the use and reuse of their health data.
Several features of the Regulation have raised apprehensions that the new framework may diminish patient autonomy and constrain patients’ ability to determine who may access their health data and for which purposes.Reference Staunton 93 In the stakeholder debates, two elements have provoked heightened concern: the expansive range of purposes deemed legitimate for seeking data access for secondary use under the EHDS, and the exceptionally broad spectrum of actors eligible to apply for such access. 94 Exemplarily, the purpose of scientific research is framed so broadly that it may apply to a far-reaching spectrum of data uses. 95 The EHDS does not restrict the notion of scientific research to academic or publicly funded projects; instead, it expressly encompasses technological development and demonstration, as well as both fundamental and applied research, including research financed by private actors. Commercial interests are not per se excluded from the scope of scientific research, provided that recognised scientific methodologies are applied. 96 Even research in areas that may not traditionally be considered part of the biomedical or clinical disciplines, such as social sciences, humanities, statistics, and other empirical disciplines, can fall within the scope, provided that recognized scientific methodologies are applied. Scientific methdologies are generally characterised by a systematic approach, empirical grounding, transparency, and ethical conduct. 97
Such an extensive interpretation of scientific research under the EHDS may indeed appear notably broad; however, it is nonetheless consistent with prior developments in EU law. In particular, it reflects the interpretative approach to scientific research adopted under the GDPR and aligns with data protection guidance. 98
In addition to the broad scope of permitted purposes, the range of potential actors who can apply for data access under Article 53 is equally expansive. Purposes such as education and teaching activities, scientific research, or improvement and optimization of treatment as well as provision of care (points d–f) are open to any legal person. This encompasses a wide variety of entities, including industry actors such as pharmaceutical companies and major technology firms, as well as not-for-profit organizations, ranging from humanitarian networks to political parties. Big Tech companies, such as Alphabet, Apple, Meta, Amazon, and Microsoft, have consistently expressed interest in the health sector. Given that the EHDS’s permit application processes can be complex and resource intensive, particularly for smaller organizations with limited administrative capacity, these well-resourced firms may be better positioned to absorb the associated administrative costs.Reference Petročnik 99 Concerns are that these actors may aggregate large quantities of data, combining existing datasets with EHDS-provided data to develop new products and services, potentially amplifying risks to privacy and patient autonomy.Reference Fåhraeus 100 Big Tech’s access to an ever-growing volume of high-quality health data, without a corresponding commitment to equitably share the value derived from those data, could even exacerbate the existing uneven distribution of resources in the health sector, limit competition and innovation through infrastructural lock-in, or generate further health disparities. 101
Neither the expansive range of purposes deemed legitimate nor the broad spectrum of actors eligible to apply for data access under the EHDS necessarily reflects patients’ preferences on health data sharing. Studies suggest that patients hold significantly varying views and prefer to actively and carefully choose whom they share their data with.Reference Biasiotto 102 While many are comfortable sharing data with their general practitioners, they often have reservations about sharing it with pharmaceutical companies, digital technology firms, insurers, or wellness app providers. 103
Furthermore, the new EHDS framework prompts another concern, relating to the principle of medical confidentiality.Reference Spajic 104 This principle is grounded in the understanding that patients must be able to communicate openly about their physical and mental conditions, thereby enabling health care professionals to make accurate diagnoses and determine appropriate treatment. As a cornerstone of medical ethics, medical confidentiality forms the foundation of the trust relationship between patients and health care professionals. Frequently enshrined in national law, breaches of medical confidentiality may give rise to disciplinary measures as well as civil or criminal liability. Medical confidentiality protects patient information obtained and exchanged in the course of medical treatment and, in many legal systems, continues to apply even after the patient’s death. Disclosure of such information requires patient’s consent, with only narrowly defined exceptions, such as where disclosure is necessary in the public interest or to safeguard patient safety.
Patient consent is, however, not a prerequisite for data sharing under the EHDS. Instead, health data holders are subject to a statutory obligation under the Regulation to make health data available. Accordingly, critics fear that the new framework established under the EHDS may undermine doctor-patient confidentiality and erode patients’ reasonable expectations of privacy when confiding in their health care providers, insofar as it risks placing doctors and other medical professionals in the position of being complicit in the mandatory commercialization and monetization of health data. 105
A. Shift From Consent Towards Data Sharing by Default
Traditionally, consent has a position of particular normative importance in health law and medical ethics, where it serves as a key expression of respect for patient autonomy.Reference de la Cruz and Shabani 106 Notably, the ethical notion of informed consent, which governs participation in medical treatment and research involving human subjects, must be clearly distinguished from consent as a legal basis for processing personal data under EU data protection law. 107
In contrast to medico-ethical standards and requirements, EU data protection law adopts a significantly more flexible approach to consent in the context of health data processing. While consent, particularly in conjunction with explicit consent as a derogation from the general prohibition in GDPR Article 9, may be the most well-known legal basis, it is by no means the only available option. The GDPR itself is formally neutral as to which legal basis under Article 6(1) serves as the foundation for processing. Regulatory guidance confirms that no hierarchy or preference exists among the legal bases listed in Article 6(1) of the GDPR, provided that the chosen basis is appropriate to the specific processing context. 108 Even data protection authorities have reiterated the availability of alternative legal bases to consent. 109 As regards the general prohibition on processing health data, GDPR Article 9(2) sets out several exemptions that are particularly relevant to the health sector, including point (g) on substantial public interest, point (h) on preventive or occupational medicine, point (i) on reasons of public interest in the area of public health, and point (j) on scientific research.
Hence, under the GDPR, consent constitutes one regulatory mechanism among several for safeguarding data subjects’ rights in relation to health data, but it is neither an absolute nor an overarching requirement for lawful processing. The GDPR deliberately adopts a pluralistic framework in which processing may instead be based on alternative legal grounds that balance individual autonomy against competing public, scientific, and societal interests.
The principle of medical confidentiality is reflected separately under the GDPR, through the notion of professional secrecy.Reference Spajic 110 GDPR Article 9(2)(h) provides an exemption permitting the processing of special category data for purposes such as preventive or occupational medicine, medical diagnosis, and the provision of health or social care, provided that such processing is based on Union or Member State law or carried out pursuant to a contract with a health professional. This exemption is subject to the additional safeguards set out in Article 9(3) of the GDPR, which require that the data be processed by, or under the responsibility of, a professional bound by an obligation of professional secrecy under Union or national law.
The new framework under the EHDS builds upon the pluralistic approach under the GDPR, taking it a significant step further. While the GDPR allows Member States to impose additional conditions or restrictions — including consent — on the processing of health data, the EHDS removes this very option: 111 The preamble of the EHDS states that Member States may no longer maintain or introduce further conditions, limitations, or specific provisions requiring the consent of natural persons under GDPR Article 9(4), except for those explicitly listed in Article 51(4) of the EHDS. 112
Pursuant to EHDS Recital 52, the Regulation establishes a legal basis for the secondary use of health data for health or social care purposes in accordance with one of the legal grounds set out in Article 6(1) of the GDPR: point (a) on consent, point (c) on legal obligation, point (e) on public interest, or point (f) on legitimate interests, together with the safeguards required under GDPR Article 9(2), points (g)-(j).Reference also and Becker 113 Accordingly, the Regulation creates a legal obligation within the meaning of Article 6(1)(c) of the GDPR for health data holders to make available the personal electronic health data to HDABs, in accordance with GDPR Article 9(2) points (i) and (j). 114 HDABs are assigned tasks in the public interest within the meaning of Article 6(1)(e) of the GDPR, in accordance with Article 9(2) points (g)-(j). Health data users must have their own legal basis under GDPR Article 6; where they rely on Article 6(1), points (e) or (f), the EHDS provides the safeguards required under Article 9(2) of the GDPR.
Departing from a predominantly consent-oriented model of health data sharing, the EU has deliberately crafted a legal framework under the EHDS that is not based on consent. Instead, it enables data-use by default by imposing legal obligations on health data holders to make health data available for secondary use. Conceptually, these two models differ fundamentally: whereas consent operates as an ex-ante prerequisite to the initiation of processing, the by default model generally permits processing from the outset, provided that the prescribed conditions and safeguards are fulfilled. This shift represents a strong political commitment to the data-driven utilization of health data.
Primary driver and justification for this shift are the societal benefits the EHDS is expected to generate:Reference Misek 115 In the preamble, the legislators list purposes benefitting society, such as research, innovation, policymaking, health threats preparedness and response, including preventing and addressing future pandemics, patient safety, personalized medicine, official statistics or regulatory activities. 116 In the context of the opt out for secondary use, societal benefits explicitly highlighted include the development of new medicines, medical devices, and health care products and services at fair and affordable prices for Union citizens, as well as improving their access to and availability across all Member States. 117
In light of the challenges associated with health data sharing under the existing legal framework this shift appears regulatorily explicable. Moreover, it coincides with a period marked by calls for more market- and innovation-friendly governance and the adoption of targeted measures to strengthen the EU data economy, with the explicit objective of enhancing European competitiveness and narrowing the innovation gap vis-à-vis the United States and China.Reference Draghi 118
At the same time, this new regulatory approach risks privileging collective or societal innovation imperatives over individual rights, including patient autonomy and meaningful control over personal health information. The tension between collective benefits and individual rights in the context of health data sharing is not new and has been examined in ethical and legal scholarship. Debates have emerged over whether citizens might even be understood to have a moral duty to share their health data for research purposes;Reference Ballantyne and Schaefer 119 calls for solidarity, framed as a willingness to contribute personal data for the benefit of others and society at large, have been voiced. 120 Concerns have been raised as to whether the EHDS regime, which systematically bypasses consent and incorporates data sharing by default rather than as a matter of free will, may even conflict with one of the EHDS’s stated objectives: the empowerment of natural persons with respect to the availability of, and control over, their electronic health data.Reference Petročnik 121
B. Introduction of Opt Out Regimes as Balancing Instrument
In view of the delicate nature of the shift away from a consent-focused model toward a framework prioritizing data sharing by default, the right to opt out, both from primary and secondary use, was the subject of intense negotiations among legislators, stakeholder groups, and scholars during the legislative process. The final adopted Regulation includes both rights. Notably, these are two distinct and independent rights, meaning that exercising one does not affect the other.
The right to opt out in primary use under the adopted Regulation depends on the Member State: Member States may, by law, provide for an opt out from exchanges under the EHDS for primary use, setting out detailed rules and safeguards. 122 Hence, this right is not granted uniformly to all EU citizens; rather, it is at the discretion of the Member State. Moreover, the right to opt out from primary use is reversible. An explicitly mentioned example for reversing the right is when processing is necessary to protect the vital interests of the data subject or of another natural person. 123
The right to opt out from secondary use — or even a potential opt in model requiring patients to actively choose to share their health data for secondary use — were debated even more intensely during the trilogue. 124 The original Commission Proposal did not contain a right to opt out from secondary use. The underlying rationale was that extending opt out mechanisms to secondary use could undermine research outcomes by introducing systematic data biases, particularly with respect to specific medical conditions or research domains. 125
Negotiations proved highly controversial, with important arguments on either side. Proponents of minimal or no opt out options stressed that the accuracy and reliability of datasets increase with the comprehensiveness, granularity, and representativeness of the available data, thereby fostering stronger research and innovation. 126 They argued persuasively that only very large and diverse datasets can produce reliable and unbiased outcomes. Such scale, they maintained, would be impossible to achieve if participation in the EHDS depended on an opt-in solution or if opt out options were offered too readily.
These claims collided with serious concerns over patient autonomy and privacy. Forcing individuals to share data that is among the most sensitive categories of personal information, often revealing highly intimate details about an individual’s life and health status, without meaningful opt out options, raised profound resistance. The sensitivity of the issue was exacerbated by the fact that data access would not be confined to trusted circles — such as health care professionals chosen by the patient or established academic institutions — but also be granted to private actors, including large technology corporations or even political parties. Such prospects fueled fears of commercial exploitation, political misuse, and an erosion of trust in both health care systems and EU governance more broadly. 127
Torn between these conflicting positions, the legislators expressly recognize the need to balance the interests of health data users, who require exhaustive and representative datasets, with the autonomy of natural persons over their personal electronic health data, which are considered particularly sensitive in the Regulation. 128 Pursuant to Recital 54, this need for balance is reflected in the right to opt out from having such data made available for secondary use. Accordingly, natural persons have a right to opt out for secondary use under the EHDS. 129 Exercising this right does not affect the processing under permits approved before that date.
This right to opt out for secondary use is reversible. Member States may make provisions in their national laws to make data available for which a right to opt out has been exercised, by way of exception and under strict conditions. Such overrides should be available only to health data users that are public sector bodies, relevant Union institutions, bodies, offices, or agencies tasked with public health functions, or to any other entity entrusted with public health responsibilities or acting on behalf of, or commissioned by, a public authority — and only when the data cannot be obtained by alternative means in a timely and effective manner. 130 An example would be to carry out tasks for public interest in the area of public health. 131
For the sake of completeness, it should be noted that the right to opt out under the EHDS is distinct from the right to object, as known in data protection law. The right to object under the GDPR is a general data protection right, not limited to electronic health data, that allows individuals to object to the processing of their personal data in specific circumstances, including processing based on public or legitimate interests. 132 In contrast, the EHDS opt out is a sui generis right established by the EHDS Regulation, to be implemented and managed by HDABs. 133 It specifically applies to the EHDS framework and introduces a sector-specific mechanism enabling individuals to exclude their personal electronic health data from reuse, regardless of the lawful basis under the GDPR. This right is not an implementation or extension of Article 21 GDPR, but rather a complementary and autonomous instrument designed for the EHDS context. Furthermore, whereas the GDPR requires the data subject to provide reasons for objecting to processing and allows the controller to override the objection, the EHDS opt out does not require any justification, and it cannot be overridden by the controller.
Unlike the right to opt out in primary use, which is left to the discretion of the Member States, the right to opt out for secondary use is established as a Union-wide entitlement. Nevertheless, the EHDS does not introduce a harmonized opt out mechanism at EU level. Instead, responsibility for giving effect to this right is delegated to national legislators, who must implement it in a manner consistent with the EHDS and other applicable legal frameworks. Member states therefore enjoy considerable discretion in designing and implementing opt out mechanisms, including the degree of granularity afforded. For example, national regimes may allow individuals to opt out of specific categories of secondary use or of particular types of health data. 134
As noted earlier, on highly contested issues, such opening clauses granting national discretion are frequently used as a last-resort compromise when no other political consensus can be reached. Yet they carry the risk of recreating the very conditions the EHDS aims to overcome, as divergent national approaches may once again obstruct cross-border data sharing and undermine the framework’s overall coherence and interoperability. Opt out mechanisms under the EHDS may vary across Member States, shaped by differing cultural norms, legal traditions, and prevailing conceptions of individual autonomy in health-related decision-making. 135 Overly granular opt out models may generate significant organizational and administrative complexity; 136 models that are insufficiently granular may fail to adequately reflect patients’ preferences. Moreover, extensive or uneven opt out practices may introduce biases into datasets and distort data processing outcomes, thereby affecting the reliability, utility, and precision of secondary use.
VII. Conclusion
The Regulation on the European Health Data Space establishes a new legal framework to advance data-driven health care, research, innovation, and policymaking across the EU. The Regulation seeks to achieve this through a single European market for health data, unified regulatory frameworks, and harmonized technical standards, while simultaneously strengthening patients’ access to their data and safeguarding their rights.
The legislative process behind the Regulation has been demanding, and given the scope of the regulatory effort, its implementation is also expected to be complex. Although the Regulation has entered into force, considerable work remains in drafting and adopting the required Implementing Acts. Setting up the entire EHDS infrastructure will require substantial legislative and technical harmonization across EU Member States. 137 Furthermore, the governance structure still needs to be fully established, and Member States face the substantial task of fulfilling their respective obligations.
From a patient perspective, the outcome of the legislative negotiations appears ambivalent. The EHDS is designed to strengthen patient rights, and the Regulation undoubtedly provides individuals with greater control over certain aspects of their health data. However, the policy shift towards a data-sharing by default approach under the EHDS is in potential conflict with fully respecting patient autonomy. The opt out regimes both allow for national deviations, creating a fragmented landscape of patient rights across the Union instead of the unified European health data market that was envisioned and promised to them.
From a technical perspective, the highly diverse state of digitalization across health care systems in different Member States poses a significant challenge in meeting the ambitious timelines. Legally, the EHDS is embedded within a dense web of existing legislation 138 — yet its interplay with these laws remains, at present, inconclusively clarified. From a regulatory standpoint, the numerous opening clauses in the newly adopted Regulation risk creating a more fragmented regulatory landscape than stakeholders are hoping for. This is particularly concerning given that the high level of fragmentation in health data processing under the GDPR was one of the reasons for introducing the EHDS in the first place. The challenges of reconciling vastly different positions during the legislative process may now lead to an outcome that lacks once more in solving the very issue it sought to address.
Building on the foregoing analysis, particular attention should be paid to the design of patient opt out mechanisms. Going forward, proactive cooperation among Member States to develop common and coherent mechanisms that respect patients’ preferences and concerns should be a central objective. In designing these, policymakers must strike a careful balance between personalization and practicality: insufficient granularity may undermine trust and not reflect patient’s preferences, whereas excessive differentiation risks confusion, decision fatigue, and low levels of engagement. Member States are therefore called to focus on defining a limited set of essential and meaningful opt out levels that reflect genuine differences in data sensitivity and public expectations. 139 Ideally, Member States could seek to agree on a unified yet selective opt out mechanism for secondary use under the EHDS, underpinned by Union-wide standardized criteria and templates. A harmonized but flexible approach of this kind would maximize patient autonomy by enabling informed choice and strengthening trust in the EHDS, while simultaneously ensuring regulatory consistency and minimizing administrative complexity. Additionally, opt out mechanisms should be communicated in a clear and transparent manner to support and sustain public trust. 140 Coordination of this kind among Member States has the potential to strengthen patients’ trust in the system and, in turn, increase their willingness to permit the secondary use of their health data, which is an essential precondition for realizing the objectives set out in the EHDS framework. Reference Petročnik 141
Patients’ trust will ultimately decide the success of the EHDS. Member States should therefore act decisively to raise public awareness, build confidence in both the individual and societal benefits of responsible health data sharing, and communicate clearly about the framework’s objectives, operational mechanisms, and safeguards. Only by ensuring that patients understand and trust how their data are governed can the EHDS achieve its long-term legitimacy, effectiveness, and societal acceptance.
Disclosures
The author has nothing to disclose.
Open access
