The European Health Data Space Regulation has arrived but will its mandatory sharing requirement be its tour de force or Achilles’ heel?
The Regulation amounts to an ambitious and laudable step towards a more integrated and streamlined approach to the secondary use of electronic health data. Such initiatives are, and will continue to be vital for the future of genomic research. Notably because of researchers’ need for easier and more equitable access to siloed data that is currently being held across multiple locations and jurisdictions. Promisingly, the Regulation seeks to achieve just that.
The Regulation has now been approved by the European Parliament and while we are still waiting for the Council’s approval, it is expected to be published in the autumn. What is apparent is that the Regulation will not be binding for another two years and rules on the secondary use of health data will only begin to apply in four years time (with a few further exceptions on sensitive health data categories which will be applicable from 2030 onwards). Once in force, the Regulation will be ‘binding in its entirety and directly applicable in all Member States.’
We have already provided an outline of what the European Health Data Space is for the purposes of research in our previous brief. This blog will instead focus on the mandatory sharing requirement underpinning the Regulation and some of the challenges it raises for industrial and academic researchers.
Mandatory sharing?
The Regulation introduces the mandatory sharing of health data as the default position under Article 1. This applies to manufacturers and suppliers of electronic health systems; controllers and processors of European electronic health data whether established in the Union or a third country connected to the EHDS data sharing infrastructure; and data users ‘to whom electronic health data has been made available by data holders in the Union’.
However, under available plans, the Regulation permits Member States to determine in what contexts citizens and/or patients are to be given an opt-out on the use of their health data – whether by a healthcare professional for primary care uses or for secondary uses such as research – except where overriding public interest, policy making, statistics and research in the public interest exist.
The opt-out mechanism has caused some anxiety among researchers. Such a mechanism could reduce the overall amount of data available for research, cause biassed and patchy datasets, and undermine the available data’s utility – ultimately impacting the innovative environment that the Regulation seeks to achieve.
Some have suggested limiting the opt-out to the categories of health data listed under Article 33 and only to only effectuate that choice where ‘an opt-out can reasonably be offered, changed, managed and respected, without undue burden on the healthcare system and data holders.’
It is unclear how ‘purposes in the public interest’ will be interpreted but what is clear is that industrial and academic stakeholders have not been given an equivalent opt out. The only exceptions to this are micro-enterprises who are excluded from the obligation to make their health data available for secondary uses.
Intellectual property and trade secrecy rights
Consequently, some in the pharmaceutical industry have raised concerns about the mandatory nature of data sharing because of the impact it could have on their research and innovation capacities.
Under Article 33(4) private entities can be forced to hand over access to the electronic health data that they hold, regardless of whether such data entails IP rights or trade secrets. The responsibility of enforcing such access requests has been given to the relevant data access body under Article 43.
That article empowers data access bodies to levy fines for data holders where they fail to give access to electronic health data within two months of receiving an access request. Moreover, where access to electronic health data is intentionally obstructed or where a data holder is an evident repeat offender, such data holders can also be excluded from the European Health Data Space for up to 5 years.
From the perspective of secondary use stakeholders, the challenges do not end there. Article 37(f) grants data access bodies the power to determine what amounts to commercially sensitive and confidential information. It has been argued that Articles 33(4) and 37(f) conflict with existing IP and trade secret frameworks which typically grant the right holder that prerogative – “to determine what amounts to commercially sensitive information”.
The key question is whether such data access bodies will have the necessary breadth and depth of expertise to make such decisions. Particularly given that a wrong decision could result in serious economic impacts which in turn could undermine the flourishing and innovative environment that the Regulation seeks to create for European health.
On the surface, it seems that industrial data holders will, much like Member States, be compelled to share electronic health data, even if they feel that doing so could undermine their own market interests and/ or their potential to deliver the research and innovation needed for European health.
Such a bold regulatory move under Articles 33(4) and 37 may come as a surprise given that running such a large federated system will inevitably require the significant backing of industry, who both hold great financial and technical resources as well as large and potentially valuable data libraries for this initiative.
Challenges for enforcement
As such, the effectiveness of such an approach will largely be determined by the Regulation’s powers of enforcement under Article 43. However, there seems to be inklings that, as currently drafted, these may not be sufficient – Article 43(5) states that fine amounts will be ‘transparent’ and ‘proportionate’ but does not provide further detail on how proportionality or transparency will be interpreted. For example, Article 43 does not clarify if ‘proportionality’ refers to the size of the enterprise and/or the scale of the offence.
It seems that both would need to be taken into account to be an effective and proportionate deterrent. Otherwise, we may see instances of data holders weighing up whether it is economically more prudent to take the fine and hold onto their commercially sensitive information – or to take the risk of harm to their innovative capacity and abide by the data access request. There will certainly be other factors to be considered such as reputational damage if such fines are made public. However, “transparency” and “being transparent” about fine amounts may in fact facilitate entities to self-determine whether breaching a data access request is more commercially viable, ultimately undermining data access bodies’ powers of enforcement.
Data access bodies will be under huge pressure to get this delicate balance right in order to effectuate the benefits that the Regulation seeks to realise. This will be no small feat. Such bodies will need to have the sufficient expertise to successfully grapple with – for example – the complexities of cross-border IP interests in an era further complicated by the exponential growth of AI and “big data” in such federated spaces.
Striking the appropriate balance between industry interests and greater data access, as well as between effective enforcement and maintaining a fertile environment for innovation, will be vital to the European Health Data Space’s success.
Final thoughts
Mandatory data sharing raises significant questions on the public acceptance of the proposed uses of health data and also raises challenges for researchers and industry where data sharing impacts their IP rights and commercially sensitive data.
It seems that only the first (public acceptance) is partially addressed by the opt-out proposal as the final decision on whether it will be offered to patients/ participants is left to individual Member States. The second (protection for commercially sensitive interests) has also been largely unaddressed and left to data access bodies who are likely to be under-resourced in terms of time, money and expertise to avoid bottlenecks caused by lengthy appeals. Its success will likely rely on a combination of effective enforcement, appropriate and considered use of the opt-out mechanism and sufficient expertise in commercially relevant interests.
However, despite a predictably difficult teething period, if successfully executed the European Health Data Space could be an object of envy around the world. From a UK (third country) perspective it will be interesting to see what lessons can be gleaned from such an ambitious and at scale data sharing initiative, as the UK has also started to consider national scale “data spaces” or “federated research environments” for our own health data.