The European Health Data Space (EHDS) draft regulation is a key component of Europe’s strategy for data. It holds the potential to unlock the value of data and ultimately to be a powerful enabler of benefits for patients, public authorities, and researchers, public or private, by providing a robust, consistent and harmonised European technical and governance framework for health data access and sharing. It is an unprecedented opportunity to tear down silos, to connect segregated data to generate new insights and solutions to address existing and emerging challenges in healthcare.   

EFPIA continues to support the establishment of the EHDS and the European Commission’s ambitions with the proposal. The recent negotiations at European Parliament (EP) and Council of the European Union (the Council) levels on the proposal have already strengthened some areas of the draft legislation, in particular as regard to alignment with other European legislations (such as the Clinical Trials Regulation) and to providing more clarity on sharing data from private data holders.  

However, as the tripartite institutional negotiations on the file are advancing, EFPIA calls for a compromise that balances ​the desired improvement of data sharing mechanisms with the preservation of a competitive European innovation ecosystem, ​​​​​​​the protection of individuals’ rights to control their health data and the need to harmonise national health data access pathways. We would ​thus ​like to highlight the​se​ aspects that are​ in our opinion​ fundamental to the success of the proposal and require thorough consideration to avoid unintended consequences and ensure EU businesses will remain competitive in the global environment:  

a) Creating a framework that truly fosters EU competitiveness and innovation  

Data in scope for secondary useGiven that clinical trial data sharing is already regulated by a well-defined EU law, we welcome the amendment which provides greater legal certainty by ensuring alignment with existing sectoral legislation, in particular when it comes to data from clinical trials that have ended in accordance with the Clinical Trials Regulation. In contrast, there is remaining uncertainty resulting from the broadly defined concepts and terminologies describing other types of health data in scope for secondary use (e.g. ‘person-generated health data’, ‘automatically generated electronic health data’). The current text should narrow the scope of these data types to balance the ambition of improving researchers access to data for innovation with protecting incentives to do exploratory research.  For example, mandatory sharing of all non-clinical research data represents a new and wide category for disclosure that negatively impacts researchers and developers of new health technologies. In consequence, this requirement may result in less investment into early research in Europe and leave EU citizens excluded from ground-breaking research that shapes the future of healthcare. If not addressed in the primary legislation, we call on the EU Institutions to include provisions that implementing acts of the legislation will set out clarifying detail on data in scope.  

Protection of intellectual property and trade secrets 

The current proposals are in direct contradiction with the existing frameworks for the protection of intellectual property (IP) rights and trade secrets by giving the responsibility to the Health Data Access Bodies (HDAB) to act as a gatekeeper for assessing what constitutes commercially confidential information (CCI) of the data holder and for protecting these rights. The Council text also gives the right to the HDAB to decide on appropriate protection of IP without elaborating on the steps taken to implement them. It is noteworthy that the finalized Data Act includes more tangible protections for trade secrets than the EHDS.  The recognised principles already in place in the adopted legislation should be carried over to the EHDS.  Data holders must remain involved in all steps of the protection of their IP, including a final right to refuse sharing of data if it is likely to suffer serious economic damage through the disclosure of trade secrets, as is provided in the Data Act. It should be noted that the HDABs will not have the technical, scientific, commercial, or economic expertise to evaluate whether data constitutes a trade secret. The assessment of the HDAB cannot take precedent over the assessment of the data holder in determining for a private company whether a dataset constitutes a Trade Secret. ​The question of whether a given data set constitutes a trade secret is a legal conclusion.  As it stands today, the EHDS does not provide the data holder with a decisive role in determining the necessary secrecy preserving measures to be applied by the HDAB and the data users, nor with a right to refuse to share its data in the event it is not satisfied with measures in place or the way it is adhered to. As currently drafted, the EHDS would delegate this legitimate role of the data holder to the HDABs, meaning the data holder is unjustifiably made dependent on others’ actions to preserve its trade secrets. 

b) Harmonisation and representativeness of data  

We continue to strongly believe that introducing an op-out mechanism in the EHDS regulation is unnecessary as the original European Commission proposal already addresses the right of control of patients over their health data.  The inclusion of an opt out and even in some cases opt-in mechanism may jeopardise the development of future innovations by reducing the overall amount of data in the EHDS. EFPIA is of the opinion that if the EU lawmakers want to insert a general opt-out right in the EHDS Regulation, this right should be limited to the data categories in Article 33 of the proposal for which the general opt-out choice can reasonably be offered, changed, managed and respected, without undue burden on the healthcare system and data holders. The main concerns and recommendations related to practical implementation of opt out were expressed in a statement developed with a multi-stakeholder group, representing the entire spectrum of the healthcare ecosystem and consisting of 36 European patient organisations, medical associations, health research infrastructures and health industry associations.  

c) A global ecosystem for medical research 

The provision allowing Member States to introduce further conditions in the context of international access and transfer of personal health data may​​ be more restrictive approach than those in GDPR and fuel fragmentation, working against the move towards a harmonised health data ecosystem. In the context of international data transfer of non-personal (anonymised) data, the EP position provides that all data categories of data entering the EHDS will be considered highly sensitive non-personal electronic health data which is a new term, not used in the current law, with unknown rules to be followed to ensure compliance. These provisions may create even more ambiguity in an already complex environment and are against the objective to harmonise data flows and free movement of electronic health data.  

​​​​​As proposed by the EP, a broadly defined data localisation requirement for all health data generated in the Union, irrespective of any EHDS access request, and cross-border restrictions may limit opportunities for EU patients to access treatment by:  

• Limiting the possibility to manufacture the medicinal product outside of EU;  
• Impacting the traceability to the patient; 
• Negatively affecting research collaboration involving researchers from EU and non-EU countries; 
• Disrupting the ability of companies to combine data from different regions in the world, for example to conduct global clinical trials or to make safety evaluations; and  
• Limiting the possibility to fulfill the regulatory obligations in the area of pharmacovigilance and product quality complaints.  

We recommend clarification on these requirements to provide greater certainty on the rules for international data transfers and data storage. It is vital to the goals of improving patient treatments and patient safety, improving public health, and accelerating the availability of innovative therapies. It is worth noting the international transfers of personal information for purposes of medical research and monitoring drug reactions transfers take place pursuant to legal and ethical frameworks that ensure the confidentiality of the data and protection of individual privacy rights. 

As the pharmaceutical industry has a long history of developing privacy compliant solutions which involve anonymisation techniques, we would welcome the opportunity to be part of the discussion on workable and balanced pseudonymisation and anonymisation processes established methods and tools that could facilitate the high-quality adoption and rapid benefits realisation from the EHDS Regulation. 

Call to action 

As the file progresses in the trilogue discussions, EFPIA calls the co-legislators to seize this opportunity to thoroughly examine aspects raised in this paper to provide greater legal certainty and keep the momentum for harmonization. With such refinements, the EHDS has a real chance to shape the future health data and digital ecosystem and bring enormous benefits to European patients, healthcare professionals, and health systems.