Sittings · Document

DRAFT REPORT (COM(2022)0197 – C90167/2022 – 2022/0140(COD)) 2023-02-10

On the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space

Committee on the Environment, Public Health and Food Safety Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Tomislav Sokol, Annalisa Tardino

Official HTML ↗ PDF DOCX

PR_COD_1amCom

Symbols for procedures

* Consultation procedure

*** Consent procedure

***I Ordinary legislative procedure (first reading)

***II Ordinary legislative procedure (second reading)

***III Ordinary legislative procedure (third reading)

(The type of procedure depends on the legal basis proposed by the draft act.)

Amendments to a draft act

Amendments by Parliament set out in two columns

Deletions are indicated in bold italics in the left-hand column. Replacements are indicated in bold italics in both columns. New text is indicated in bold italics in the right-hand column.

The first and second lines of the header of each amendment identify the relevant part of the draft act under consideration. If an amendment pertains to an existing act that the draft act is seeking to amend, the amendment heading includes a third line identifying the existing act and a fourth line identifying the provision in that act that Parliament wishes to amend.

Amendments by Parliament in the form of a consolidated text

New text is highlighted in bold italics. Deletions are indicated using either the ▌symbol or strikeout. Replacements are indicated by highlighting the new text in bold italics and by deleting or striking out the text that has been replaced.

By way of exception, purely technical changes made by the drafting departments in preparing the final text are not highlighted.

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space

(COM(2022)0197 – C90167/2022 – 2022/0140(COD))

(Ordinary legislative procedure: first reading)

– having regard to the Commission proposal to Parliament and the Council (COM(2022)0197),

– having regard to Article 294(2) and Articles 16 and 114 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90167/2022),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to the opinion of the European Economic and Social Committee of 22 September 2022,

– having regard to the opinion of the Committee of the Regions of 9 February 2023,

– having regard to Rules 59 and 40 of its Rules of Procedure,

– having regard to the opinions of the Committee on Industry, Research and Energy and of the Committee on Internal Market and Consumer Protection,

– having regard to the report of the Committee on the Environment, Public Health and Food Safety and the Committee on Civil Liberties, Justice and Home Affairs (A90000/2023),

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Amendment 1

Proposal for a regulation

Recital 3

Text proposed by the Commission

Amendment

(3) The COVID-19 crisis strongly anchored the work of the eHealth Network, a voluntary network of digital health authorities, as the main pillar for the development of mobile contact tracing and warning applications and the technical aspects of the EU Digital COVID Certificates. It also highlighted the need for sharing electronic health data that are findable, accessible, interoperable and reusable (‘FAIR principles’), and ensuring that electronic health data are as open as possible and as closed as necessary. Synergies between the EHDS, the European Open Science Cloud42 and the European Research Infrastructures should be ensured, as well as lessons learned from data sharing solutions developed under the European COVID-19 Data Platform.

(3) The COVID-19 crisis strongly anchored the work of the eHealth Network, a voluntary network of digital health authorities, as the main pillar for the development of mobile contact tracing and warning applications and the technical aspects of the EU Digital COVID Certificates. Moreover, real-time access to data was also highly valuable in directing appropriate policy responses. It also highlighted the need for sharing electronic health data that are findable, accessible, interoperable and reusable (‘FAIR principles’), and ensuring that electronic health data are as open as possible and as closed as necessary. Synergies between the EHDS, the European Open Science Cloud42 and the European Research Infrastructures should be ensured, as well as lessons learned from data sharing solutions developed under the European COVID-19 Data Platform.

_________________

42 EOSC Portal (eosc-portal.eu).

Or. en

Amendment 2

Proposal for a regulation

Recital 5 a (new)

Text proposed by the Commission

Amendment

(5a) Although Regulation 2016/679 does not apply to the personal data of deceased persons, such data, in particular health data, may constitute personal data of the relatives of deceased persons and create certain risks. Member States are encouraged to allow either a person appointed by the data subject during their life or a close relative, if a close relative has a legitimate interest in such protection or for family reasons worthy of protection, to exercise the data subject's rights of deceased person arising from this Regulation after their death, in particular to fully or partially opt-out of having some or all of their personal electronic health data processed for secondary use. Data holders should ensure that data of deceased individuals is kept in a way that ensures its confidentiality, in particular by applying relevant technical and organisational measures, and is respectful to the deceased individuals and their relatives. Member States are encouraged to allow data subjects to establish instructions for the management of their personal data after death. In case where a data subject has expressly forbidden it with a written declaration, exercise of data subject rights by an appointed person or a close relative should not be permitted.

Or. en

Amendment 3

Proposal for a regulation

Recital 7

Text proposed by the Commission

Amendment

(7) In health systems, personal electronic health data is usually gathered in electronic health records, which typically contain a natural person’s medical history, diagnoses and treatment, medications, allergies, immunisations, as well as radiology images and laboratory results, spread between different entities from the health system (general practitioners, hospitals, pharmacies, care services). In order to enable that electronic health data to be accessed, shared and changed by the natural persons or health professionals, some Member States have taken the necessary legal and technical measures and set up centralised infrastructures connecting EHR systems used by healthcare providers and natural persons. Alternatively, some Member States support public and private healthcare providers to set up personal health data spaces to enable interoperability between different healthcare providers. Several Member States have also supported or provided health data access services for patients and health professionals (for instance through patients or health professional portals). They have also taken measures to ensure that EHR systems or wellness applications are able to transmit electronic health data with the central EHR system (some Member States do this by ensuring, for instance, a system of certification). However, not all Member States have put in place such systems, and the Member States that have implemented them have done so in a fragmented manner. In order to facilitate the free movement of personal health data across the Union and avoid negative consequences for patients when receiving healthcare in cross-border context, Union action is needed in order to ensure individuals have improved acess to their own personal electronic health data and are empowered to share it.

Or. en

Amendment 4

Proposal for a regulation

Recital 9

Text proposed by the Commission

Amendment

(9) At the same time, it should be considered that immediate access to certain types of personal electronic health data may be harmful for the safety of natural persons, unethical or inappropriate. For example, it could be unethical to inform a patient through an electronic channel about a diagnosis with an incurable disease that is likely to lead to their swift passing instead of providing this information in a consultation with the patient first. Therefore, a possibility for limited exceptions in the implementation of this right should be ensured. Such an exception may be imposed by the Member States where this exception constitutes a necessary and proportionate measure in a democratic society, in line with the requirements of Article 23 of Regulation (EU) 2016/679. Such restrictions should be implemented by delaying the display of the concerned personal electronic health data to the natural person for a limited period. Where health data is only available on paper, if the effort to make data available electronically is disproportionate, there should be no obligation that such health data is converted into electronic format by Member States. Any digital transformation in the healthcare sector should aim to be inclusive and benefit also natural persons with limited ability to access and use digital services. Natural persons should be able to provide an authorisation to the natural persons of their choice, such as to their relatives or other close natural persons, enabling them to access or control access to their personal electronic health data or to use digital health services on their behalf. Such authorisations may also be useful for convenience reasons in other situations. Proxy services should be established by Member States to implement these authorisations, and they should be linked to personal health data access services, such as patient portals on patient-facing mobile applications. The proxy services should also enable guardians to act on behalf of their dependent children; in such situations, authorisations could be automatic. In order to take into account cases in which the display of some personal electronic health data of minors to their guardians could be contrary to the interests or will of the minor, Member States should be able to provide for such limitations and safeguards in national law, as well as the necessary technical implementation. Personal health data access services, such as patient portals or mobile applications, should make use of such authorisations and thus enable authorised natural persons to access personal electronic health data falling within the remit of the authorisation, in order for them to produce the desired effect.

(9) At the same time, it should be considered that immediate access to certain types of personal electronic health data may be harmful for the safety of natural persons, unethical or inappropriate. For example, it could be unethical to inform a patient through an electronic channel about a diagnosis with an incurable disease that is likely to lead to their swift passing instead of providing this information in a consultation with the patient first. Therefore, a possibility for limited exceptions in the implementation of this right should be ensured. Such an exception may be imposed by the Member States where this exception constitutes a necessary and proportionate measure in a democratic society, in line with the requirements of Article 23 of Regulation (EU) 2016/679. Such restrictions should be implemented by delaying the display of the concerned personal electronic health data to the natural person for a limited period. Where health data is only available on paper, if the effort to make data available electronically is disproportionate, there should be no obligation that such health data is converted into electronic format by Member States. Any digital transformation in the healthcare sector should aim to be inclusive and benefit also natural persons with limited ability to access and use digital services. Member States should design policies aimed at facilitating the inclusion in the EHDS of people lacking digital skills or lacking access to the internet and people with disabilities Natural persons should be able to provide an authorisation to the natural persons of their choice, such as to their relatives or other close natural persons, enabling them to access or control access to their personal electronic health data or to use digital health services on their behalf. Such authorisations may also be useful for convenience reasons in other situations. Proxy services should be established by Member States to implement these authorisations, and they should be linked to personal health data access services, such as patient portals on patient-facing mobile applications. The proxy services should also enable guardians to act on behalf of their dependent children; in such situations, authorisations could be automatic. In order to take into account cases in which the display of some personal electronic health data of minors to their guardians could be contrary to the interests or will of the minor, Member States should be able to provide for such limitations and safeguards in national law, as well as the necessary technical implementation. Personal health data access services, such as patient portals or mobile applications, should make use of such authorisations and thus enable authorised natural persons to access personal electronic health data falling within the remit of the authorisation, in order for them to produce the desired effect.

Or. en

Amendment 5

Proposal for a regulation

Recital 10

Text proposed by the Commission

Amendment

(10) Some Member States allow natural persons to add electronic health data to their EHRs or to store additional information in their separate personal health record that can be accessed by health professionals. However, this is not a common practice in all Member States and therefore should be established by the EHDS across the EU. Information inserted by natural persons may not be as reliable as electronic health data entered and verified by health professionals, therefore it should be clearly marked to indicate the source of such additional data. Enabling natural persons to more easily and quickly access their electronic health data also further enables them to notice possible errors such as incorrect information or incorrectly attributed patient records and have them rectified using their rights under Regulation (EU) 2016/679. In such cases, natural person should be enabled to request rectification of the incorrect electronic health data online, immediately and free of charge, for example through the personal health data access service. Data rectification requests should be assessed and, where relevant, implemented by the data controllers on case by case basis, if necessary involving health professionals.

(10) Some Member States allow natural persons to add electronic health data to their EHRs or to store additional information in their separate personal health record that can be accessed by health professionals. However, this is not a common practice in all Member States and therefore should be established by the EHDS across the EU. Information inserted by natural persons may not be as reliable as electronic health data entered and verified by health professionals, therefore it should be clearly marked to indicate the source of such additional data. Specifically relevant fields in the EHR should be clearly marked, such as patient ID, allergies, laboratory data, medical alerts, and current medication. Enabling natural persons to more easily and quickly access their electronic health data also further enables them to notice possible errors such as incorrect information or incorrectly attributed patient records and have them rectified using their rights under Regulation (EU) 2016/679. In such cases, natural person should be enabled to request rectification of the incorrect electronic health data online, immediately and free of charge, for example through the personal health data access service. Data rectification requests should be assessed and, where relevant, implemented by the data controllers on case by case basis, if necessary involving health professionals.

Or. en

Amendment 6

Proposal for a regulation

Recital 15 a (new)

Text proposed by the Commission

Amendment

(15a) It is imminent that the role and practice of health professionals will undergo a profound change with digitalisation and implementation of the EHDS. Health professionals will need to improve their digital health literacy and digital competencies, especially ones in advanced age. Therefore, health professionals who qualify as micro enterprises, as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC should be exempted of the implementation of this Regulation for some time in order to avoid disproportionate administrative burdens of micro enterprises. During the exempted period, Member States should enable healthcare professionals working as micro enterprises to take regular digital literacy courses to be able to prepare to work in EHR systems.

Or. en

Amendment 7

Proposal for a regulation

Recital 18 a (new)

Text proposed by the Commission

Amendment

(18 a) In order to support the successful implementation of the EHDS and the execution of an effective landscape of European health data cooperation, the Commission should agree with Member States a range of time-based targets for implementation of health data interoperability milestones, including in respect to cancer registry interoperability.

Or. en

Amendment 8

Proposal for a regulation

Recital 24

Text proposed by the Commission

Amendment

(24) Access to and transmission of electronic health data is relevant in cross-border healthcare situations, as it may support continuity of healthcare when natural persons travel to other Member States or change their place of residence. Continuity of care and rapid access to personal electronic health data is even more important for residents in border regions, crossing the border frequently to get health care. In many border regions, some specialised health care services may be available closer across the border rather than in the same Member State. An infrastructure is needed for the transmission of personal electronic health data across borders, in situations where a natural person is using services of a healthcare provider established in another Member State. A voluntary infrastructure for that purpose, MyHealth@EU, has been established as part of the actions provided for in Article 14 of Directive 2011/24/EU. Through MyHealth@EU, Member States started to provide natural persons with the possibility to share their personal electronic health data with healthcare providers when travelling abroad. To further support such possibilities, the participation of Member States in the digital infrastructure MyHealth@EU should become mandatory. All Member States should join the infrastructure and connect healthcare providers and pharmacies to it, as this is necessary for the implementation of the rights of natural persons to access and make use of their personal electronic health data regardless of the Member State. The infrastructure should be gradually expanded to support further categories of electronic health data.

Or. en

Amendment 9

Proposal for a regulation

Recital 25

Text proposed by the Commission

Amendment

(25) In the context of MyHealth@EU, a central platform should provide a common infrastructure for the Member States to ensure connectivity and interoperability in an efficient and secure way. In order to guarantee compliance with data protection rules and to provide a risk management framework for the transmission of personal electronic health data, the Commission should, by means of implementing acts, allocate specific responsibilities among the Member States, as joint controllers, and prescribe its own obligations, as processor.

Or. en

Amendment 10

Proposal for a regulation

Recital 36 a (new)

Text proposed by the Commission

Amendment

(36a) Facilitating the use of real-world data offers benefits for policy and regulatory decision-making, research, clinical, and health technology assessment purposes. Real-world evidence complements randomized clinical trial data and enables a holistic understanding of medicines’ effectiveness, impact and safety in large and heterogeneous populations. It is particularly crucial for policy and regulatory decision-making in certain disease areas, including respiratory or rare diseases. On top of enabling better health outcomes for patients, the more intensive use of real-world evidence also offers economic benefits and can contribute to the greater sustainability of health systems.

Or. en

Justification

The important role of real-world evidence for policy decision-making is currently not emphasised in the proposal. The amendment introduces a recital highlighting the potential application of real-world evidence, including the benefits for patients with certain diseases, including respiratory and rare diseases.

Amendment 11

Proposal for a regulation

Recital 37

Text proposed by the Commission

Amendment

(37) For the secondary use of the clinical data for research, innovation, policy making, regulatory purposes, patient safety or the treatment of other natural persons, the possibilities offered by Regulation (EU) 2016/679 for a Union law should be used as a basis and rules and mechanisms and providing suitable and specific measures to safeguard the rights and freedoms of the natural persons. This Regulation provides the legal basis in accordance with Articles 9(2) (g), (h), (i) and (j) of Regulation (EU) 2016/679 for the secondary use of health data, establishing the safeguards for processing, in terms of lawful purposes, trusted governance for providing access to health data (through health data access bodies) and processing in a secure environment, as well as modalities for data processing, set out in the data permit. At the same time, the data applicant should demonstrate a legal basis pursuant to Article 6 of Regulation (EU) 2016/679, based on which they could request access to data pursuant to this Regulation and should fulfil the conditions set out in Chapter IV. More specifically: for processing of electronic health data held by the data holder pursuant to this Regulation, this Regulation creates the legal obligation in the sense of Article 6(1) point (c) of Regulation (EU) 2016/679 for disclosing the data by the data holder to health data access bodies, while the legal basis for the purpose of the initial processing (e.g. delivery of care) is unaffected. This Regulation also meets the conditions for such processing pursuant to Articles 9(2) (h),(i),(j) of the Regulation (EU) 2016/679. This Regulation assigns tasks in the public interest to the health data access bodies (running the secure processing environment, processing data before they are used, etc.) in the sense of Article 6(1)(e) of Regulation (EU) 2016/679 to the health data access bodies, and meets the requirements of Article 9(2)(h),(i),(j) of the Regulation (EU) 2016/679. Therefore, in this case, this Regulation provides the legal basis under Article 6 and meets the requirements of Article 9 of that Regulation on the conditions under which electronic health data can be processed. In the case where the user has access to electronic health data (for secondary use of data for one of the purposes defined in this Regulation), the data user should demonstrate its legal basis pursuant to Articles 6(1), points (e) or (f), of Regulation (EU) 2016/679 and explain the specific legal basis on which it relies as part of the application for access to electronic health data pursuant to this Regulation: on the basis of the applicable legislation, where the legal basis under Regulation (EU) 2016/679 is Article 6(1), point (e), or on Article 6(1), point (f), of Regulation (EU) 2016/679. If the user relies upon a legal basis offered by Article 6(1), point (e), it should make reference to another EU or national law, different from this Regulation, mandating the user to process personal health data for the compliance of its tasks. If the lawful ground for processing by the user is Article 6(1), point (f), of Regulation (EU) 2016/679, in this case it is this Regulation that provides the safeguards. In this context, the data permits issued by the health data access bodies are an administrative decision defining the conditions for the access to the data.

(37) For the secondary use of electronic health data for research, innovation, policy making, regulatory purposes, patient safety or the treatment of other natural persons, the possibilities offered by Regulation (EU) 2016/679 for a Union law should be used as a basis for rules and mechanisms and providing suitable and specific measures to safeguard the rights and freedoms of the natural persons. For processing of electronic health data for secondary use, a legal basis set out in Article 6(1)(c), (e) or (f) combined with a legal basis set out in Article 9(2) of Regulation (EU) 2016/679 is required. The most relevant processing grounds listed in Article 9(2) of Regulation (EU) 2016/679 in this context concern the provision of health or social care (point (h)), substantial public interest (point (g)), public interest in the area of public health (point (i)) and research (point (j)). Hence, this Regulation provides the legal basis in accordance with Articles 9(2) (g), (h), (i) and (j) of Regulation (EU) 2016/679 for the secondary use of health data, establishing the safeguards for processing, in terms of lawful purposes, trusted governance for providing access to health data (through health data access bodies) and processing in a secure environment, as well as modalities for data processing, set out in the data permit. More specifically, for processing of electronic health data held by the data holder pursuant to this Regulation, this Regulation creates the legal obligation in the sense of Article 6(1) point (c) of Regulation (EU) 2016/679 for disclosing the data by the data holder to health data access bodies, while the legal basis for the purpose of the initial processing (e.g. delivery of care) is unaffected. This Regulation assigns tasks in the public interest to the health data access bodies (running the secure processing environment, processing data before they are used, etc.) in the sense of Article 6(1)(e) of Regulation (EU) 2016/679, and meets the requirements of Article 9(2)(h),(i),(j) of the Regulation (EU) 2016/679. At the same time, the data applicant should demonstrate a legal basis pursuant to Article 6 of Regulation (EU) 2016/679, combined with Article 9(2) thereof, based on which they could request access to data pursuant to this Regulation and should fulfil the conditions set out in Chapter IV of this Regulation. In the case where the user has access to electronic health data (for secondary use of data for one of the purposes defined in this Regulation), the data user should demonstrate the specific legal basis on which it relies as part of the application for access to electronic health data pursuant to this Regulation: on the basis of the applicable legislation, where the legal basis under Regulation (EU) 2016/679 is Article 6(1), point (e), or on Article 6(1), point (f), of Regulation (EU) 2016/679. If the user relies upon a legal basis offered by Article 6(1), point (e), it should make reference to another EU or national law, different from this Regulation, mandating the user to process personal health data for the compliance of its tasks. If the lawful ground for processing by the user is Article 6(1), point (f), of Regulation (EU) 2016/679, in this case it is this Regulation that provides the appropriate and necessary safeguards. In this context, the data permits issued by the health data access bodies are an administrative decision defining the conditions for the access to the data.

Or. en

Amendment 12

Proposal for a regulation

Recital 39

Text proposed by the Commission

Amendment

(39) The categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users, while remaining limited to data related to health or known to influence health. It can also include relevant data from the health system (electronic health records, claims data, disease registries, genomic data etc.), as well as data with an impact on health (for example consumption of different substances, homelessness, health insurance, minimum income, professional status, behaviour, including environmental factors (for example, pollution, radiation, use of certain chemical substances). They can also include person-generated data, such as data from medical devices, wellness applications or other wearables and digital health applications. The data user who benefits from access to datasets provided under this Regulation could enrich the data with various corrections, annotations and other improvements, for instance by supplementing missing or incomplete data, thus improving the accuracy, completeness or quality of data in the dataset. To support the improvement of the original database and further use of the enriched dataset, the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. The data holder should make available the new dataset, unless it provides a justified notification against it to the health data access body, for instance in cases of low quality of the enrichment. Secondary use of non-personal electronic data should also be ensured. In particular, pathogen genomic data hold significant value for human health, as proven during the COVID-19 pandemic. Timely access to and sharing of such data has proven to be essential for the rapid development of detection tools, medical countermeasures and responses to public health threats. The greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other.

(39) The categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users, while remaining limited to data related to health or known to influence health. It can also include relevant data from the health system (electronic health records, claims data, disease registries, genomic data etc.), as well as data with an impact on health (for example consumption of different substances, homelessness, health insurance, minimum income, professional status, behaviour, including environmental factors (for example, pollution, radiation, use of certain chemical substances). They can also include person-generated data, such as data from medical devices, wellness applications or other wearables and digital health applications. The data user who benefits from access to datasets provided under this Regulation could enrich the data with various corrections, annotations and other improvements, for instance by supplementing missing or incomplete data, thus improving the accuracy, completeness or quality of data in the dataset. Data users should be encouraged to report to data holders critical errors in datasets. To support the improvement of the original database and further use of the enriched dataset, the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. The data holder should make available the new dataset, unless it provides a justified notification against it to the health data access body, for instance in cases of low quality of the enrichment. Secondary use of non-personal electronic data should also be ensured. In particular, pathogen genomic data hold significant value for human health, as proven during the COVID-19 pandemic. Timely access to and sharing of such data has proven to be essential for the rapid development of detection tools, medical countermeasures and responses to public health threats. The greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other.

Or. en

Amendment 13

Proposal for a regulation

Recital 39 a (new)

Text proposed by the Commission

Amendment

(39a) A relationship of trust between patients and health or care providers is a crucial element of the provision of health or social care or treatment. It is within that delicate context that patients should have a say in the processing of their health data for secondary use. It is appropriate to empower patients- data subjects- by giving them the possibility to restrict access to all or parts of their personal data for all or parts of secondary use and to provide for obligations to clearly inform data subjects of this possibility. Therefore, an opt-out for data subjects for secondary use of their electronic health data should be envisaged, as the purpose of the secondary processing causes the patient's individual interests to prevail over the general interest of society.

Or. en

Justification

In order to empower data subjects, they should have a say on the further use of their most private and sensitive data. The possibility to opt-out of processing for secondary use should be provided to preserve the essence of the right to data protection and to provide for suitable and specific measures to safeguard the fundamental rights and interests of data subjects (Art. 9(2) GDPR).

The issue is also one of trust between the patient and the HC provider: patients may no longer wish to share their health data with HC providers if the data are then automatically passed on for secondary use.

Amendment 14

Proposal for a regulation

Recital 40 a (new)

Text proposed by the Commission

Amendment

(40a) Clinical trial sponsors should remain the first entity to analyse the locked datasets of their own trials (Phases 1-4), and sufficient time should be given to make analysis, draw conclusions and file for intellectual property right protections to protect the underlying innovation, before the data is available for secondary use. Timing of access requests should not conflict with public reporting obligations and internal insiders’ lists. Same principle of deferrals should be extended to clinical trial data as in the Clinical Trials Information System (CTIS), in accordance with Article 81(5) of Regulation (EU) No 536/2014.

Or. en

Amendment 15

Proposal for a regulation

Recital 47

Text proposed by the Commission

Amendment

(47) Health data access bodies and single data holders should be allowed to charge fees based on the provisions of Regulation […] [Data Governance Act COM/2020/767 final] in relation to their tasks. Such fees may take into account the situation and interest of SMEs, individual researchers or public bodies. Data holders should be allowed to also charge fees for making data available. Such fees should reflect the costs for providing such services. Private data holders may also charge fees for the collection of data. In order to ensure a harmonised approach concerning fee policies and structure, the Commission may adopt implementing acts. Provisions in Article 10 of the Regulation [Data Act COM/2022/68 final] should apply for fees charged under this Regulation.

(47) Health data access bodies should be allowed to charge fees based on the provisions of Regulation […] [Data Governance Act COM/2020/767 final] in relation to their tasks. Such fees may take into account the situation and interest of SMEs, individual researchers or public bodies. Data holders should be allowed to also charge fees for making data available. Such fees should reflect the costs for providing such services. Private data holders may also charge fees for the collection of data. In order to ensure a harmonised approach concerning fee policies and structure, the Commission may adopt implementing acts. Provisions in Article 10 of the Regulation [Data Act COM/2022/68 final] should apply for fees charged under this Regulation.

Or. en

Justification

Consequence of proposed deletion of Article 49.

Amendment 16

Proposal for a regulation

Recital 49

Text proposed by the Commission

Amendment

(49) Given the sensitivity of electronic health data, it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in Article 5 (1), point (c) of Regulation (EU) 2016/679. Therefore, the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. If the data user needs to use personal electronic health data, it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. The personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. Data users should not attempt to re-identify natural persons from the dataset provided under this Regulation, subject to administrative or possible criminal penalties, where the national laws foresee this. However, this should not prevent, in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance, discovering treatments or risk factors to develop a certain disease), the data users would inform the health data access body, which in turn would inform the concerned natural person(s). Moreover, the applicant can request the health data access bodies to provide the answer to a data request, including in statistical form. In this case, the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.

(49) Given the sensitivity of electronic health data, it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in Article 5 (1), point (c) of Regulation (EU) 2016/679. Therefore, the use of anonymised electronic health data, which ensures, to the maximum extent possible, by making use of state-of-the art technologies, that a person cannot be re-identified, should be made available when possible and if the data user asks it. If the data user needs to use identifiable personal electronic health data, it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. The personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. Data users should not attempt to re-identify natural persons from the dataset provided under this Regulation, subject to administrative or possible criminal penalties, where the national laws foresee this. It should be underlined that the application of pseudonymisation to personal data can only reduce the risks to the data subjects concerned but cannot exclude them. However, this should not prevent, in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance, discovering treatments or risk factors to develop a certain disease), the data users would inform the health data access body, which in turn would inform the concerned natural person(s). Moreover, the applicant can request the health data access bodies to provide the answer to a data request, including in statistical form. In this case, the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.

Or. en

Amendment 17

Proposal for a regulation

Recital 53

Text proposed by the Commission

Amendment

(53) For requests to access electronic health data from a single data holder in a single Member State and in order to alieviate the administrative burden for heath data access bodies of managing such request, the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. Multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. The data holder should report to the health data access bodies about any data permits or data requests they provide.

deleted

Or. en

Justification

Consequence of proposed deletion of Article 49.

Amendment 18

Proposal for a regulation

Recital 54

Text proposed by the Commission

Amendment

(54) Given the sensitivity of electronic health data, data users should not have an unrestricted access to such data. All secondary use access to the requested electronic health data should be done through a secure processing environment. In order to ensure strong technical and security safeguards for the electronic health data, the health data access body or, where relevant, single data holder should provide access to such data in a secure processing environment, complying with the high technical and security standards set out pursuant to this Regulation. Some Member States took measures to locate such secure environments in Europe. The processing of personal data in such a secure environment should comply with Regulation (EU) 2016/679, including, where the secure environment is managed by a third party, the requirements of Article 28 and, where applicable, Chapter V. Such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. The health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. Only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. Thus, it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. The Commission should assist the Member State in developing common security standards in order to promote the security and interoperability of the various secure environments.

(54) Given the sensitivity of electronic health data, data users should only have restricted access to such data, in accordance with the data minimisation principle. All secondary use access to the requested electronic health data should be done through a secure processing environment. In order to ensure strong technical and security safeguards for the electronic health data, the health data access body should provide access to such data in a secure processing environment, complying with the high technical and security standards set out pursuant to this Regulation. Some Member States took measures to locate such secure environments in Europe. The processing of personal data in such a secure environment should comply with Regulation (EU) 2016/679, including, where the secure environment is managed by a third party, the requirements of Article 28 and, where applicable, Chapter V. Such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. The health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. Only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. Thus, it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. The Commission should assist the Member State in developing common security standards in order to promote the security and interoperability of the various secure environments.

Or. en

Amendment 19

Proposal for a regulation

Recital 55

Text proposed by the Commission

Amendment

(55) For the processing of electronic health data in the scope of a granted permit, the health data access bodies and the data users should be joint controllers in the sense of Article 26 of Regulation (EU) 2016/679, meaning that the obligations of joint controllers under that Regulation will apply. To support health data access bodies and data users, the Commission should, by means of an implementing act, provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. In order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data, a cross-border infrastructure should be established. HealthData@EU should accelerate the secondary use of electronic health data while increasing legal certainty, respecting the privacy of natural persons and being interoperable. Due to the sensitivity of health data, principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. Authorised participants in HealthData@EU could be health data access bodies, research infrastructures established as an European Research Infrastructure Consortium (‘ERIC’) under Council Regulation (EC) No 723/200950 or similar structures established under another Union legislation, as well as other types of entities, including infrastructures under the European Strategy Forum on Research Infrastructures (ESFRI), infrastructures federated under the European Open Science Cloud (EOSC). Other authorised participants should obtain the approval of the joint controllership group for joining HealthData@EU. On the other hand, HealthData@EU should enable the secondary use of different categories of electronic health data, including linking of the health data with data from other data spaces such as environment, agriculture, social etc. The Commission could provide a number of services within HealthData@EU, including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests, maintaining catalogues of electronic health data available through the infrastructure, network discoverability and metadata queries, connectivity and compliance services. The Commission may also set up a secure environment, allowing data from different national infrastructures to be transmitted and analysed, at the request of the controllers. The Commission digital strategy promote the linking of the various common European data spaces. For the health sector, interoperability with the sectors such as the environmental, social, agricultural sectors may be relevant for additional insights on health determinants. For the sake of IT efficiency, rationalisation and interoperability of data exchanges, existing systems for data sharing should be reused as much as possible, like those being built for the exchange of evidences under the once only technical system of Regulation (EU) 2018/1724 of the European Parliament and of the Council51 .

(55) For the processing of electronic health data in the scope of a granted permit, the health data access bodies and the data users should be joint controllers in the sense of Article 26 of Regulation (EU) 2016/679, meaning that the obligations of joint controllers under that Regulation will apply. To support health data access bodies and data users, the Commission should, by means of an implementing act, provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. In order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data, a cross-border infrastructure should be established. HealthData@EU should accelerate the secondary use of electronic health data while increasing legal certainty, respecting the privacy of natural persons and being interoperable. Due to the sensitivity of health data, principles such as “privacy by design”, “privacy by default”, and “bring questions to data instead of moving data” should be respected whenever possible. Authorised participants in HealthData@EU could be health data access bodies, research infrastructures established as an European Research Infrastructure Consortium (‘ERIC’) under Council Regulation (EC) No 723/200950 or similar structures established under another Union legislation, as well as other types of entities, including infrastructures under the European Strategy Forum on Research Infrastructures (ESFRI), infrastructures federated under the European Open Science Cloud (EOSC). Other authorised participants should obtain the approval of the joint controllership group for joining HealthData@EU. On the other hand, HealthData@EU should enable the secondary use of different categories of electronic health data, including linking of the health data with data from other data spaces such as environment, agriculture, social etc. The Commission could provide a number of services within HealthData@EU, including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests, maintaining catalogues of electronic health data available through the infrastructure, network discoverability and metadata queries, connectivity and compliance services. The Commission may also set up a secure environment, allowing data from different national infrastructures to be transmitted and analysed, at the request of the controllers. The Commission digital strategy promote the linking of the various common European data spaces. For the health sector, interoperability with the sectors such as the environmental, social, agricultural sectors may be relevant for additional insights on health determinants. For the sake of IT efficiency, rationalisation and interoperability of data exchanges, existing systems for data sharing should be reused as much as possible, like those being built for the exchange of evidences under the once only technical system of Regulation (EU) 2018/1724 of the European Parliament and of the Council51 .

_________________

50 Council Regulation (EC) No 723/2009 of 25 June 2009 on the Community legal framework for a European Research Infrastructure Consortium (ERIC) (OJ L 206, 8.8.2009, p. 1).

51 Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending Regulation (EU) No 1024/2012 (OJ L 295, 21.11.2018, p. 1).

Or. en

Amendment 20

Proposal for a regulation

Recital 57

Text proposed by the Commission

Amendment

(57) The authorisation process to gain access to personal health data in different Member States can be repetitive and cumbersome for data users. Whenever possible, synergies should be established to reduce the burden and barriers for data users. One way to achieve this aim is to adhere to the “single application” principle whereby, with one application, the data user obtain authorisation from multiple health data access bodies in different Member States.

(57) The authorisation process to gain access to personal health data in different Member States can be repetitive and cumbersome for data users. Whenever possible, synergies should be established to reduce the burden and barriers for data users. One way to achieve this aim could be to adhere to the “single application” principle whereby, with one application, the data user obtain authorisation from multiple health data access bodies in different Member States.

Or. en

Amendment 21

Proposal for a regulation

Recital 61 a (new)

Text proposed by the Commission

Amendment

(61a) In order to alleviate reported difficulties associated with the implementation of Regulation (EU) 2016/679, potential outcomes of the secondary use of health data, and its impact upon cancer research, the Commission should conduct a study to examine the impact of Regulation (EU) 2016/679 and Regulation on EHDS on cancer research. The study should be completed and published by not later than one year after the adoption of this Regulation. The study should examine divergence of implementation approaches and the impacts upon different areas of cancer research, including Europe’s participation in international cancer trials. The study should include remedial recommendations.

Or. en

Amendment 22

Proposal for a regulation

Recital 63 a (new)

Text proposed by the Commission

Amendment

(63a) The initial Union funding to achieve a timely application of the EHDS is limited to what can be mobilised under the 2021-2027 Multiannual Financial Framework (MFF) where 220 million euro can be made available under the EU4Health and Digital Europe programmes. The successful and coherent application of the EHDS across all Member States will however require a higher funding. The Commission should therefore analyse the need for mobilising further resources for the EHDS as part of the review of the 2021-2027 MFF and for the forthcoming MFF under the principle that new initiatives should be matched with new funding.

Or. en

Amendment 23

Proposal for a regulation

Recital 64 a (new)

Text proposed by the Commission

Amendment

(64a) The functioning of the EHDS involves processing of a large quantity of personal and non-personal data of a highly sensitive nature. Article 8(3) of the Charter requires control over its processing by an independent authority. Such a control of compliance with the requirements of protection and security by an independent supervisory authority, carried out on the basis of Union law, is an essential component of the protection of individuals with regard to the processing of personal data and cannot be fully ensured in the absence of a requirement to retain the electronic health data in question within the Union. Therefore, bearing in mind the need to mitigate the risks of unlawful access and ineffective supervision, in compliance with the principle of proportionality, this Regulation should require Member States to store electronic health data within the territory of the Union. Such harmonisation of storage requirements should ensure a uniform high level of protection for data subjects across the Union, preserve the proper functioning of the internal market, in line with Article 114 TFEU on which this Regulation is based and serve to enhance citizens’ trust in the EHDS.

Or. en

Amendment 24

Proposal for a regulation

Recital 64 b (new)

Text proposed by the Commission

Amendment

(64b) An obligation to store electronic health data in the Union does not preclude transfers of those data to third countries or international organisations. Indeed, it is possible to reconcile a general requirement to store personal data in the Union with specific transfers being allowed in compliance with Union law on personal data protection, for instance in the context of scientific research, disbursement of care or international cooperation. In particular, when personal data are transferred from the Union to controllers, processors or other recipients in third countries or to international organisations, the level of protection of natural persons ensured in the Union by Regulation (EU) 2016/679 should not be undermined, including in cases of onward transfers of personal data from the third country or international organisation to controllers, processors in the same or another third country or international organisation. Transfers of personal health data to third countries and international organisations may only be carried out in full compliance with Chapter V of Regulation (EU) 2016/679. Hence, controllers and processors processing personal electronic health data remain subject to Article 48 of that Regulation on transfers or disclosures not authorised by Union law and should comply with this provision in case of an access request stemming from a third country. In accordance with and under the conditions of Article 9(4) of Regulation (EU) 2016/679, Member States can maintain or introduce further conditions, including limitations, to transfers of personal health data to third countries or international organisations.

Or. en

Amendment 25

Proposal for a regulation

Recital 64 c (new)

Text proposed by the Commission

Amendment

(64c) Further rules should be provided on transfers of non-personal health data to third countries or international organisations, where they are deemed highly sensitive within the meaning of Article 5(13) of Regulation (EU) 2022/868 [Data Governance Act].

Or. en

Amendment 26

Proposal for a regulation

Recital 64 d (new)

Text proposed by the Commission

Amendment

(64d) Electronic health data provide valuable information to anyone who processes it. Access to electronic health data for entities from third countries should take place only on the basis of the reciprocity principle. Making available of health data to a third country may take place only where the Commission has established by means of a delegated act that the third country concerned allows for the use of health data by Union entities under the same conditions and with the same safeguards as within the Union. The Commission should monitor such decisions, and should provide for a periodic review mechanism of their functioning. The Commission may recognise that a third country no longer ensures access on the same terms and revoke its decision.

Or. en

Amendment 27

Proposal for a regulation

Recital 65

Text proposed by the Commission

Amendment

(65) In order to promote the consistent application of this Regulation, a European Health Data Space Board (EHDS Board) should be set up. The Commission should participate in its activities and chair it. It should contribute to the consistent application of this Regulation throughout the Union, including by helping Member State to coordinate the use of electronic health data for healthcare, certification, but also concerning the secondary use of electronic health data. Given that, at national level, digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data, the functions are different and there is a need for distinct cooperation in each of these areas, the EHDS Board should be able to set up subgroups dealing with these two functions, as well as other subgroups, as needed. For an efficient working method, the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities, but also at Union level. Such bodies could comprise data protection authorities, cybersecurity, eID and standardisation bodies, as well as bodies and expert groups under Regulations […], […], […] and […] [Data Governance Act, Data Act, AI Act and Cybersecurity Act].

(65) In order to promote the consistent application of this Regulation, a European Health Data Space Board (EHDS Board) should be set up. The Board should consists of representatives from digital health authorities, European Data Protection Board, European Data Protection Supervisor, European Medicines Agency, European Centre for Disease Prevention and Control, healthcare professionals, patient organizations, and health industry. All Board members have the same rights and responsibilities. Furthermore, experts of the European Parliament should be invited to attend the meetings of the EHDS Board. The EHDS Board may also invite experts and observers to attend its meetings, and may cooperate with other external experts as appropriate. The EHDS Board should operate transparently with open publication of meeting dates and minutes of the discussion as well as an annual report. The Commission should participate in its activities and chair it. It should contribute to the consistent application of this Regulation throughout the Union, including by helping Member State to coordinate the use of electronic health data for healthcare, certification, but also concerning the secondary use of electronic health data. Given that, at national level, digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data, the functions are different and there is a need for distinct cooperation in each of these areas, the EHDS Board should be able to set up subgroups dealing with these two functions, as well as other subgroups, as needed. For an efficient working method, the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities, but also at Union level. Such bodies could comprise data protection authorities, cybersecurity, eID and standardisation bodies, as well as bodies and expert groups under Regulations […], […], […] and […] [Data Governance Act, Data Act, AI Act and Cybersecurity Act]. However, data protection issues, including the interpretation or the application of data protection rights and the identification or the handling of data breaches related to primary and secondary use of electronic health data, should remain the exclusive competence of the data protection authorities.

Or. en

Amendment 28

Proposal for a regulation

Recital 69 a (new)

Text proposed by the Commission

Amendment

(69 a) In accordance with Article 42 of Regulation (EU) 2018/1725, the Commission should, when preparing delegated acts or implementing acts, consult the European Data Protection Supervisor where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, and where such an act is of particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data, the Commission may also consult the European Data Protection Board. The Commission should moreover consult the European Data Protection Board in the cases specified in Regulation (EU) 2016/679 and when relevant in the context of this Regulation.

Or. en

Amendment 29

Proposal for a regulation

Recital 74

Text proposed by the Commission

Amendment

(74) The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42 of Regulation (EU) 2018/1725 and delivered an opinion on […].

(74) The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42 of Regulation (EU) 2018/1725 and delivered Joint Opinion n. 03/2022 on 12 July 2022.

Or. en

Amendment 30

Proposal for a regulation

Article 1 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3 a. References to the provisions of Regulation (EU) 2016/679 shall be understood also as references to the corresponding provisions of Regulation (EU) 2018/1725 for Union institutions and bodies, where relevant.

Or. en

Amendment 31

Proposal for a regulation

Article 1 – paragraph 4

Text proposed by the Commission

Amendment

4. This Regulation shall be without prejudice to other Union legal acts regarding access to, sharing of or secondary use of electronic health data, or requirements related to the processing of data in relation to electronic health data, in particular Regulations (EU) 2016/679, (EU) 2018/1725, […] [Data Governance Act COM/2020/767 final] and […] [Data Act COM/2022/68 final].

4. This Regulation shall be without prejudice to other Union legal acts regarding access to, sharing of or secondary use of electronic health data, or requirements related to the processing of data in relation to electronic health data, in particular Regulations (EU) 2016/679, (EU) 2018/1725, (EU) 2022/868 and […] [Data Act COM/2022/68 final].

Or. en

Amendment 32

Proposal for a regulation

Article 2 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) the definitions in Regulation (EU) 2016/679;

(a) the definitions, including those of ‘personal data’, ‘processing’, ‘pseudonymisation’, ‘controller’, ‘processor’, ‘third party’, ‘consent’, ‘genetic data’, ‘data concerning health’, ‘supervisory authority’, ‘international organisation’, in Regulation (EU) 2016/679;

Or. en

Amendment 33

Proposal for a regulation

Article 2 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the definitions of ‘data’, ‘access’, ‘data altruism’, ‘public sector body’ and ‘secure processing environment’, pursuant to Article 2 (1), (8), (10), (11) and (14) of [Data Governance Act COM/2020/767 final];

(c) the definitions of ‘data’, ‘access’, ‘data altruism’ and ‘secure processing environment’, pursuant to Article 2 (1), (8), (10), (11) and (14) of Regulation (EU) 2022/868;

Or. en

Amendment 34

Proposal for a regulation

Article 2 – paragraph 1 – point f a (new)

Text proposed by the Commission

Amendment

(f a) the definition of 'critical infrastructure' provided in Article 2(4) of Directive (EU) 2022/2557;

Or. en

Amendment 35

Proposal for a regulation

Article 2 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

(b) ‘non-personal electronic health data’ means data constituting health and genetic data in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

Or. en

Amendment 36

Proposal for a regulation

Article 2 – paragraph 2 – point e

Text proposed by the Commission

Amendment

(e) ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in Chapter IV of this Regulation. The data used may include personal electronic health data initially collected in the context of primary use, but also electronic health data collected for the purpose of the secondary use;

(e) ‘secondary use of electronic health data’ means the compatible further processing of electronic health data for purposes set out in Chapter IV of this Regulation. The data used may include personal electronic health data initially collected in the context of primary use, but also electronic health data collected for the purpose of the secondary use;

Or. en

Amendment 37

Proposal for a regulation

Article 2 – paragraph 2 – point m

Text proposed by the Commission

Amendment

(m) ‘EHR’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system, processed for healthcare purposes;

(m) ‘EHR’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system, processed for the purpose of the provision of healthcare services;

Or. en

Amendment 38

Proposal for a regulation

Article 2 – paragraph 2 – point n

Text proposed by the Commission

Amendment

(n) ‘EHR system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records;

(n) ‘EHR system’ (electronic health record system) means any product (hardware or software) primarily intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records;

Or. en

Amendment 39

Proposal for a regulation

Article 2 – paragraph 2 – point q – introductory part

Text proposed by the Commission

Amendment

(q) ‘serious incident’ means any malfunction or deterioration in the characteristics or performance of an EHR system made available on the market that directly or indirectly leads, might have led or might lead to any of the following:

(q) ‘serious incident’ means any malfunction or deterioration in the characteristics or performance of an EHR system made available on the market that directly or indirectly leads, has led or is likely to lead to any of the following:

Or. en

Amendment 40

Proposal for a regulation

Article 2 – paragraph 2 – point z

Text proposed by the Commission

Amendment

(z) ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use;

(z) ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use pursuant to a data permit or a data request in accordance with this Regulation;

Or. en

Amendment 41

Proposal for a regulation

Article 2 – paragraph 2 – point z a (new)

Text proposed by the Commission

Amendment

(za) ‘data applicant’ means a natural or legal person who has submitted a data access application for access to personal or non-personal electronic health data for secondary use in accordance with this Regulation;

Or. en

Amendment 42

Proposal for a regulation

Article 2 – paragraph 2 – point ae a (new)

Text proposed by the Commission

Amendment

(aea) ‘public sector body’ means national, regional or local authorities of the Member States, and bodies governed by public law of the Member States, or associations formed by one or more such authorities or one or more such bodies and Union institutions, bodies, offices and agencies when carrying out tasks enshrined in their mandate, based on national or Union law.

Or. en

Amendment 43

Proposal for a regulation

Article 2 – paragraph 2 – point ae b (new)

Text proposed by the Commission

Amendment

(aeb) ‘innovation activities’ means the processes and actions taken to generate new or improve products, services, methods, practices and models expected to improve health outcomes, cost efficiency, quality, and reliability;

Or. en

Amendment 44

Proposal for a regulation

Article 3 – paragraph 5 – subparagraph 1 – point b

Text proposed by the Commission

Amendment

(b) establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf.

(b) establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf or to enable guardians to act on behalf of their dependent children.

Or. en

Amendment 45

Proposal for a regulation

Article 3 – paragraph 5 – subparagraph 1 – point b a (new)

Text proposed by the Commission

Amendment

(b a) allow electronic health data access services to interface with electronic health records, products and applications under strict security, confidentiality and consent conditions.

Or. en

Amendment 46

Proposal for a regulation

Article 3 – paragraph 8 – subparagraph 1

Text proposed by the Commission

Amendment

Natural persons shall have the right to give access to or request a data holder from the health or social security sector to transmit their electronic health data to a data recipient of their choice from the health or social security sector, immediately, free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder.

Natural persons shall have the right to give access to or request a controller or a data holder, including from the health or social security sector, to transmit all or part of their electronic health data to a data recipient of their choice from the health or social security sector, immediately, free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder. Where requested by the data subject, the controller, data holders, data recipients and their processors shall comply with the request and shall transmit the data in the format provided for in Article 5.

Or. en

Amendment 47

Proposal for a regulation

Article 3 – paragraph 9

Text proposed by the Commission

Amendment

9. Notwithstanding Article 6(1), point (d), of Regulation (EU) 2016/679, natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. In the event that any part of a natural person´s electronic health record is omitted, notification of such exclusion shall be made in the EHR. Member States shall establish the rules and specific safeguards regarding such restriction mechanisms.

Or. en

Amendment 48

Proposal for a regulation

Article 3 – paragraph 10

Text proposed by the Commission

Amendment

10. Natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. In order to demonstrate compliance with this right, all relevant entities shall maintain a system of automated recording showing who had access to data. The information shall be provided immediately and free of charge through electronic health data access services.

Or. en

Amendment 49

Proposal for a regulation

Article 3 – paragraph 12

Text proposed by the Commission

Amendment

12. The Commission shall, by means of implementing acts, determine the requirements concerning the technical implementation of the rights set out in this Article. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

12. The Commission shall, by means of implementing acts, determine the requirements concerning the technical implementation of the rights set out in this Article, including technical and organisational measures to ensure the process of authentication of the authorised person referred to in point (b) of paragraph 5. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

Or. en

Amendment 50

Proposal for a regulation

Article 4 – paragraph 2

Text proposed by the Commission

Amendment

2. In line with the data minimisation principle provided for in Regulation (EU) 2016/679, Member States may establish rules providing for the categories of personal electronic health data required by different health professions. Such rules shall not be based on the source of electronic health data.

2. In line with the data minimisation principle provided for in Regulation (EU) 2016/679, Member States shall establish rules providing for the categories of personal electronic health data required by different health professions or different healthcare tasks. Such rules shall not be based on the source of electronic health data.

Or. en

Amendment 51

Proposal for a regulation

Article 4 – paragraph 3

Text proposed by the Commission

Amendment

3. Member States shall ensure that access to at least the priority categories of electronic health data referred to in Article 5 is made available to health professionals through health professional access services. Health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services, free of charge.

3. Member States shall ensure that access to at least the priority categories of electronic health data referred to in Article 5 is made available to health professionals through health professional access services, where the processing of health data is necessary. Health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services, free of charge, where the processing of health data is necessary.

Or. en

Amendment 52

Proposal for a regulation

Article 5 – paragraph 1 – subparagraph 1 – point f

Text proposed by the Commission

Amendment

(f) discharge reports.

(f) hospital discharge reports.

Or. en

Amendment 53

Proposal for a regulation

Article 5 – paragraph 1 – subparagraph 1 – point f a (new)

Text proposed by the Commission

Amendment

(f a) International Classification of Diseases (ICD) codes.

Or. en

Amendment 54

Proposal for a regulation

Article 5 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2 a. The Commission shall, by means of implementing acts, lay down rules determining which health information domains and interoperability specifications, including standards, and profiles for representing and exchanging health data shall be included in the European electronic health record exchange format, taking into account the Commission Recommendation (EU) 2019/243 on a European Electronic Health Record exchange format.

Or. en

Amendment 55

Proposal for a regulation

Article 6 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) datasets containing electronic health data and defining structures, such as data fields and data groups for the content representation of clinical content and other parts of the electronic health data;

(a) harmonised datasets containing electronic health data and defining structures, such as minimum data fields and data groups for the content representation of clinical content and other parts of the electronic health data;

Or. en

Amendment 56

Proposal for a regulation

Article 7 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The requirement in the first paragraph of this Article shall not apply to health professionals that qualify as micro enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC for the first two years of the application of this Regulation, in order to avoid a disproportionate administrative burdens of micro enterprises.

Or. en

Amendment 57

Proposal for a regulation

Article 8 – paragraph 1

Text proposed by the Commission

Amendment

Where a Member State accepts the provision of telemedicine services, it shall, under the same conditions, accept the provision of the services of the same type by healthcare providers located in other Member States.

Where a Member State accepts the provision of telemedicine services, it shall facilitate the provision of the services of the same type by healthcare providers located in other Member States.

Or. en

Amendment 58

Proposal for a regulation

Article 10 – paragraph 2 – point m

Text proposed by the Commission

Amendment

(m) cooperate with other relevant entities and bodies at national or Union level, to ensure interoperability, data portability and security of electronic health data, as well as with stakeholders representatives, including patients’ representatives, healthcare providers, health professionals, industry associations;

Or. en

Amendment 59

Proposal for a regulation

Article 10 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. Digital health authorities shall consult relevant data protection authorities on matters of particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data.

Or. en

Amendment 60

Proposal for a regulation

Article 10 – paragraph 5

Text proposed by the Commission

Amendment

5. In the performance of its tasks, the digital health authority shall actively cooperate with stakeholders’ representatives, including patients’ representatives. Members of the digital health authority shall avoid any conflicts of interest.

5. Essential health stakeholders representatives on national level, including patient organisations, and healthcare professionals, shall be present in the governance and decision-making structures of the digital health authority. In the performance of its tasks, the digital health authority shall actively cooperate with stakeholders’ representatives, including patients’ representatives. Members of the digital health authority shall avoid any conflicts of interest. The Commission may adopt guidance on what is likely to constitute a conflict of interests together with the procedure to be followed in such cases.

Or. en

Amendment 61

Proposal for a regulation

Article 10 – paragraph 5 a (new)

Text proposed by the Commission

Amendment

5 a. The Member States shall determine the selection procedure for health stakeholders referred to in paragraph 5.

Or. en

Amendment 62

Proposal for a regulation

Article 11 – paragraph 1

Text proposed by the Commission

Amendment

1. Without prejudice to any other administrative or judicial remedy, natural and legal persons shall have the right to lodge a complaint, individually or, where relevant, collectively, with the digital health authority. Where the complaint concerns the rights of natural persons pursuant to Article 3 of this Regulation, the digital health authority shall inform the supervisory authorities under Regulation (EU) 2016/679.

1. Without prejudice to any other administrative or judicial remedy, natural and legal persons shall have the right to lodge a complaint, individually or, where relevant, collectively, with the digital health authority, where their rights laid down in this Regulation are affected. Where the complaint concerns the rights of natural persons pursuant to Article 3 of this Regulation, the digital health authority shall send a copy of the complaint to the supervisory authorities under Regulation (EU) 2016/679.

Or. en

Amendment 63

Proposal for a regulation

Article 11 a (new)

Text proposed by the Commission

Amendment

Article 11a

Right to an effective remedy against a digital health authority

1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a digital health authority concerning them.

2. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy where the digital health authority which is competent pursuant to Article 10 does not handle a complaint or does not inform the natural or legal person within three months on the progress or outcome of the complaint lodged pursuant to Article 11.

3. Proceedings against a digital health authority shall be brought before the courts of the Member States where the digital health authority is established.

Or. en

Amendment 64

Proposal for a regulation

Article 12 – paragraph 4

Text proposed by the Commission

Amendment

4. The Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

Or. en

Amendment 65

Proposal for a regulation

Article 12 – paragraph 8

Text proposed by the Commission

Amendment

8. The Commission shall, by means of implementing acts, allocate responsibilities among controllers and as regards the processor referred to in paragraph 7 of this Article, in accordance with Chapter IV of Regulation (EU) 2016/679. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

8. The Commission shall, by means of implementing acts, allocate responsibilities among controllers and as regards the processor referred to in paragraph 7 of this Article, in accordance with Chapter IV of Regulation (EU) 2016/679 and of Regulation (EU) 2018/1725. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

Or. en

Amendment 66

Proposal for a regulation

Article 13 – paragraph 3 – subparagraph 1

Text proposed by the Commission

Amendment

Member States and the Commission shall seek to ensure interoperability of MyHealth@EU with technological systems established at international level for the exchange of electronic health data. The Commission may adopt an implementing act establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of MyHealth@EU for the purposes of the electronic health data exchange. Before adopting such an implementing act, a compliance check of the national contact point of the third country or of the system established at an international level shall be performed under the control of the Commission.

Or. en

Amendment 67

Proposal for a regulation

Article 16 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the user with regard to its intended purpose, interoperability and security by:

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the professional user as defined under Regulation (EU) 2018/1807 with regard to its intended purpose, interoperability and security by:

Or. en

Amendment 68

Proposal for a regulation

Article 16 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) failing to inform the user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

(b) failing to inform the professional user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

Or. en

Amendment 69

Proposal for a regulation

Article 16 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

If any economic operator, other than the manufacturer, makes modifications to the EHR system while deploying or using it, which lead to changes in the intended purpose and deployments recommendations for the EHR system as declared by the manufacturer, the economic operator shall assume the responsibilities of a manufacturer under this Regulation for the EHR system’s compliance with this Regulation. In case of any malfunctioning or deterioration in performance quality due to the changes made by the economic operator during deployment or use of the EHR system contrary to the manufacturer's recommendations for technical deployment of the system or purpose of its use, full responsibility for those modifications lays with the economic operator.

Or. en

Amendment 70

Proposal for a regulation

Article 23 – paragraph 1 – subparagraph 1

Text proposed by the Commission

Amendment

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a common template document and a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

Or. en

Amendment 71

Proposal for a regulation

Article 23 – paragraph 1 – subparagraph 2

Text proposed by the Commission

Amendment

Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2) after consultation with the EHDS Board.

Or. en

Amendment 72

Proposal for a regulation

Article 29 – paragraph 1

Text proposed by the Commission

Amendment

1. Where a market surveillance authority finds that an EHR system presents a risk to the health or safety of natural persons or to other aspects of public interest protection, it shall require the manufacturer of the EHR system concerned, its authorised representative and all other relevant economic operators to take all appropriate measures to ensure that the EHR system concerned no longer presents that risk when placed on the market to withdraw the EHR system from the market or to recall it within a reasonable period.

1. Where a market surveillance authority finds that an EHR system presents a risk to the health or safety of natural persons, to the protection of personal data or to other aspects of public interest protection, it shall require the manufacturer of the EHR system concerned, its authorised representative and all other relevant economic operators to take all appropriate measures to ensure that the EHR system concerned no longer presents that risk when placed on the market to withdraw the EHR system from the market or to recall it within a reasonable period.

Or. en

Amendment 73

Proposal for a regulation

Article 31 – paragraph 6

Text proposed by the Commission

Amendment

6. If the wellness application is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label.

6. If the wellness application is an integral part of a device or embedded in a device after its putting into service, the accompanying label shall be shown in the application itself or placed on the device. 2D barcodes may also be used to display the label.

Or. en

Amendment 74

Proposal for a regulation

Article 31 – paragraph 9

Text proposed by the Commission

Amendment

9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form or, upon request, in physical form.

9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form.

Or. en

Amendment 75

Proposal for a regulation

Article 33 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) EHRs;

(a) electronic health data from EHRs, including the categories in Article 5 of this Regulation;

Or. en

Amendment 76

Proposal for a regulation

Article 33 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) data impacting on health, including social, environmental behavioural determinants of health;

(b) data on factors impacting on health, including social, environmental behavioural determinants of health;

Or. en

Amendment 77

Proposal for a regulation

Article 33 – paragraph 1 – point d

Text proposed by the Commission

Amendment

(d) health-related administrative data, including claims and reimbursement data;

(d) health care-related administrative data, including claims and reimbursement data;

Or. en

Amendment 78

Proposal for a regulation

Article 33 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) person generated electronic health data, including medical devices, wellness applications or other digital health applications;

(f) automatically generated electronic health data, including wellness applications or other digital health applications;

Or. en

Amendment 79

Proposal for a regulation

Article 33 – paragraph 1 – point g

Text proposed by the Commission

Amendment

(g) identification data related to health professionals involved in the treatment of a natural person;

(g) identification data related to health professionals involved in the treatment of a natural person or in research;

Or. en

Amendment 80

Proposal for a regulation

Article 33 – paragraph 1 – point j

Text proposed by the Commission

Amendment

(j) electronic health data from clinical trials;

(j) electronic health data from fully completed clinical trials and in accordance with Regulation (EU) No 536/2014;

Or. en

Amendment 81

Proposal for a regulation

Article 33 – paragraph 1 – point l

Text proposed by the Commission

Amendment

(l) research cohorts, questionnaires and surveys related to health;

(l) data from research cohorts, questionnaires and surveys related to health;

Or. en

Amendment 82

Proposal for a regulation

Article 33 – paragraph 1 – point n

Text proposed by the Commission

Amendment

(n) electronic data related to insurance status, professional status, education, lifestyle, wellness and behaviour data relevant to health;

(n) electronic data related to insurance status, professional status, education, wellness and modifiable behavioural risk factors relevant to health;

Or. en

Amendment 83

Proposal for a regulation

Article 33 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3 a. Data referred to in paragraph 1(j) of this Article should be made available in the format outline in Annex IV in Regulation No 536/2014 or, if requested by the public sector body, as defined in the Data Act Art 15 (a) or (b).

Or. en

Amendment 84

Proposal for a regulation

Article 33 – paragraph 5

Text proposed by the Commission

Amendment

5. Where the consent of the natural person is required by national law, health data access bodies shall rely on the obligations laid down in this Chapter to provide access to electronic health data.

5. Natural persons that are subjects to secondary use of health data shall have the right to decline the processing of their health data. Health data access bodies shall provide for an accessible and easily understandable opt-out mechanism, whereby natural persons must be offered the possibility to explicitly express their wish not to have all or part of their personal electronic health data processed for some or all secondary use purposes. In situation where natural persons explicitly express their wish to use opt-out mechanism to data holders, data holders shall direct natural persons to the health data access bodies.

Or. en

Justification

The possibility to opt-out of processing for secondary use should be provided to preserve the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of data subjects (Art. 9(2) GDPR). The issue is also one of trust between the patient and the HC provider: patients may no longer wish to share their health data with HC providers if the data are then automatically passed on for secondary use.

Amendment 85

Proposal for a regulation

Article 34 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. Health data access bodies shall only provide access to electronic health data referred to in Article 33 where the intended purpose of processing pursued by the applicant complies with:

1. Health data access bodies shall only provide access to electronic health data referred to in Article 33 to a health data user where the processing of the data by the applicant is necessary for one of the following purposes, and in accordance with Article 6(1)(c) and Article 9(2)(g), (h), (i) and (j) of Regulation (EU) 2016/679:

Or. en

Amendment 86

Proposal for a regulation

Article 34 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) activities for reasons of public interest in the area of public and occupational health, such as protection against serious cross-border threats to health, public health surveillance or ensuring high levels of quality and safety of healthcare and of medicinal products or medical devices;

(a) activities for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health, public health surveillance or ensuring high levels of quality and safety of healthcare and of medicinal products or medical devices;

Or. en

Amendment 87

Proposal for a regulation

Article 34 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) to produce national, multi-national and Union level official statistics as defined in Regulation (EU) 223/2009 related to health or care sectors;

Or. en

Amendment 88

Proposal for a regulation

Article 34 – paragraph 1 – point d

Text proposed by the Commission

Amendment

(d) education or teaching activities in health or care sectors;

(d) university and post-university teaching activities in health or care sectors;

Or. en

Amendment 89

Proposal for a regulation

Article 34 – paragraph 1 – point e

Text proposed by the Commission

Amendment

(e) scientific research related to health or care sectors;

(e) scientific research related to health or care sectors and relevant purposes, contributing to public health or social security, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices, with the aim to benefit the end-users of the activity, including:

Or. en

Amendment 90

Proposal for a regulation

Article 34 – paragraph 1 – point e – point i (new)

Text proposed by the Commission

Amendment

i) development and innovation activities for products or services;

Or. en

Amendment 91

Proposal for a regulation

Article 34 – paragraph 1 – point e – point ii (new)

Text proposed by the Commission

Amendment

ii) training, testing and evaluating of algorithms, including in medical devices, AI systems and digital health applications;

Or. en

Amendment 92

Proposal for a regulation

Article 34 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) development and innovation activities for products or services contributing to public health or social security, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices;

deleted

Or. en

Justification

Included in point e - point i

Amendment 93

Proposal for a regulation

Article 34 – paragraph 1 – point g

Text proposed by the Commission

Amendment

(g) training, testing and evaluating of algorithms, including in medical devices, AI systems and digital health applications, contributing to the public health or social security, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices;

deleted

Or. en

Justification

Included in point e- point ii

Amendment 94

Proposal for a regulation

Article 34 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2 a. Where data subjects wish to generally or partially opt-out of having their personal electronic health data processed for secondary use, in accordance with Article 33(5), for any of the purposes listed in paragraph 1, they shall indicate so to the health data access body.

Or. en

Amendment 95

Proposal for a regulation

Article 35 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) taking decisions detrimental to a natural person based on their electronic health data; in order to qualify as “decisions”, they must produce legal effects or similarly significantly affect those natural persons;

(a) taking decisions detrimental to a natural person based on their electronic health data, including but not limited to offers of employment, offering less favourable terms in the provision of goods or services such as insurance or other financial services; in order to qualify as “decisions”, they must produce legal effects or similarly significantly affect those natural persons;

Or. en

Amendment 96

Proposal for a regulation

Article 35 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) taking decisions in relation to a natural person or groups of natural persons to exclude them from the benefit of an insurance contract or to modify their contributions and insurance premiums;

(b) taking decisions in relation to a natural person or groups of natural persons to exclude them from the benefit of an insurance or credit contract or to modify their contributions and insurance premiums or durations of loans;

Or. en

Amendment 97

Proposal for a regulation

Article 36 – paragraph 2

Text proposed by the Commission

Amendment

2. Member States shall ensure that each health data access body is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and the exercise of its powers.

Or. en

Amendment 98

Proposal for a regulation

Article 36 – paragraph 3

Text proposed by the Commission

Amendment

3. In the performance of their tasks, health data access bodies shall actively cooperate with stakeholders’ representatives, especially with representatives of patients, data holders and data users. Staff of health data access bodies shall avoid any conflicts of interest. Health data access bodies shall not be bound by any instructions, when making their decisions.

3. Member States shall ensure that essential health stakeholders’ representatives, including patient organisations and healthcare professional shall be present in the governance and decision-making structures of the health data access bodies. In the performance of their tasks, health data access bodies shall actively cooperate with stakeholders’ representatives, especially with representatives of patients, data altruism organisation active in the area of health, data holders and data users. Staff of health data access bodies shall avoid any conflicts of interest. Health data access bodies shall not be bound by any instructions, when making their decisions.

Or. en

Amendment 99

Proposal for a regulation

Article 36 – paragraph 4 a (new)

Text proposed by the Commission

Amendment

4 a. Member States shall determine the selection procedure for health stakeholders referred to in paragraph 3.

Or. en

Amendment 100

Proposal for a regulation

Article 37 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) support Union institutions, bodies, offices and agencies in carrying out tasks enshrined in the mandate of Union institutions, bodies, offices and agencies, based on national or Union law;

deleted

Or. en

Justification

Text simplification, see horizontal amendment introducing a definition of 'public sector body', which includes Union institutions, bodies, offices and agencies.

Amendment 101

Proposal for a regulation

Article 37 – paragraph 1 – point j

Text proposed by the Commission

Amendment

(j) cooperate with and supervise data holders to ensure the consistent and accurate implementation of the data quality and utility label set out in Article 56;

(j) cooperate with and supervise data holders, assist them in order to ensure respect of the data subjects’ right to opt-out as referred to in Article 33(5) and ensure the consistent and accurate implementation of the data quality and utility label set out in Article 56;

Or. en

Amendment 102

Proposal for a regulation

Article 37 – paragraph 4 – subparagraph 1 a (new)

Text proposed by the Commission

Amendment

The Commission shall adopt guidelines on the functioning of the health data access bodies to ensure coherent processes among them.

Or. en

Amendment 103

Proposal for a regulation

Article 38 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the applicable rights of natural persons in relation to secondary use of electronic health data, in particular the right to opt-out pursuant to Article 33(5), including detailed information on how to exercise them;

Or. en

Amendment 104

Proposal for a regulation

Article 38 – paragraph 1 – point d a (new)

Text proposed by the Commission

Amendment

(d a) the identity and the contact details of the health data access body and, where applicable, other information required pursuant to Article 13(1)(a) of Regulation (EU) 2016/679.

Or. en

Amendment 105

Proposal for a regulation

Article 38 – paragraph 1 – point e a (new)

Text proposed by the Commission

Amendment

(e a) the record on who has been granted access to which sets of electronic health data and a justification regarding the purposes for processing them as referred to in Article 34(1), Union and national law.

Or. en

Amendment 106

Proposal for a regulation

Article 38 – paragraph 2

Text proposed by the Commission

Amendment

2. Health data access bodies shall not be obliged to provide the specific information under Article 14 of Regulation (EU) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to Article 46.

2. For the purpose of Article 14 of Regulation (EU) 2016/679, where the health data access body requests and processes personal electronic health data from a data holder, if the provision of information by the body, in its capacity as a controller, to each natural person concerned proves impossible or would involve a disproportionate effort in accordance with to Article 14(5)(b) of the same Regulation, the health data access body shall take appropriate measures and at the minimum make the information provided in Article 14(1) and (2) of Regulation (EU) 2016/679 publicly available.

Or. en

Justification

Alignment to Article 14 GDPR.

Amendment 107

Proposal for a regulation

Article 38 – paragraph 3

Text proposed by the Commission

Amendment

3. Where a health data access body is informed by a data user of a finding that may impact on the health of a natural person, the health data access body may inform the natural person and his or her treating health professional about that finding.

3. Where a health data access body is informed by a data user of a finding that may gravely impact on the health of a natural person, the health data access body shall inform the natural person and his or her treating health professional about that finding.

Or. en

Amendment 108

Proposal for a regulation

Article 38 – paragraph 4

Text proposed by the Commission

Amendment

4. Member States shall regularly inform the public at large about the role and benefits of health data access bodies.

4. Member States shall regularly inform the public at large about the role, risks and benefits of the secondary use of health data and the role of health data access bodies.

Or. en

Amendment 109

Proposal for a regulation

Article 38 a (new)

Text proposed by the Commission

Amendment

Article 38 a

Right to lodge a complaint with a health data access body

1. Without prejudice to any other administrative or judicial remedy, natural and legal persons shall have the right to lodge a complaint, individually or, where relevant, collectively, with the health data access body, where their rights laid down in this Regulation are affected. Where the complaint concerns the rights of natural persons pursuant to Article 38(1)(d) of this Regulation, the health data access body shall inform send a copy of the complaint to the supervisory authorities under Regulation (EU) 2016/679.

2. The health data access body with which the complaint has been lodged shall inform the complainant of the progress of the proceedings and of the decision taken.

3. Health data access body shall cooperate to handle and resolve complaints, including by exchanging all relevant information by electronic means, without undue delay.

Or. en

Amendment 110

Proposal for a regulation

Article 38 b (new)

Text proposed by the Commission

Amendment

Article 38 b

Right to an effective remedy against a health data access body

2. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy where the health data access body which is competent pursuant to Article 37 does not handle a complaint or does not inform the natural or legal person within three months on the progress or outcome of the complaint lodged pursuant to Article 38a.

3. Proceedings against a health data access body shall be brought before the courts of the Member States where the health data access body is established.

Or. en

Amendment 111

Proposal for a regulation

Article 39 – paragraph 1 – subparagraph 1 a (new)

Text proposed by the Commission

Amendment

Information on clinical trials shall not be included in the report until the clinical trials have been fully completed.

Or. en

Amendment 112

Proposal for a regulation

Article 42 – paragraph 1

Text proposed by the Commission

Amendment

1. Health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. Any fees shall include and be derived from the costs related to conducting the procedure for requests, including for assessing a data application or a data request, granting, refusing or amending a data permit pursuant to Articles 45 and 46 or providing an answer to a data request pursuant to Article 47, in accordance with Article 6 of Regulation […] [Data Governance Act COM/2020/767 final]

1. Health data access bodies may charge fees for making electronic health data available for secondary use. Any fees shall include and be derived from the costs related to conducting the procedure for requests, including for assessing a data application or a data request, granting, refusing or amending a data permit pursuant to Articles 45 and 46 or providing an answer to a data request pursuant to Article 47, in accordance with Article 6 of Regulation […] [Data Governance Act COM/2020/767 final, as well as the technical and operational costs to prepare the data sets, including annonymization and pseudonymization, and to make them available.

Or. en

Justification

consequence of the proposed deletion of Article 49

Amendment 113

Proposal for a regulation

Article 42 – paragraph 4

Text proposed by the Commission

Amendment

4. Any fees charged to data users pursuant to this Article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use, objectively justified and shall not restrict competition. The support received by the data holder from donations, public national or Union funds, to set up, develop or update tat dataset shall be excluded from this calculation. The specific interests and needs of SMEs, public bodies, Union institutions, bodies, offices and agencies involved in research, health policy or analysis, educational institutions and healthcare providers shall be taken into account when setting the fees, by reducing those fees proportionately to their size or budget.

Or. en

Amendment 114

Proposal for a regulation

Article 43 – paragraph 4

Text proposed by the Commission

Amendment

4. Health data access bodies shall have the power to revoke the data permit issued pursuant to Article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3, immediately or within a reasonable time limit, and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. In this regard, the health data access bodies shall be able, where appropriate, to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years.

4. Notwithstanding the right for Member States to impose penalties in accordance with Article 69, health data access bodies shall have the power to revoke the data permit issued pursuant to Article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3, immediately or within a reasonable time limit, and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. In this regard, the health data access bodies shall be able, where appropriate, to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years.

Or. en

Amendment 115

Proposal for a regulation

Article 43 – paragraph 5

Text proposed by the Commission

Amendment

5. Where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data, or do not respect the deadlines set out in Article 41, the health data access body shall have the power to fine the data holder with fines for each day of delay, which shall be transparent and proportionate. The amount of the fines shall be established by the health data access body. In case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body, that body can exclude the data holder from participation in the EHDS for a period of up to 5 years. Where a data holder has been excluded from the participation in the EHDS pursuant to this Article, following manifest intention of obstructing the secondary use of electronic health data, it shall not have the right to provide access to health data in accordance with Article 49.

Or. en

Justification

Consequence of the proposed deletion of Article 49

Amendment 116

Proposal for a regulation

Article 44 – paragraph 1

Text proposed by the Commission

Amendment

1. The health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.

1. The health data access body shall ensure that access is only provided to requested electronic health data necessary and relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.

Or. en

Amendment 117

Proposal for a regulation

Article 44 – paragraph 3

Text proposed by the Commission

Amendment

3. Where the purpose of the data user’s processing cannot be achieved with anonymised data, taking into account the information provided by the data user, the health data access bodies shall provide access to electronic health data in pseudonymised format. The information necessary to reverse the pseudonymisation shall be available only to the health data access body. Data users shall not re-identify the electronic health data provided to them in pseudonymised format. The data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.

3. Where the purpose of the data user’s processing cannot be achieved with anonymised data, taking into account the information provided by the data user, the health data access bodies shall provide access to electronic health data in pseudonymised format. The information required to reverse the pseudonymisation shall be available only to the health data access body. Data users shall not re-identify the electronic health data provided to them in pseudonymised format.

Or. en

Amendment 118

Proposal for a regulation

Article 44 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3 a. The data user’s failure to respect the health data access body’s measures ensuring anonymisation and pseudonymisation shall be subject to appropriate penalties.

Or. en

Amendment 119

Proposal for a regulation

Article 45 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) a detailed explanation of the intended use of the electronic health data, including for which of the purposes referred to in Article 34(1) access is sought;

(a) a detailed explanation of the intended use of the electronic health data, including for which of the purposes referred to in Article 9(2) of Regulation (EU) 2016/679, combined with Article 34(1), access is sought;

Or. en

Amendment 120

Proposal for a regulation

Article 45 – paragraph 2 – point f

Text proposed by the Commission

Amendment

(f) a description of the safeguards planned to protect the rights and interests of the data holder and of the natural persons concerned;

(f) a description of the safeguards planned to protect the rights and interests of the data holder and of the natural persons concerned and to ensure a level of protection appropriate to the risk;

Or. en

Amendment 121

Proposal for a regulation

Article 45 – paragraph 2 – point f a (new)

Text proposed by the Commission

Amendment

(f a) a description of how the data applicant is qualified vis-à-vis the intended purposes of data use, such as professional qualifications to demonstrate appropriate expertise;

Or. en

Amendment 122

Proposal for a regulation

Article 45 – paragraph 2 – point f b (new)

Text proposed by the Commission

Amendment

(fb) In case of data provision at the reduced fee, proof that the data applicant has sufficient human resources, infrastructure and capital to complete the research and/or product development for which electronic health data is requested and that the use of the electronic health data will comply with provisions under this Regulation and the Data Act;

Or. en

Amendment 123

Proposal for a regulation

Article 45 – paragraph 2 – point h a (new)

Text proposed by the Commission

Amendment

(ha) a plan defining audiences and tools to publicly inform on the results or outcomes of the access to the data in accordance with Article 46(11).

Or. en

Amendment 124

Proposal for a regulation

Article 46 – paragraph 1

Text proposed by the Commission

Amendment

1. Health data access bodies shall assess if the application fulfils one of the purposes listed in Article 34(1) of this Regulation, if the requested data is necessary for the purpose listed in the application and if the requirements in this Chapter are fulfilled by the applicant. If that is the case, the health data access body shall issue a data permit.

1. Health data access bodies shall assess if the application fulfils one of the purposes listed in Article 34(1) of this Regulation, if the requested data is necessary and relevant for the purpose listed in the application and if the requirements in this Chapter are fulfilled by the applicant. If that is the case, the health data access body shall issue a data permit.

Or. en

Amendment 125

Proposal for a regulation

Article 46 – paragraph 2

Text proposed by the Commission

Amendment

2. Health data access bodies shall refuse all applications including one or more purposes listed in Article 35 or where requirements in this Chapter are not met.

2. Health data access bodies shall refuse all applications including one or more purposes listed in Article 35, applications where the necessity of processing for the intended purpose has not been sufficiently demonstrated, applications that do not sufficiently provide safeguards on re-identification and applications where requirements in this Chapter are not met. The data authorisation shall not be granted for personal electronic health data where the data subject opted-out to the processing thereof pursuant to Article 33(5).

Or. en

Amendment 126

Proposal for a regulation

Article 46 – paragraph 3

Text proposed by the Commission

Amendment

3. A health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. By way of derogation from that Regulation […] [Data Governance Act COM/2020/767 final], the health data access body may extend the period for responding to a data access application by 2 additional months where necessary, taking into account the complexity of the request. In such cases, the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application, together with the reasons for the delay. Where a health data access body fails to provide a decision within the time limit, the data permit shall be issued.

Or. en

Justification

This provision would in practice void the core of the regulation. It would entail a fiction of a data authorization, at the expense of the fundamental rights of the data subjects and would not allow for controlling essential elements of the request, including the necessity and relevance of the data for the processing purpose pursued. In particular, applicants could benefit from the licensing fiction making unlawful or unlawful applications.

Amendment 127

Proposal for a regulation

Article 46 – paragraph 4

Text proposed by the Commission

Amendment

4. Following the issuance of the data permit, the health data access body shall immediately request the electronic health data from the data holder. The health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders, unless the health data access body specifies that it will provide the data within a longer specified timeframe.

Or. en

Amendment 128

Proposal for a regulation

Article 49

Text proposed by the Commission

Amendment

Article 49

deleted

Access to electronic health data from a single data holder

1. Where an applicant requests access to electronic health data only from a single data holder in a single Member State, by way of derogation from Article 45(1), that applicant may file a data access application or a data request directly to the data holder. The data access application shall comply with the requirements set out in Article 45 and the data request shall comply with requirements in Article 47. Multi-country requests and requests requiring a combination of datasets from several data holders shall be adressed to health data access bodies.

2. In such case, the data holder may issue a data permit in accordance with Article 46 or provide an answer to a data request in accordance with Article 47. The data holder shall then provide access to the electronic health data in a secure processing environment in compliance with Article 50 and may charge fees in accordance with Article 42.

3. By way of derogation from Article 51, the single data provider and the data user shall be deemed joint controllers.

4. Within 3 months the data holder shall inform the relevant health data access body by electronic means of all data access applications filed and all the data permits issued and the data requests fulfilled under this Article in order to enable the health data access body to fulfil its obligations under Article 37(1) and Article 39.

Or. en

Justification

Without the involvement and oversight by a health data access body, there is an important risk that the rights of the data subjects and safeguards contained in this Regulation might not be upheld.

Amendment 129

Proposal for a regulation

Article 50 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. The health data access bodies shall provide access to electronic health data only through a secure processing environment, with technical and organisational measures and security and interoperability requirements. In particular, they shall take the following security measures:

1. The health data access bodies shall provide access to electronic health data pursuant to a data permit only through a secure processing environment, with technical and organisational measures and security and interoperability requirements. In particular, they shall take the following security measures:

Or. en

Amendment 130

Proposal for a regulation

Article 50 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) minimise the risk of the unauthorised reading, copying, modification or removal of electronic health data hosted in the secure processing environment through state-of-the-art technological means;

(b) minimise the risk of the unauthorised reading, copying, modification or removal of electronic health data hosted in the secure processing environment through state-of-the-art technological and organisational means;

Or. en

Amendment 131

Proposal for a regulation

Article 50 – paragraph 2

Text proposed by the Commission

Amendment

2. The health data access bodies shall ensure that electronic health data can be uploaded by data holders and can be accessed by the data user in a secure processing environment. The data users shall only be able to download non-personal electronic health data from the secure processing environment.

2. The health data access bodies shall ensure that electronic health data from data holders in the format determined by the data permit can be uploaded by data holders and can be accessed by the data user in a secure processing environment. The data users shall only be able to download non-personal electronic health data from the secure processing environment.

Or. en

Amendment 132

Proposal for a regulation

Article 51 – title

Text proposed by the Commission

Amendment

Joint controllers

Controllership

Or. en

Amendment 133

Proposal for a regulation

Article 51 – paragraph 1

Text proposed by the Commission

Amendment

1. The health data access bodies and the data users, including Union institutions, bodies, offices and agencies, shall be deemed joint controllers of electronic health data processed in accordance with data permit.

1. The data holder shall be deemed controller for the disclosure of the requested personal electronic health data to the health data access body pursuant to Article 33(1) of this Regulation. The health data access body shall be deemed controller for the processing of the personal electronic health data when fulfilling its tasks pursuant to Article 37(1)(d) of this Regulation. The data user shall be deemed controller for the processing of personal electronic health data in pseudonymised form in the secure processing environment pursuant to the data permit. The health data access body shall act as a processor for the health data user´s processing pursuant to a data permit in the secure processing environment.

Or. en

Amendment 134

Proposal for a regulation

Article 51 – paragraph 2

Text proposed by the Commission

Amendment

2. The Commission shall, by means of implementing acts, establish a template for the joint controllers’ arrangement. Those implementing acts shall be adopted in accordance with the advisory procedure set out in Article 68(2).

2. The Commission shall, by means of implementing acts, establish a template for the controllers’ arrangement that meets the requirements laid down in Article 28(3) of Regulation (EU) 2016/679. Those implementing acts shall be adopted in accordance with the advisory procedure set out in Article 68(2).

Or. en

Amendment 135

Proposal for a regulation

Article 52 – paragraph 4

Text proposed by the Commission

Amendment

4. Health-related research infrastructures or similar structures whose functioning is based on Union law and which support the use of electronic health data for research, policy making, statistical, patient safety or regulatory purposes shall be authorised participants of HealthData@EU.

4. Health-related research infrastructures, including private legal entities, or similar structures whose functioning is based on Union law and which support the use of electronic health data for research, policy making, statistical, patient safety or regulatory purposes shall be authorised participants of HealthData@EU.

Or. en

Amendment 136

Proposal for a regulation

Article 52 – paragraph 5

Text proposed by the Commission

Amendment

5. Third countries or international organisations may become authorised participants where they comply with the rules of Chapter IV of this Regulation and provide access to data users located in the Union, on equivalent terms and conditions, to the electronic health data available to their health data access bodies. The Commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of HealthData@EU for the purposes of secondary use of health data, is compliant with the Chapter IV of this Regulation and provides access to data users located in the Union to the electronic health data it has access to on equivalent terms and conditions. The compliance with these legal, organisational, technical and security requirements, including with the standards for secure processing environments pursuant to Article 50 shall be checked under the control of the Commission. These implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68 (2). The Commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available.

5. Third countries or international organisations may become authorised participants where they comply with the rules of Chapter IV of this Regulation, the transfer stemming from such connection complies with the rules in Chapter V of Regulation (EU) 2016/679 and provide access to data users located in the Union, on equivalent terms and conditions, to the electronic health data available to their health data access bodies. The Commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of HealthData@EU for the purposes of secondary use of health data, is compliant with the Chapter IV of this Regulation and Chapter V of Regulation (EU) 2016/679 and provides access to data users located in the Union to the electronic health data it has access to on equivalent terms and conditions. The compliance with these legal, organisational, technical and security requirements, including with the standards for secure processing environments pursuant to Article 50 shall be checked under the control of the Commission. These implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68 (2). The Commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available.

Or. en

Amendment 137

Proposal for a regulation

Article 56 – paragraph 3 – introductory part

Text proposed by the Commission

Amendment

3. The data quality and utility label shall comply with the following elements:

3. The data quality and utility label shall cover the following elements:

Or. en

Amendment 138

Proposal for a regulation

Article 60 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. Public procurers, national competent authorities, including digital health authorities and health data access bodies, and the Commission shall require, as a condition to procure or fund services provided by controllers and processors established in the Union processing personal electronic health data, that such controllers and processors:

(a) will store this data in the Union, in accordance with Article 60a of this Chapter, and

(b) have duly demonstrated that they are not subject to third country legislation conflicting with Union data protection rules.

Or. en

Justification

The EDPB and EDPS consider in their Joint Opinion that the recommendations regarding data storage in the EU and compliance with Chapter V GDPR and in particular Article 48 GDPR would be best operationalised if they were embedded at an early stage when procuring or funding services provided by controllers and processors established in the EU processing personal electronic health data.

Amendment 139

Proposal for a regulation

Article 60 a (new)

Text proposed by the Commission

Amendment

Article 60a

Storage of electronic health data

For the purposes of primary and secondary use of electronic health data, Member States shall ensure that the storage, processing and analysis of electronic health data shall be carried out exclusively within a secure location or locations within the territory of the Union, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V of Regulation (EU) 2016/679.

Or. en

Justification

See the EDPB/EDPS Joint Opinion, citing the storage location requirement as set out in CJEU joined Cases C-293/12 and C-594/12 of 8 April 2014, Digital Rights Ireland Ltd, paras 68-69, and joined Cases C-203/15 and C-698/15 of 21 December 2016, Tele2 Sverige AB, para 122, which should apply a fortiori to electronic health data. See as well the data storage requirement laid down in Article 6(8) of Directive (EU) 2016/681 (EU PNR Directive).

Amendment 140

Proposal for a regulation

Article 63 – paragraph 1

Text proposed by the Commission

Amendment

In the context of international access and transfer of personal electronic health data, Member States may maintain or introduce further conditions, including limitations, in accordance with and under the conditions of article 9(4) of the Regulation (EU) 2016/679.

International access and transfer of personal electronic health data shall be granted in accordance with Chapter V of Regulation (EU) 2016/679. Member States may maintain or introduce further conditions, including limitations, in accordance with and under the conditions of article 9(4) of the Regulation (EU) 2016/679.

Or. en

Amendment 141

Proposal for a regulation

Article 63 a (new)

Text proposed by the Commission

Amendment

Article 63a

Access restrictions

1. Access to electronic health data for entities from third countries, for secondary use purposes, shall be possible only if the third country where an entity is established, allows access to health data of its residents for entities from the European Union.

2. The Commission may decide, by issuing a delegated act, with effect for the entire Union, that a third country allows a secondary use of electronic health data of its residents for entities from the European Union.

3. Making of electronic health data available to a third country entity may take place only where the Commission has decided that the third country allows for such use.

4. The Commission shall monitor such decisions, and shall provide for a periodic review mechanism of their functioning.

5. The Commission may recognise that a third country no longer ensures the access and shall revoke its decision.

Or. en

Amendment 142

Proposal for a regulation

Article 64 – paragraph 1

Text proposed by the Commission

Amendment

1. A European Health Data Space Board (EHDS Board) is hereby established to facilitate cooperation and the exchange of information among Member States. The EHDS Board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the Member States. Other national authorities, including market surveillance authorities referred to in Article 28, European Data Protection Board and European Data Protection Supervisor may be invited to the meetings, where the issues discussed are of relevance for them. The Board may also invite experts and observers to attend its meetings, and may cooperate with other external experts as appropriate. Other Union institutions, bodies, offices and agencies, research infrastructures and other similar structures shall have an observer role.

1. European Health Data Space Board (EHDS Board) is hereby established to facilitate cooperation and the exchange of information among Member States. The EHDS Board shall be composed of:

a) one high level representative of digital health authorities and one high level representative of health data access bodies appointed by each Member State;

b) one representative of the European Data Protection Board (EDPB) and one representative of the European Data Protection Supervisor (EDPS);

c) one representative of European Medicines Agency (EMA);

d) one representative of the European Centre for Disease Prevention and Control (ECDC);

e) one member and one alternate member appointed by the Commission, on the basis of a public call for expressions of interest, after consulting the European Parliament, in order to represent healthcare professionals;

f) one member and one alternate member appointed by the Commission, on the basis of a public call for expressions of interest, after consulting the European Parliament, in order to represent patient organisation;

g) one member and one alternate member appointed by the Commission, on the basis of a public call for expressions of interest, after consulting the European Parliament, in order to represent health industry;

Or. en

Amendment 143

Proposal for a regulation

Article 64 – paragraph 4

Text proposed by the Commission

Amendment

4. Stakeholders and relevant third parties, including patients’ representatives, shall be invited to attend meetings of the EHDS Board and to participate in its work, depending on the topics discussed and their degree of sensitivity.

4. The EHDS Board may also invite representatives of other relevant Union institutions, bodies, offices and agencies. Moreover, it may invite other health stakeholders and relevant third parties to attend meetings and to participate in its work, depending on the topics discussed and their degree of sensitivity. The EHDS Board may also invite, in accordance with its rules of procedure, any other person whose opinion may be of interest to attend its meetings as an observer.

Or. en

Amendment 144

Proposal for a regulation

Article 64 – paragraph 6 a (new)

Text proposed by the Commission

Amendment

6 a. The chair of the EHDS Board shall also invite an expert of the European Parliament to attend the meetings of the EHDS Board.

Or. en

Amendment 145

Proposal for a regulation

Article 65 – paragraph 1 – point a a (new)

Text proposed by the Commission

Amendment

(aa) The EHDS Board shall publish an annual report to include the implementation status of the European Health Data Space and other relevant points of development, including in respect to cross-border health data interoperability, and arising implementation challenges.

Or. en

Amendment 146

Proposal for a regulation

Article 65 – paragraph 1 – point b a (new)

Text proposed by the Commission

Amendment

(ba) to conduct an oversight of the implementation and enforcement of Chapter II of this Regulation for which digital health authorities are responsible;

Or. en

Amendment 147

Proposal for a regulation

Article 65 – paragraph 1 – point b b (new)

Text proposed by the Commission

Amendment

(bb) to provide guidance and recommendations to digital health authorities;

Or. en

Amendment 148

Proposal for a regulation

Article 65 – paragraph 1 – point e

Text proposed by the Commission

Amendment

(e) to facilitate the exchange of views on the primary use of electronic health data with the relevant stakeholders, including representatives of patients, health professionals, researchers, regulators and policy makers in the health sector.

(e) to facilitate the exchange of views on the primary use of electronic health data with the relevant stakeholders, including representatives of patients, health professionals, industry, researchers, regulators and policy makers in the health sector.

Or. en

Amendment 149

Proposal for a regulation

Article 65 – paragraph 1 – point e a (new)

Text proposed by the Commission

Amendment

(ea) to advise the Commission and Member States on matters relevant for the implementation and development of the European Health Data Space, including cross-border interoperability of health data, and potential mechanisms of funding support to ensure equal development of health data systems across Europe in respect to the primary use of electronic health data;

Or. en

Amendment 150

Proposal for a regulation

Article 65 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The EHDS Board shall publish an annual report on the implementation status of the European Health Data Space and other relevant points of development, including with respect to cross-border health data interoperability, and arising implementation challenges.

Or. en

Amendment 151

Proposal for a regulation

Article 65 – paragraph 2 – point f a (new)

Text proposed by the Commission

Amendment

(fa) to ensure consistent provision of the secure processing environment compliant with the technical, information security and interoperability requirements and enforce compliance across the Member States;

Or. en

Amendment 152

Proposal for a regulation

Article 65 – paragraph 2 – point f b (new)

Text proposed by the Commission

Amendment

(fb) to advise the Commission and Member States on matters relevant for the implementation and development of the European Health Data Space, including cross-border interoperability of health data, and potential mechanisms of funding support to ensure equal development of health data systems across Europe in respect to the secondary use of electronic health data.

Or. en

Amendment 153

Proposal for a regulation

Article 65 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. The EHDS Board may commission studies and other initiatives in order to support the implementation and development of the EHDS.

Or. en

Amendment 154

Proposal for a regulation

Article 69 – paragraph 1

Text proposed by the Commission

Amendment

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties shall be effective, proportionate and dissuasive. Member States shall notify the Commission of those rules and measures by date of application of this Regulation and shall notify the Commission without delay of any subsequent amendment affecting them. The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.

Or. en

Amendment 155

Proposal for a regulation

Article 69 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. Penalties shall cover infringements not addressed by Regulation (EU) 2017/745, Regulation (EU) 2017/746, Regulation (EU) No 536/2014 and Regulation (EU) 2016/679 and shall depend on the circumstances of each individual case. When deciding whether to impose a penalty and deciding on the amount of the penalty in each individual case, due regard shall be given to the criteria stated in Article 83(2) of Regulation (EU) 2016/679, where applicable.

Or. en

Amendment 156

Proposal for a regulation

Article 69 a (new)

Text proposed by the Commission

Amendment

Article 69a

Right to an effective judicial remedy against a controller or processor

1. In accordance with Article 79 of Regulation (EU) 2016/679, without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a digital health authority pursuant to Article 11 or with a health data access body pursuant to Article 38a, each natural person shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with the Regulation.

Or. en

Amendment 157

Proposal for a regulation

Article 70 – paragraph 1

Text proposed by the Commission

Amendment

1. After 5 years from the entry into force of this Regulation, the Commission shall carry out a targeted evaluation of this Regulation especially with regards to Chapter III, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. The evaluation shall include an assessment of the self-certification of EHR systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies.

1. After 5 years from the entry into force of this Regulation, the Commission shall carry out a targeted evaluation of this Regulation especially with regards to Chapter III and IV, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. The evaluation shall include an assessment of the self-certification of EHR systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies. It shall also include an evaluation of the opt-out mechanism laid down in Article 33(5).

Or. en

Amendment 158

Proposal for a regulation

Article 70 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. After two years from the entry into force of this Regulation, the Commission shall carry out an evaluation on the Union funding attributed to the setting up and working of the EHDS, notably as to the ability of Union bodies to carry out their tasks under this Regulation and of Member States to apply the Regulation in a uniform and coherent manner. The Commission shall submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a legislative proposals.

Or. en

EXPLANATORY STATEMENT

The rapporteurs welcome the Commission’s proposal on the European Health Data Space and its high ambition. Using the power of health data through a safe and secure exchange environment within the EU for both primary and secondary use will be important to ensure more efficient and high-quality care for patients, to improve decision-making by healthcare professionals, and to ensure science-based and reliable responses to future health crises such as a possible new pandemic.

Since the proposal concerns sensitive personal data, processing of which is allowed only for specific purposes, it is important to clarify the relationship between the provisions in the EHDS proposal and the GDPR, the EU Charter of Fundamental Rights and Member State laws on data protection. The level of data protection guaranteed by the GDPR shall be the benchmark to the level of data protection guaranteed within the EHDS.

Primary use of health data

The rapporteurs consider that the simplified and uniform exchange of health data for primary use will be of essence for the provision of high-quality and innovative healthcare across the Union and for the rights of patients to effectively access and assess their personal health data. The portability of health data should facilitate cross-border healthcare for Union citizens exercising their right of free movement across the Union and will reinforce the possibility for patients to access healthcare in other Member States as laid down in Regulation No 883/2004 and Directive 2011/24/EU on the application of patients’ rights in cross-border healthcare.

The rapporteurs consider that harmonisation of health data needs to be further clarified to ensure true interoperability of health systems. The rapporteurs consider that some of the rights of patients as data subjects should be clarified. Notably, the right to obtain free and digital copies of their health data should apply on top of the rights established by Article 15 of the GDPR.

It is furthermore necessary that representatives of healthcare professionals and patients are represented in the digital health authority of each Member State to ensure their interests are duly taken into account in the implementation of these actions.

Secondary use of health data

The rapporteurs consider that the secondary use of health data can significantly contribute to the public health objectives of the Union, thanks to policy makers, researchers, innovators and enterprises activities. Secondary data must be representative, reliable and available to serve the use in the public interest of the data. At the same time, patients’ and public trust in the processing of such data must be strong. Further clarifications of the purposes of such processing much hence be provided.

The rapporteurs consider it necessary to lay down that no processing of health data for secondary use should be allowed to the detriment of persons or groups in economic activities, most notably in the labour market or in the provision of financial services.

The rapporteurs consider that the prescribed processes through which data permits for secondary use must be granted after a decision by the health data access body, after a substantiated and vetted application is a necessary safeguard for public trust in the use of their data and that such processing fulfils the necessary criteria. However, such direct access may be necessary in cases such as to manage an epidemic or for pharmacovigilance purposes. Any access to such data from the data holder should hence be limited to the cases necessary for public health purposes and limited to public sector bodies.

The rapporteurs note that the obligation to provide data for secondary use also covers data that contain intellectual property rights and trade secrets. This obligation may create insecurity of their confidentiality for health industry actors such as pharmaceutical and medical device companies. It is therefore important to introduce measures to preserve the confidentiality of intellectual property rights, strictly and uniformly applied across the Union, notably to avoid some applicants seeking access to data for secondary use in one Member State where controls of such confidentiality may be less stringently enforced. The rapporteurs will favourably consider strengthened provisions for IP rights and trade secrets with legal clarity for all concerned actors and that can ensure uniform application across the Union.

The rapporteurs consider that Chapter IV on secondary use of health data as proposed by the Commission requires certain amendments to align better with aforementioned fundamental rights framework. Article 8(2) of the Charter of Fundamental Rights emphasizes individuals’ power over and protection of their personal data. The principle of proportionality requires that the more sensitive personal data are, the stricter the processing requirements are. This is reflected in Article 6 and especially Article 9 of the GDPR. Health data are among the most sensitive personal data of all, processing of which is subject to strengthened safeguards and conditions under Article 9 of the GDPR. It is therefore necessary to further clarify the relationship between the conditions for processing of health data under that article and articles 34 under the proposal. It is commendable that Article 1(4) states that the EHDS is without prejudice to the rules of the GDPR. Recital 37 suggests that the catalogue of processing purposes of Article 34 EHDS concretizes Article 9(2) (h), (i) and (j) GDPR. However, the purposes of Article 34 EHDS proposal are formulated in a broader and vaguer way than Article 9(2)(h), (i) and (j) GDPR. Hence the purposes of processing under 9(2) should be directly integrated in Article 34.

Consent is the legal basis for the processing of health data in some Member States. Hence, processing health data for secondary use without consent of the data subject means a significant shift in data protection law as applied and would create an important precedent for further legal acts on secondary data use. The participation of the data subjects must be ensured. Therefore, a right to a partial or entire opt-out for some or all of the purposes of secondary use should be provided and to ensure the right to object provided by Article 21(6) of the GDPR.

Governance

The rapporteurs welcome the establishment of a European Health Data Space Board. The rapporteurs would like to furthermore extend its tasks to enable it to give recommendations to ensure actual interoperability between health data systems to avoid inconsistencies in application between Member States.

It is also necessary to expand the composition of the Board to representatives of health stakeholders including representatives of patients, health professionals and the health industry, the latter being appropriate as the Board does not directly take supervisory decisions as regards economic operators. It is furthermore reasonable to give a permanent seat in the Board to representatives of the most concerned Union agencies and other bodies, being the European Medicines Agency, European Centre for Disease Prevention and Control, a representative of the European Data Protection Board, and a representative of the European Data Protection Supervisor.

Miscellaneous

Due to the sensitive character of health data and the necessity for Union and Member States authorities to supervise the storage of such data, the rapporteurs consider it necessary to provide that electronic health data should be stored in the territory of the Union. Such a storage requirement should however not preclude the transfer of such data insofar as such transfers are allowed under Chapter V of the GDPR.

The rapporteurs consider that wellness applications have a role in the digital health landscape, which is still in an early and developing stage. It is therefore appropriate to make the labelling of wellness applications compatible with EHR systems voluntary at this moment. The data of wellness applications for secondary use would provide for data of lower quality for secondary use and may not cover the entire population, but may still be of relevance together with other data. The rapporteurs do however see other privacy concerns regarding the sharing of health data under such applications. Such concerns must be addressed through the enforcement by responsible authorities under the GDPR and other applicable law.

The successful and timely implementation of the EHDS across all Member States will require sufficient funding from Union sources. Member States are not equally advanced in the digitisation of their health systems and previous experience in harmonising the exchange of health data and ensuring the interoperability of systems within Member States show that costs and timelines are often not fully met. Furthermore, not all Member States are in the same financial and/or administrative position to successfully implement all the requirements of the proposal, which could jeopardise the benefits for all other Member States and financial support in this regard hence has a genuine European added value is needed.

The rapporteurs note with some concern the relatively restrictive budget allocated for the EHDS in the Legislative Financial Statement and sees the risk that the allocated budget may not be sufficient in fully meeting the objectives of the proposal. Furthermore, it is the position of the Parliament that new Union initiatives should be met with fresh financial resources, while there is a genuine concern that the EHDS will compete with other actions under the EU4Health and Digital Europe programmes foreseen at the adoption of the 2021-2027 Multiannual Financial Framework. The Commission should therefore analyse the need for strengthening the budget allocated to the implementation of the EHDS as part of any revision of the MFF and in the proposal for a new MFF in the period after 2027.