Opt-in vs opt-out rules for secondary use of health data: can the European Health Data Space learn from Switzerland?

Introduction

The European Union (EU) institutions have just reached a deal for passing the European Health Data Space (EHDS) Regulation, which was described as “the most important health legislation of this mandate”. This landmark piece of law is aimed to set clear rule for the use of data in the health and biomedical sector, and finding an agreement on its content was far from easy. Indeed, the regulation is very ambitious, in that it aims to harmonise throughout the EU the rules for both primary (e.g. in the context of care provision) and secondary (e.g. for research purposes) use of health data. 

Individual rights regarding secondary use of data: a contested issue in the EHDS negotiation

One of the most contentious issues in the negotiation of the law concerned the conditions for secondary use of health data. More specifically, EU institutions had different visions on the role and rights of individuals (i.e. data subjects). The original EHDS proposal by the Commission did not give individuals any rights to opt-out, meaning that data-subjects would have no chance to withdraw their data from secondary uses (e.g. research). The Parliament, on the contrary, insisted that individuals should have a right to opt-out from the secondary use of their health data, and that reuse of genetic data should always require explicit consent. Finally, Council believed it should be up to single member states to adjust such rules. These diverging views clashed during the negotiations, and the final deal faltered over these issues. A compromise deal was finally reached in March and the Parliament then approved the new agreed text of the EHDS at the end of April. The regulation is now (as of May 2024) under examination by the Council, and it is unlikely that substantial changes will emerge. 

Opt-out and opt-in rules in the agreed text: a difference between health and genetic data?

The currently agreed text seems to show that many of the requests by the Parliament were integrated. Indeed, art. 35f introduces (albeit with some exceptions) a “Right to opt-out from the processing of personal electronic health data for secondary use”. Moreover, article 33.5 states that “Member States may introduce stricter measures and additional safeguards at national level aimed at safeguarding the sensitivity and value of the data that falls under Article 33 (1) points (e) [human genetic, epigenomic and genomic data]”. If member states make use of this open clause, they may require that the secondary use of specifically sensitive data (e.g. genetic ones) requires individual consent, just as suggested by the EU Parliament in the negotiations. In this case, a two-tier system will develop: secondary use of regular health data will be possible unless individuals have opted out, whereas secondary use of genetic data will necessitate consent (opt-in system). This differentiation based on the nature of the data (genetic vs non-genetic) mirrors the theory of “genetic exceptionalism”, i.e. the idea that genetic data have something intrinsically special, which often deserves a separate (stricter) legal regime.[1]

Learning from the Swiss regulatory framework

Should thus Member States make use of this open clause and introduce stricter rules for the secondary use of genetic data? Although it is difficult to provide a general recommendation, policymakers can profit from looking at the regulatory system of Switzerland. Here, the Federal Law on Human Research (in force since 2014) sets specific rules for the secondary use of data that also distinguish between regular health data and genetic ones. Specifically, the reuse of pseudonymised genetic data is possible only if consent by data-subject is present (opt-in solution) whereas for regular health data it is sufficient that demonstrate that individuals did not opt-out. In a study we conducted in 2019, we demonstrated that this two-tier system can be problematic both at a theoretical and at a practical level. [2] For example, the attempt of Swiss university hospitals to implement policies on data reuse that would guarantee both the right to opt-out (with respect to health data) and the right to opt-in (for genetic data) for the reuse of routinely collected data proved extremely difficult and confusing for patients. Moreover, although it is often argued that genetic data deserves higher protection due to their potential to re-identify individuals, developments in the field of data science increase the chances to re-identify individuals also based on health data alone. Finally, research on people’s attitudes show that the public is often more concerned about who will re-use the data, rather than which type of data will be re-used.

Conclusions

These considerations do not mean to suggest that the protection of (and individual rights regarding) genetic data should be reduced. Rather, they invite to reflect on whether a differential system where genetic data are more protected than regular health data is truly justified. If EU Member States consider this policy choice in the future, looking at the experience of Switzerland can provide some useful lessons about the implementation of different opt-out or opt-in rights based on the nature of the data.

Credit: Image by vjohns1850, via Pixabay