Transparency under the EHDS secondary use framework: Between individual notification and public information

Transparency is an important principle in EU data protection law. Its importance not only lies in the right to information itself, but limitations on transparency can directly affect the ability of individuals to exercise other data subject rights.

This is particularly significant under the European Health Data Space Regulation (EHDS), which aims to facilitate the secondary use of electronic health data for research, policy-making and innovation. It gives individuals a right to opt out of the secondary use of their health data, but an opt-out right is only meaningful if individuals know that their data may be used, understand what that use entails, and have a genuine opportunity to exercise their choice. It is therefore important to examine how transparency is configured in this context.

Article 13 and 14 GDPR still apply

The starting point remains Articles 13 and 14 GDPR. Article 13 applies where personal data are collected directly from the data subject, while Article 14 applies where they are obtained indirectly. Both provisions generally require controllers to provide information regarding the processing, including its purposes and legal basis, recipients, retention periods and the rights available to data subjects.

The original EHDS proposal would have significantly weakened this framework. Article 38(2) of the Commission's proposal provided that health data access bodies (HDABs) would not have to provide the information required by Article 14 to each individual whose data were used for projects covered by a data permit. This proposal attracted substantial criticism and was removed from the final text. [1]

The final EHDS therefore does not establish a general exemption from the GDPR’s transparency requirements. Where data holders, HDABs or data users qualify as controllers under the GDPR, they remain subject to the relevant information obligations. For data holders, Article 13(3) GDPR is particularly relevant where data have been collected directly from individuals. Making those data available for secondary use may constitute “further processing”, requiring information about such processing to be provided before the data are shared. Article 14 is also relevant where personal data are obtained indirectly. This will generally be the case for HDABs and data users, and may also apply to data holders, depending on how the data are obtained.

GDPR’s exceptions on transparency obligations

The GDPR itself recognises that individual notification may not always be practicable, particularly in large-scale research. Article 14(5)(b) provides an exception where providing the information is impossible, would involve disproportionate effort, or would seriously undermine the objectives of the processing, provided that appropriate measures are taken to protect the data subject's rights and interests. Recital 62 GDPR specifically points to factors such as the number of data subjects, the age of the data and the safeguards adopted.

These considerations fit the EHDS context particularly well. Secondary use may involve very large datasets, including historical health records whose subjects may be difficult or impossible to trace. Contact details may no longer be available, while re-contacting individuals may itself affect the quality or representativeness of research. Its application, however, requires an assessment of whether the relevant conditions are actually satisfied.

Article 14(5)(c) might appear to offer a exception without the need of case-by case assessment. It applies where the obtaining or disclosure of personal data is expressly laid down by Union or Member State law and that law provides appropriate measures to protect the data subject’s legitimate interests. Since the EHDS establishes a legal obligation requiring data to be made available for secondary use purposes, one might argue that this exception applies to data holders, HDABs and data users.This is where the EHDS’s own transparency requirement becomes important.

Article 58 EHDS: filling the transparency gap?

The exception provided in Article 14(5)(b) requires appropriate measures to protect individuals’ rights and interests. One example given by the GDPR is making the information publicly available. This is indeed included in the EHDS Regulation. Article 58(1) and (2) EHDS requires HDABs to make information publicly available concerning secondary use, including the legal basis, relevant safeguards and the rights of natural persons, including the right to opt out. The information must be easily searchable electronically and accessible to individuals. Importantly, HDABs are not required to communicate information about a particular secondary use directly to each individual whose data are involved.

Article 14(5)(c) similarly requires “appropriate measures” to be provided in Union or Member State law. However, the Court of Justice has interpreted this provision as requiring a level of protection at least equivalent to that provided by Articles 14(1)-(4) GDPR. [2] It is therefore difficult to conclude that Article 58 EHDS, by itself, satisfies this standard. Making information publicly available is a less demanding form of transparency than proactive communication to the individuals concerned. It requires individuals to find the information themselves and, importantly, to know where and when to look for it. It would also be practically difficult for individuals to identify the secondary use projects involving their data, unless this is enabled through national implementation.

Therefore, Article 58 EHDS should not be understood as enabling a general exemption under Article 14(5)(c). Nevertheless, data holders, HDABs and data users may still be very likely to rely on Article 14(5)(b), especially in the context of scientific research.

Article 58 and the right to opt out from secondary use

The limitations of Article 58 become apparent when considering its role in facilitating the right to opt out. Article 58 requires information concerning secondary use to be made publicly available, but information concerning a specific secondary use may only become available after the relevant data access permit or health data request has been approved.

Given that the right to opt out operates prospectively and ceases to affect a particular use once a data permit is issued [3], information published about a specific secondary use will come too late to enable individuals to meaningfully act on the information they receive. Their decision to opt out will instead have to be based on the general possibility that their data may be made available for secondary use, rather than on information about how their data are actually being used. Article 58 may therefore contribute to general transparency concerning the secondary use framework, but it offers very limited assistance in facilitating the exercise of the opt-out right. This raises the concern about whether making information publicly available is sufficient to provide individuals with meaningful control over the use of their health data.

Additionally, regarding information about the right to opt out, Recital 54 EHDS stresses that natural persons should receive sufficient and comprehensive information about their right to opt out, including its benefits and drawbacks. How this is implemented in practice, and whether it provides meaningful transparency, will depend on how the opt-out mechanism is established at the national level.

Conclusion

The EHDS does not replace the GDPR’s individual transparency requirements, but these may in practice be exempted due to practical difficulties. The EHDS supplements them with a requirement of making information public under Article 58. While reliance on public information may be justified, it creates a potential gap between information being publicly available and individuals being meaningfully informed. In particular, Article 58 has considerable limitations in enabling individuals to exercise the right to opt out. Whether this gap can be addressed in practice will also depend significantly on how the opt-out mechanism and related information requirements are implemented at the national level. Ultimately, the effectiveness of transparency under the EHDS should be assessed not simply by whether information is available, but by whether individuals have a meaningful opportunity to understand the use of their data and act on it.

Credit: Photo by Veta Aprel on Unsplash

[1] For example, see European Data Protection Board and European Data Protection Supervisor, ‘EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space’ (2022).

[2] Nemzeti Adatvédelmi és Információszabadság Hatóság v UC (C-169/23) EU:C:2024:988, paras 54, 64; also see European Data Protection Board, ‘Guidelines 1/2026 on Processing of Personal Data for Scientific Research Purposes’ (2026) para 104.

[3] Article 71 EHDS