Data

CPME Rapporteur: dr. Sjaak NOUWT (NL) 
CPME Secretariat: Ms Sara RODA

Personal data protection

CPME believes that a high level protection of all citizens’ data is essential, in particular health and medical data. As the patient-doctor relationship is built on confidence and trust, medical records should be considered as particularly sensitive data. At the same time, it is of utmost importance that healthcare data be stored with the appropriate security standards, for purposes of proof of medical treatment and for future patient’s safety. Following the adoption of the General Data Protection Regulation (GDPR) on 27 April 2016, CPME closely monitors the implementation of this regulatory framework, as well as related legislation with impact to the processing of data concerning health, patient confidentiality and professional secrecy.

European Health Data Space and its implementation

The European Commission published a ‘European strategy for data’ to enable the EU to become more attractive, secure and dynamic data-agile economy. The strategy aimed at developing common European data spaces in strategic economic sectors and domains of public interest, such as the common European Health Data Space (EHDS). The European Commission published the EHDS proposal in May 2022, and Regulation 2025/327 will come into force on 26 March 2025. CPME closely monitored and contributed to the debate, making sure physicians’ views were taken into account. The work will continue to ensure implementation process is 'user-friendly'.

The EHDS Regulation aims to establish a common framework for the use and exchange of electronic health data across the EU. It enhances individuals’ access to and control over their personal electronic health data, while enabling certain data to be reused for public interest, policy support, and scientific research purposes. It supports a single market for digital health services and products; it harmonises legal and technical framework for electronic health record (EHR) systems, fostering interoperability.

Key CPME messages:

• Easier access to individual’s data, specifically patients’ data, needs to be surrounded by strong legal safeguards and level of security. 

• Patient confidentiality and professional secrecy must be preserved online and offline.

• To foster trust in the sharing of health data, there should be the involvement of research ethics committees or ethics review boards , in particular when the legal base to share personal data is other than consent of the data subject.

• The default position for provision of information should be anonymisation, which should be irreversible and legally guaranteed.

• Pseudonymisation, if necessary, can be only in accordance with the national medical practitioner regulator.