Changes from adopted text to adopted text

RemovedArticle 42 – paragraph 1: 1. Health data access bodies may charge fees to health data users for making electronic health data available for secondary use. Any fees shall include and be derived from the costs related to the set up, combination, preparation, anonymisation, pseudonymisation, maintenance, tasks under Article 33a, making available or updating of the dataset and conducting the procedure for requests, including for assessing a data application or a data request, granting, refusing or amending a data permit pursuant to Articles 45 and 46 or providing an answer to a data request pursuant to Article 47, in accordance with Article 6 of Regulation […] [Data Governance Act COM/2020/767 final]. No fees shall be charged to public sector bodies and Union institutions, offices, agencies and bodies when making data available for the purposes referred to in Article 34(1), points (a), (b) and(c). No fees shall be charged to public sector bodies or Union institutions, offices, agencies and bodies with a legal mandate in the field of public health.

RemovedArticle 42 – paragraph 2: 2. In the case of health data holders, where the data in question are not held by the health data access body or a public sector body or a Union institution, office, agency and body, the fees may be derived from the costs for gathering, enriching, and preparing the electronic health data specifically under this Regulation in addition to the fees that may be charged pursuant to paragraph 1. The part of the fees linked to the health data holder’s costs shall be paid to the health data holder.

RemovedArticle 42 – paragraph 4: 4. Any fees charged to health data users pursuant to this Article by the health data access bodies or health data holders shall be transparent, non-discriminatory, and proportionate to the cost of making electronic health data available for secondary use, objectively justified and shall not restrict competition. The support received by the health data holder from donations, public national or Union funds, to set up, develop or update that dataset shall be excluded from this calculation. The specific interests and needs of SMEs, public bodies, Union institutions, bodies, offices and agencies involved in research, health policy or analysis, academic and educational institutions, non-commercial entities and healthcare providers shall be taken into account when setting the fees, by reducing those fees proportionately to their size or budget.

RemovedArticle 42 – paragraph 5: 5. Where health data holders and health data users do not agree on the level of the fees within 1 month of the data permit being granted, the health data access body may set the fees in proportion to the cost of making available electronic health data for secondary use. Where the health data holder or the health data user disagree with the fee set out by the health data access body, they shall have access to dispute settlement bodies set out in accordance with Article 10 of the Regulation […] [Data Act COM/2022/68 final].

RemovedArticle 42 – paragraph 6: 6. The Commission shall, by means of implementing acts, lay down principles and rules for the fee policies and fee structures, including deductions for the entities listed in paragraph 4, second sub-paragraph. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

RemovedArticle 43 – title: Enforcement by health data access bodies

RemovedArticle 43 – paragraph 1: deleted

RemovedArticle 43 – paragraph 2: 2. When carrying out its monitoring and supervisory tasks to verify compliance with this Chapter, as referred to in Article 37(1), point (ra), the health data access bodies shall request information from health data holders and users that is proportionate for the performance of the task.

RemovedArticle 43 – paragraph 3: 3. Where health data access bodies find that a health data user or health data holder does not comply with the requirements of this Chapter, they shall immediately notify the health data user or health data holder of those findings and shall give it the opportunity to state its views within 4 weeks. / Where the finding of non-compliance concerns a possible breach of Regulation (EU) 2016/679, the health data access body shall immediately inform the supervisory authorities under Regulation (EU) 2016/679 and provide them with all relevant information at their disposal concerning this finding to ensure application and enforcement of the relevant provisions of that Regulation, including penalties.

RemovedArticle 43 – paragraph 4: 4. Health data access bodies shall have the power to revoke the data permit issued pursuant to Article 46 and stop the affected electronic health data processing operation carried out by the health data user in order to ensure the cessation of the non-compliance referred to in paragraph 3, immediately or without undue delay, and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the health data users. In this regard, the health data access bodies shall be able, where appropriate, to revoke the data permit and to exclude the health data user from any access to electronic health data for a period of up to 5 years.

RemovedArticle 43 – paragraph 5: 5. Where health data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data, or do not respect the deadlines set out in Article 41, the health data access body shall have the power to fine the health data holder with fines for each day of delay, which shall be transparent and proportionate. The amount of the fines shall be established by the health data access body. In case of repeated breaches by the health data holder of the obligation of loyal cooperation with the health data access body, that body can exclude the health data holder from submitting data access applications pursuant to Chapter IV for a period of up to 5 years, while still being obliged to make data accessible pursuant to Chapter IV, where applicable.

RemovedArticle 43 – paragraph 6: 6. The health data access body shall communicate the measures imposed pursuant to paragraphs 4 and 5 and the reasons on which they are based to the health data user or holder concerned, without delay, and shall lay down a reasonable period for the health data user or holder to comply with those measures.

RemovedArticle 43 – paragraph 7: 7. Any enforcement measures imposed pursuant to paragraph 4 shall be notified to other health data access bodies and made publicly available on the website of the EHDS Board.

RemovedArticle 43 – paragraph 7 a (new): 7a. The health data access body shall ensure coherent enforcement based on the provisions of this Regulation and Regulation (EU) 2016/679 by taking into account any decision or investigation ongoing in supervisory authorities.

RemovedArticle 43 – paragraph 9: deleted

RemovedArticle 43 – paragraph 10: 10. The Commission shall issue guidelines on enforcement measures to be applied by the health data access bodies, in accordance with the principles set out in Article 68a.

RemovedArticle 43 a (new): Article43a / General conditions for the imposition of administrative fines by health data access bodies / 1. Each health data access body shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements referred to in paragraphs 4 and 5 shall in each individual case be effective, proportionate and dissuasive. / 2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in Article 43(4) and (5). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: / (a) the nature, gravity and duration of the infringement; / (b) whether any penalties or administrative fines have already been applied by other competent authorities to the same infringing party for the same infringement; / (c) the intentional or negligent character of the infringement; / (d) any action taken by the health data holder or health data user to mitigate the damage suffered by natural persons; / (e) the degree of responsibility of the health data user, taking into account technical and organisational measures implemented by them pursuant to Article 45(2), points (e) and (f),and Article 45(4); / (f) any relevant previous infringements by the health data holder or health data user; / (g) the degree of cooperation with the health data access body, in order to remedy …

RemovedArticle 44 – paragraph 1: 1. The health data access body shall ensure that access is only provided to requested electronic health data that are adequate, relevant and limited to what is necessary in relation to the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.

RemovedArticle 44 – paragraph 2: 2. The health data access bodies shall provide the electronic health data in an anonymised format, in any event where the purpose of processing by the health data user can be achieved with such data, taking into account the information provided by the health data user.

RemovedArticle 44 – paragraph 3: 3. Where the health data user has sufficiently demonstrated that the purpose of processing cannot be achieved with anonymised data in line with Article 46(1c), taking into account the information provided by the health data user the health data access bodies shall provide access to electronic health data in pseudonymised format. The information necessary to reverse the pseudonymisation shall be available only to the health data access body. Health Data users shall not re-identify the electronic health data provided to them in anonymised or pseudonymised format.

RemovedArticle 44 – paragraph 3 a (new): 3a. The health data user’s failure to respect the health data access body’s measures ensuring anonymisation and pseudonymisation shall be considered a particularly serious breach of this Regulation and shall be subject to effective, proportionate and dissuasive penalties.

RemovedArticle 44 – paragraph 3 b (new): 3b. The Commission shall, by means of implementing acts, set out the procedures and requirements, and provide technical tools, for a unified procedure for anonymising and pseudonymising the electronic health data. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

RemovedArticle 45 – paragraph 1: 1. Health data applicants may submit a data access application for the purposes referred to in Article 34.

RemovedArticle 45 – paragraph 2 – point -a (new): (-a) the health data applicant´s identity, description of professional functions and operations, including the identity of the natural persons who will have access to electronic health data, if a data permit is granted; the list of natural persons can be updated and in that case it shall be notified to the health data access body;

RemovedArticle 45 – paragraph 2 – point a: (a) a detailed explanation of the intended use of the electronic health data including for which of the purposes referred to in Article 34(1), access is necessary;

RemovedArticle 45 – paragraph 2 – point a a (new): (aa) a description of how the health data applicant is qualified vis-à-vis the intended purposes of data use, including professional qualifications to demonstrate appropriate expertise, consistent with ethical practice and applicable laws and regulations;

RemovedArticle 45 – paragraph 2 – point a b (new): (ab) an explanation of the expected benefits and how these benefits contribute to the purposes referred to in Article 34(1);

RemovedArticle 45 – paragraph 2 – point b: (b) a description of the requested electronic health data, their timeframe, format and data sources, where possible, including geographical coverage where data is requested from several Member States;

RemovedArticle 45 – paragraph 2 – point c: (c) an explanation whether electronic health data needs to be made available in a pseudonymised format and why the envisaged purpose for processing cannot be pursued using anonymised data;

RemovedArticle 45 – paragraph 2 – point d: (d) a description of the safeguards planned to prevent any other use or any misuse of the electronic health data;

RemovedArticle 45 – paragraph 2 – point e: (e) a description of the safeguards proportionate to the risks, planned to protect the rights and interests of the health data holder;

RemovedArticle 45 – paragraph 2 – point f: (f) for personal electronic health data, a description of the necessary technical and organisational measures pursuant to Article 32 of Regulation (EU) 2016/679; to protect the rights and interests of the natural persons concerned, including to prevent any re-identification of natural persons in the dataset;

RemovedArticle 45 – paragraph 2 – point g: (g) a justified estimation of the period during which the electronic health data is needed for processing;

RemovedArticle 45 – paragraph 2 – point h a (new): (ha) where applicable, information on the assessment of ethical aspects of the processing and details of any necessary ethics approval obtained by the competent ethics committee in line with national law, which may serve to replace their own ethics assessment;

RemovedArticle 45 – paragraph 2 – point h b (new): (hb) a plan defining audiences and tools to provide information publicly on the results or outcomes of the access to the data in accordance with Article 46(11);

RemovedArticle 45 – paragraph 2 – point h c (new): (hc) a declaration that the intended uses of the data requested do not pose a risk of stigmatisation of or causing harm to the dignity of individuals or the groups to which the dataset requested relates.

RemovedArticle 45 – paragraph 3: 3. Health data applicants seeking access to electronic health data from more than one Member State shall submit a single application to one of the concerned health data access bodies of their choice which shall be responsible for sharing the application with the other health data access bodies and authorised participants in HealthData@EU referred to in Article 52, which have been identified in the data access application. In such a case, the health data access body shall notify the other relevant health data access bodies of the receipt of an application relevant to them within 15 days from the date of receipt of the data access application.

RemovedArticle 45 – paragraph 4 – introductory part: 4. Where the health data applicants intend to access the personal electronic health data in a pseudonymised format, the following additional information shall be provided together with the data access application:

RemovedArticle 45 – paragraph 4 – point a: (a) a description of how the processing would comply with applicable Union and national law on data protection and privacy, notably Regulation (EU) 2016/679;

RemovedArticle 45 – paragraph 4 – point b: deleted

RemovedArticle 45 – paragraph 5 – subparagraph 2: deleted

RemovedArticle 45 – paragraph 6: 6. The Commission shall, by means of implementing acts, set out the templates for the data access application referred to in this Article, the data permit referred to in Article 46 and the data request referred to in Article 47. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 68(2).

RemovedArticle 46 – paragraph 1: 1. Health data access bodies shall issue a data permit only when, after an assessment of the data access application, they find that it fulfils all of the following criteria: / (a) the purpose described in the health data access application is one of the purposes listed in Article 34(1); / (b) the requested data is necessary, adequate and proportionate for the purpose or purposes listed in the health data access application; / (c) in the case of pseudonomised data, there is sufficient justification that the purpose cannot be achieved with anonymised data; / (d) the processing complies with Article 6(1) and Article 9(2) of Regulation (EU) 2016/679 in the case of access to pseudonymised electronic health data; / (e) the health data applicant demonstrates sufficient technical and organisational measures to prevent any other use or misuse of the electronic health data and to protect the rights and interests of the data holder and of the natural persons concerned; / (f) the information on the assessment of ethical aspects of the processing, where applicable, is in line with national law; / (g) all other requirements in this Chapter are fulfilled by the health data applicant.

RemovedArticle 46 – paragraph 2: 2. Health data access bodies shall refuse all applications where requirements in this Chapter are not met.

RemovedArticle 46 – paragraph 3: 3. After the health data applicant has demonstrated the effective implementation of their security measures referred to in Article 45(2), points (e) and (f), the health data access body shall issue or refuse a data permit within 2 months of receiving a complete data access application. If the health data access body finds that the data access application is incomplete, it shall notify the health data applicant, who shall be given the possibility of completing their application. If the health data applicant does not fulfil this request within four weeks, a permit shall not be granted. By way of derogation from that Regulation (EU) 2022/868 the health data access body may extend the period for responding to a data access application by 2 additional months where necessary, taking into account the complexity of the request. In such cases, the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application, together with the reasons for the delay.

RemovedArticle 46 – paragraph 4: 4. Following the issuance of the data permit, the health data access body shall immediately request the electronic health data from the data holder and inform them whether the data will be made accessible in anonymised or pseudonymised form. The health data access body shall make available the electronic health data to the health data user within 2 months after receiving them from the data holders.

RemovedArticle 46 – paragraph 5: 5. When the health data access body refuses to issue a data permit, it shall provide a justification for the refusal to the health data applicant.

RemovedArticle 46 – paragraph 6 – introductory part: 6. The data permit shall set out the general conditions applicable to the health data user, in particular:

RemovedArticle 46 – paragraph 6 – point a: (a) categories and format of electronic health data accessed, covered by the data permit, including their sources;

RemovedArticle 46 – paragraph 6 – point b: (b) a detailed description of the purpose for which data are made available;

RemovedArticle 46 – paragraph 6 – point b a (new): (ba) the identity of the user as well as the concrete persons who are authorised to have access to the electronic health data in the secure processing environment;

RemovedArticle 46 – paragraph 6 – point d: (d) information about the technical characteristics and tools available to the health data user within the secure processing environment;

RemovedArticle 46 – paragraph 6 – point e: (e) fees to be paid by the health data user;

RemovedArticle 46 – paragraph 7: 7. Data users shall have the right to access and process the electronic health data in a secure processing environment in accordance with the data permit delivered to them on the basis of this Regulation.

RemovedArticle 46 – paragraph 8: 8. The Commission is empowered to adopt delegated acts to amend the list of aspects to be covered by a data permit in paragraph 6 of this Article, in accordance with the procedure set out in Article 67.

RemovedArticle 46 – paragraph 9: 9. A data permit shall be issued for the duration necessary to fulfil the requested purposes which shall not exceed 5 years. This duration may be extended once, at the request of the data user, based on arguments and documents to justify this extension provided, 1 month before the expiry of the data permit, for a period which cannot exceed 5 years. By way of derogation from Article 42, the health data access body may charge increasing fees to reflect the costs and risks of storing electronic health data for a longer period of time exceeding the initial 5 years. In order to reduce such costs and fees, the health data access body may also propose to the data user to store the dataset in storage system with reduced capabilities. The data within the secure processing environment shall be deleted without undue delay following the expiry of the data permit. Upon request of the data user, the formula on the creation of the requested dataset shall be stored by the health data access body.

RemovedArticle 46 – paragraph 11: deleted

RemovedArticle 46 – paragraph 12: deleted

RemovedArticle 46 – paragraph 14: 14. The liability of health data access bodies as controller is limited to the scope of the issued data permit until the completion of the processing activity and in accordance with Article 51.

RemovedArticle 47 – title: Health data request