EDPS Formal Comments on the proposed European Health Union package

The EDPS has issued its Formal Comments on a package of three legislative proposals for a European Health Union. He welcomes a European unified approach to tackle cross-border health threats while respecting the role and competences of EU Member States’ national health systems. In these Formal Comments, he takes note of the positive steps taken by the Commission to further strengthen a coordinated approach on health matters and, in particular, to broaden the European Medicines Agency’s and the European Centre for Disease Prevention and Control’s tasks. Both of these EU bodies have proved to be key assets in the management of the COVID-19 pandemic.

The EDPS recommends that specific provisions on the application of data protection law are included in the proposal. Likewise, the role of the entities involved under data protection law should also be covered in the proposal. More specifically on the processing of ‘electronic health data outside of clinical studies’ and ‘real-time data’, a clear definition of the ‘data generated outside the scope of clinical trials’ should be included; and the meaning of “real world data” should be clarified, specifying, at least, examples of the type of data concerned and the purpose for which this data will be used.

To find out more, read the EDPS’ Formal Comments.

The EDPS provides a series of recommendations. In particular, he advises that:

As for the new tasks of the ECDC regarding digital platforms and applications supporting epidemiological surveillance, the EDPS notes that these applications are likely to present high risks for  the rights and freedoms of individuals and, thus, require a data protection impact assessment (DPIA) to be conducted prior to their deployment. Moreover, the EDPS insists that contact tracing applications use privacy-enhancing technologies.

In relation to the ECDC’s task of establishing and operating a network of national blood and transplant services and the national authorities of this network, the EDPS encourages the development of a Code of Conduct for the processing of personal data as an effective enabler of cross-border exchange of this data, which would bring further clarity and trust in the new system.

To find out more, read the EDPS’ Formal Comments.

The EDPS recommends providing for further implementing or delegated acts that would lay down the roles of the actors involved in the processing of personal data via the use of IT tools and systems envisaged in the proposal.

Given the potential risks associated with the use of surveillance systems and artificial intelligence, the EDPS recommends that the ECDC conducts a DPIA prior to the deployment of a digital platform. The EDPS also points out that, unless the data controller takes measures to mitigate the risk in cases where the DPIA reveals that the processing of personal data would entail a high risk for individuals’ rights and freedoms, there is an obligation to consult the supervisory authority under Article 40 of Regulation (EU) 2018/1725.

In a similar way, but in relation to the Early Warning and Response System (EWRS), the EDPS reiterates that a DPIA should be carried out before processing personal data using innovative technologies if the processing is likely to result in high risk for individuals’ rights and freedoms. Moreover, the EDPS draws the EU legislators’ attention to the EDPB Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak which provide useful guidance and clarifications on the conditions and principles surrounding the use of location data and contact tracing tools in a proportionate way.

To find out more, read the EDPS’ Formal Comments.

Finally, in relation to the three proposals, the EDPS reiterates that transfers of personal data to third countries or international organisations must comply with Regulation (EU) 2018/1725, including Chapter V of this Regulation.