In brief
Regulation (EU) 2025/327 on the European Health Data Space has been in force since 26 March 2025 and applies from 26 March 2027. Chapter IV, on secondary use, applies from 26 March 2029. It contains two different opt-out mechanisms: Article 10 is an option left to Member States, Article 71 is a right belonging to the person.
What the Regulation does
The Regulation distinguishes two uses of electronic health data. Primary use is the purpose the data were collected for: care. Secondary use is everything else — research, innovation, official statistics, policy-making, regulatory activities. For the first, the Regulation builds a person's access to their own data and a health professional's access to the data of the patient under treatment, including across borders. For the second, it builds an infrastructure of national bodies that issue data permits.
There are four dates, not one
- 26 March 2025: entry into force, the twentieth day after publication in the Official Journal of 5 March 2025.
- 26 March 2027: general application of the Regulation.
- 26 March 2029: Chapter IV on secondary use applies, and Articles 3 to 15 apply to the priority categories of data listed in Article 14(1), points (a), (b) and (c).
- 26 March 2031: the same articles apply to the categories listed in points (d), (e) and (f), which include test results and medical imaging.
The two opt-outs
This is where confusion is easiest, because the word is the same and the legal nature is not.
Article 10 concerns primary use and opens by saying that Member States' laws may provide for the right to opt out: it is an option, not an obligation. A Member State that exercises it must ensure the opt-out is reversible and establish the rules and safeguards of the mechanism, including the possibility for a health professional to access the data anyway where processing is necessary to protect the vital interests of the person or of another individual.
Article 71 concerns secondary use and leaves nobody a choice: natural persons have the right to opt out at any time, without giving any reason, from the processing of their personal electronic health data for secondary use. It is not a Member State option, it is a directly conferred right.
The mistake to avoid
The Regulation does not replace the GDPR and does not derogate from it: it sits on top of it. Legal bases, information notices, the record of processing and the impact assessment remain those of Regulation 2016/679. Anyone reading the European Health Data Space as a special regime that absorbs the rest is preparing documentation that will answer the questions of neither instrument.
What to do now, if you advise a healthcare client
- Know which of the Article 14 priority categories the client actually processes: the application date changes depending on the point.
- Check whether and how the State where the client operates has exercised the Article 10 option, because the answer is not the same across the Union.
- Look at the electronic health record systems in use: Chapter III imposes requirements on the systems, not only on those who use them, and the supplier has to be involved now, not in 2027.
- Do not wait until 2029 for secondary use: those who release data for research are already doing so today, and the incoming rules will also ask about what was built beforehand.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
