health data and broad consent

Health data is my biggest interest within data protection law. If my health would permit it, I would work in a hospital or pharmacy. I even originally set out to complete my traineeship in medical documentation at a hospital! It fell through because I would have had to move to another state. Alas, now I don't work in any medical settings, but I still work with health data in a boring building instead.

Under Article 9 GDPR, health data is considered a special category of data (often called "sensitive data"), and processing is by default prohibited.

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

This data can be vast and overlap in practice - some medical information is biometric or genetic, some might refer to your ethnicity or the color of your skin, some will be sexual and cover sexual activity, orientation, or gender. Some is just plain diagnoses, or values, tests, prescriptions, or otherwise documented treatment for something.

Health data is in this weird spot where most people do not wish to share it, but on the other hand, most of us are supportive of research and new scientific discoveries that could help prevent, treat or cure disease. This doesn't immediately seem like a contradiction, because after all, we have clinical trials. Unfortunately, they only get us so far, as they are limited in scope, population, and variables. That is also why there is a period of time after market authorization (in EU at least) where a drug is additionally monitored as the general population starts to use it for the first time, and more trials are needed.

The risk-benefit analysis might switch or new discoveries are made, like new side effects or drug interactions that need to be included in the package leaflet and the SmPC (Summary of Product Characteristics). You can spot these medications by looking for a black triangle, or check out the list on the EMA website.

Not only practical reasons speak for more use of data; the promotion of scientific research is an objective in the EU’s founding treaties, and the EU Charter of Fundamental Rights mentions unconstrained scientific research and academic freedom.

So it makes sense that there is a growing interest in getting the health data of the general population, for example through their health insurance. We can do clinical trials, and we can analyze reported cases in pharmacovigilance systems or do journal reviews, but these are only small parts of the population, in very controlled environments, and the reporting isn't as good as it could be - lots of doctors simply do not report much or with too little information. Trends across populations are more difficult to detect that way or different causes and effects are never seen as connected.

Examples for moves to combine health data across different registries, biobanks, organizations or countries for scientific purposes are for example the German Medizinregistergesetz to combine different national medical registries, the DARWIN EU project, and the secondary use option of the European Health Data Space regulation, whose infrastructure is currently being established across the EU (and is something I aim to work with).

But how is health data handled under GDPR, for not just clinical trials but all kinds of scientific research? That is where the exceptions of Article 9 and the concept of Broad Consent comes in.

The aforementioned Article 9 also contains exceptions to the total processing ban, and one of them is the purpose of scientific research. A controller needs to meet at least one Article 6 legal basis (like for example your explicit consent, a task in the public interest, legitimate interest etc.), and then it can base its processing on Article 9(2)(j) GDPR together with any Member State law that may apply. Member States are allowed to introduce further conditions and limitations for the processing of genetic data, biometric data or data concerning health, so each EU member might have additional laws to what I am about to describe; Germany, for example, has made use of this.

On top of that, Recital 33 of the GDPR introduces the option of Broad Consent, saying

It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.

That means that in case of scientific research, it is possible to move away from the otherwise very granular and specific consent required by the GDPR, and agree more broadly, and most importantly, agree before the specific purpose of the processing is already set. This makes sense in practice: You technically need to be informed at the time of recording the data, but that may not be at a time where the purpose or scope of the research project is already set or it even already exists.

This doesn't free controllers from specifying no purpose at all, or making it too broad. They cannot make you agree to simply all kinds of research, even if you want to do that. Instead, you might opt into, for example, "oncology research", and then later on, your data can be used for more specific purposes and studies within that bigger purpose. It's important that the purpose is within the defined research area and within the reasonable expectations of you as the data subject.

Aside from this Broad Consent, controllers can also ask you to consent to different individual research projects separately, as soon as the purposes of those projects become known. This is called Dynamic Consent, and avoids some of the issues Broad Consent can pose. It's especially handy when future projects can be identified progressively or research continues over long periods and researchers maintain an ongoing relationship with participants, maybe because they need ongoing care or control.

It can be difficult to fulfill the standard GDPR rights under Broad Consent in practice; you might not be reliably informed who specifically is currently (still) using your data for what purpose, especially years or decades later. It can be harder to withdraw consent and make it reach all parties that need to know about the withdrawal. Enforcement is harder because of how the data might have spread. Who makes sure to remove the data when you request so, or when the storage limitation is reached? And: While your data might be anonymized later on or pseudonymized in one dataset, multiple can be combined, which makes re-identification more likely.

Sidenote about feelings around health data sharing

Of course, there are also reasons to be scared of health data being shared at all, with or without consent. Some illnesses, like HIV, herpes and more are still stigmatized. If this is revealed, the affected people could be seen as unsafe, dirty and promiscuous. Some are scared that it could lead to employers having access to databases where they can check an applicant's health status, which could prevent people who are sick often, or chronically ill and disabled people from getting and keeping employment. Trans people who wish to live stealth can be outed by the sharing of their medical data.

Others see a risk in the data being used for racist and eugenicist reasons, especially via racial information and genetic data, or to detect specific populations the government wants to get rid of, like ethnic minorities, queer people, disabled people and more. In the wrong hands, health data could be used to deem you life unworthy of life. Plus, what if there's a data leak to third parties?

With these risks in mind, I still wanna encourage people to check whether their discomfort around sharing their health data for scientific research is at a reasonable level and based on a likely concern, or a learned behavior because of the shame and stigma around discussing your health in social settings. It's hard to keep those apart! Many of us have learned not to share our illnesses because it makes others uncomfortable or because of bad experiences of others close to us using that information against us.

The fears we usually have around discussing our diagnoses are often based on an information imbalance with our surroundings. That could mean: Your diagnosis of a stigmatized illness is revealed to people who have direct access to you, and now you are afraid that this changes how people view and treat you. You might be scared of being excluded, of being seen as a burden or being infantilized; fears of not finding sexual or romantic partners, and so on. But all of this usually requires a "leak" that exposes only you in your direct environment, and the other people around you aren't exposed and can use this power imbalance against you. On the other hand, if a data leak happens and strangers elsewhere have it in a dataset, there are different consequences; it doesn't give the people around you easy and immediate access, and they might be affected as well, leveling the playing field.

What I am trying to point out with this is: Concern around leaked health data is often less focused on the actual outcome, each person's specific risk factors and what's technically possible, and moreso informed by general stigma in society and fears of interpersonal issues. People mix up the learned fears around admitting illness in their surroundings with the risks in a data leak, even if they barely have any overlap.

For what it's worth, look around you: It is a false premise that we have a small amount of sick people, as if we were a minuscule minority. A lot of people are permanently sick or disabled in some way, needing medication for life, and this also increases the older the population gets. It's time for visibility and solidarity, and that only works if we don't pretend 90% of people are healthy and/or not reliant on medication or other assistance, or don't mentally "count" certain ones (or our own diagnoses) so people can feel above others and punch down.

In your social circle and family, how many people are on antidepressants, how many people have rheumatoid arthritis or endometriosis or PMOS, how many have an Inflammatory Bowel Disease, how many people are on some heart medication, how many are diabetic, how many have epilepsy or have asthma or osteoporosis, who is fighting the effects of surviving cancer, who's on opioids for chronic pain etc., and who's simply dealing with age-related symptoms? That's just the most popular ones and isn't even including traditional physical disability. We all got something to lose and something to gain, and being open about being ill is easier when you realize the people around you are not exempt (forever). It is an inevitability of life.

This perspective gives me the courage to be really open with my illnesses; of course no one else has to do the same.

☁️☁️☁️

For Broad Consent to work well and not undermine your rights, there should be a clear understanding of what even counts as scientific research so there is no abuse of this privilege, and practices should be in place that keep the data secure and foster genuine attempts at informing patients and giving them the option to easily withdraw or keep updated about the use of their data.

Helpfully, the European Data Protection Board (EDPB) has released guidelines for the processing of personal data for scientific research purposes.

They set some standards for what qualifies as scientific research. The six key indicative factors they describe, next to just the nature, scope, contexts and purpose of the processing, are the methodical and systematic approach, the adherence to ethical standards, the verifiability and transparency of the methods and results, autonomy and independence, the objectives of the research ("the aim of contributing to the growth of society's general knowledge and wellbeing"), and the potential to contribute to existing scientific knowledge.

They also clarify:

"If the research activities under assessment meet all of the factors , they can be presumed to constitute scientific research. If the research activities do not meet all factors, the controller needs to justify and be able to demonstrate why the activities should nonetheless be considered scientific research, within the meaning of the GDPR."

Additionally, they discuss that even private entities can rely on the legal basis of performing a task carried out in the public interest, and scientific research can, in their eyes, be a legitimate interest under Art. 6(f) GDPR. And they also explicitly do not exclude commercial interests from falling well-within the scope of scientific research.

What they suggest needs to be ensured is

• further processing for scientific research purposes that are compatible with the initial purpose(s) of when the data was collected,
• storage limitations or criteria to determine the period of storage must be set before the processing; it may be okay to store the data for longer, even after the conclusion of a research project, if it is needed within peer review or similar things,
• data subjects understanding the consequences of their choice, and having access to information on how their data is processed, for example on a website or a via a newsletter, and where they can withdraw their consent possibly via a privacy dashboard or other offline means,
• reassessment when the circumstances change (purpose change, controller change, third country transfer etc.),
• possible extra involvement of independent data trustees, time-limited consent, independent oversight, ethics committees, and patient groups for participant representation, and
• proper technical safeguards (as usually required by GDPR and other laws anyway).

All these are supposed to "compensate" for the Broad Consent.

These are not the only guidelines out there; the German Datenschutzkonferenz and others have also published their own, and while they tend to differ in some points (especially around what can and cannot be considered scientific research), they largely suggest the same safety standards and patient rights to consider.

☁️☁️☁️

I felt like writing about this for a while now because not many people I ask tend to know about the general movement towards health data sharing and combining of datasets that is increasingly being prepared and legislated, or at least have a broad idea of how consent is handled in these cases. There's a lot I could go more in-depth on, but this is an overview for now.

I am sure the processing of health data digitally as well as the ease of sharing will become more visible in the future as more milestones are hit for the European Health Data Space, and as health insurance providers and healthcare facilities all over the EU make changes in how they offer and organize the digital patient file, digital prescriptions and referrals, opt-ins to data collection or enrollment in studies via app, and so on.

Published 07 Sep, 2026