### where the commission considers that a foreign direct investment is likely to affect security or public order in one or more member states , it may issue an opinion addressed to the member state in which the foreign direct investment is planned or has been completed . the commission may issue an opinion irrespective of whether other member states have provided comments . ### where the commission considers that a foreign direct investment is likely to affect security or public order in one or more member states , it may issue an opinion addressed to the member state maintaining a screening mechanism in which the foreign direct investment is planned . the commission may issue an opinion irrespective of whether other member states have provided comments .


### the commission or a member state which duly considers that a foreign direct investment is likely to affect its security or public order may request from the member state where the foreign direct investment is planned or has been completed , any information necessary to provide comments referred to in paragraph 2 , or to issue the opinion referred to in paragraph 3 . ### the commission or a member state which duly considers that a foreign direct investment is likely to affect its security or public order may request from the member state where the foreign direct investment is planned or has been completed , any information necessary to provide comments referred to in paragraph 2 , or to issue the opinion referred to in paragraph 3 . the european commission or a member state can ask to discuss the issue in the framework of the coordination group .


### cooperation between member states pursuant to this article shall take place through the contact points referred to in article 12 . ### cooperation between member states pursuant to this article shall take place through the contact points referred to in article 12 and to the coordination group as defined in article 12a .


### the opinion of the commission shall be communicated to the other member states . ### the decision of the commission shall be communicated to the member states .


### member states shall ensure that the information requested by the commission and other member states pursuant to articles 8 and 9 is made available to the commission and the requesting member states without undue delay . ### member states shall ensure that the information requested by the commission and other member states or by the coordination group pursuant to articles 8 and 9 is made available to the commission and the requesting member states without undue delay .


### member states and the commission shall ensure the protection of confidential information acquired in application of this regulation . ### member states and the commission shall ensure the highest protection of confidential information acquired in application of this regulation .


### each member state shall appoint a foreign direct investment screening contact point for the screening of foreign direct investment . the commission and other member states shall involve these fdi screening contact points on all issues related to implementation of this regulation . ### each member state shall appoint a foreign direct investment screening contact point for the screening of foreign direct investment . the commission and other member states shall involve these fdi screening contact points and the coordination group on all issues related to implementation of this regulation .


### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. ### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. provided that it complies with conditions of relevant articles of the regulation (eu) 2016/679 , it should also be possible to combine individual’s electronic health data with other types of data , for example consumer behavioural data for research purposes as long as the data is anonymised.


### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector. ### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies shall be granted the level of protection of confidential information mandated by article 39(2) of the trips agreement and the trade secrets directive (2016/943) with the protection of the main ip rights i.e. patents , spcs , utility models , copyright , trademarks , database rights (as per directive 96/9/ec) , design rights , etc.. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector.


### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector. ### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies shall be granted the level protection of confidential information mandated by article 39 of the agreement on trade-related aspects of intellectual property and the trade secrets directive (2016/943). however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector.


### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited. ### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited.


### (42) the establishment of one or more health data access bodies , supporting access to electronic health data in member states , is an essential component for promoting the secondary use of health-related data. member states should therefore establish one or more health data access body , for instance to reflect their constitutional , organisational and administrative structure. however , one of these health data access bodies should be designated as a coordinator in case there are more than one data access body. where a member state establishes several bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one health data access body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other health data access bodies , the ehds board and the commission. health data access bodies may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization) but should have the same functions , responsibilities and capabilities. health data access bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that the health data access body cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each health data access body should be provided with the financial and human resources , premises and infrastructure necessary for the effective performance of its tasks , including those related to cooperation with other health data access bodies throughout the union. each health data access body should have a separate , public annual budget , which may be part of the overall state or national budget. in order to enable better access to health data and complementing article 7(3) of regulation […] of the european parliament and of the council [data governance act com/2020/767 final] , member states should entrust health data access bodies with powers to take decisions on access to and secondary use of health data. this could consist in allocating new tasks to the competent bodies designated by member states under article 7(1) of regulation […] [data governance act com/2020/767 final] or in designating existing or new sectoral bodies responsible for such tasks in relation to access to health data. ### (42) in order to increase the level of data protection and citizens' trust in connection with the secondary use of data , health data processing steps should be divided up among legally distinct entities for (i) the pseudonymisation of health data (‘pseudonymisation bodies’) , (ii) the storage and processing of health data (‘health data access bodies’) and (iii) health data access applications (‘application processing bodies’). member states should therefore establish one or more such bodies in each case , for instance to reflect their constitutional , organisational and administrative structure. however , one of the health data access bodies involved should be designated as a coordinator for union-wide cooperation in case there are more than one data access body. where a member state establishes several such bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other bodies involved in accessing health data , the ehds board and the commission. the bodies involved in accessing health data may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization or private bodies) but should have the same functions , responsibilities and capabilities. application processing bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that application processing bodies cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review. each application processing body should be provided with the necessary financial and human resources , premises and infrastructure , or any private application processing body should be reimbursed the necessary appropriate level of expenditure , for the effective performance of its tasks , including those related to cooperation with other bodies involved in accessing health data throughout the union. all bodies involved in the secondary use of health data should have a separate , public annual budget , which may be part of the overall state or national budget. with regard to application processing bodies , a certification system should be set up to ensure their competence and uniform assessment standards for data use applications.


### (42) the establishment of one or more health data access bodies , supporting access to electronic health data in member states , is an essential component for promoting the secondary use of health-related data. member states should therefore establish one or more health data access body , for instance to reflect their constitutional , organisational and administrative structure. however , one of these health data access bodies should be designated as a coordinator in case there are more than one data access body. where a member state establishes several bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one health data access body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other health data access bodies , the ehds board and the commission. health data access bodies may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization) but should have the same functions , responsibilities and capabilities. health data access bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that the health data access body cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each health data access body should be provided with the financial and human resources , premises and infrastructure necessary for the effective performance of its tasks , including those related to cooperation with other health data access bodies throughout the union. each health data access body should have a separate , public annual budget , which may be part of the overall state or national budget. in order to enable better access to health data and complementing article 7(3) of regulation […] of the european parliament and of the council [data governance act com/2020/767 final] , member states should entrust health data access bodies with powers to take decisions on access to and secondary use of health data. this could consist in allocating new tasks to the competent bodies designated by member states under article 7(1) of regulation […] [data governance act com/2020/767 final] or in designating existing or new sectoral bodies responsible for such tasks in relation to access to health data. ### (42) in order to increase the level of data protection and citizens' trust in connection with the secondary use of data , health data processing steps should be divided up among legally distinct entities , i.e. different bodies for (i) the pseudonymisation of health data (‘pseudonymisation bodies’) , (ii) the storage and processing of health data (‘health data access bodies’) and (iii) health data access applications (‘application processing bodies’). member states should therefore establish one or more such bodies in each case , for instance to reflect their constitutional , organisational and administrative structure. however , one of the bodies involved in health data access should be designated as a coordinator for union-wide cooperation in case there are more than one data access body. where a member state establishes several such bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other bodies involved in health data access , the ehds board and the commission. the bodies involved in health data access may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization or private bodies) but should have the same functions , responsibilities and capabilities. application processing bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that application processing bodies cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each application processing body should be provided with the necessary financial and human resources , premises and infrastructure , and any private application processing body should be reimbursed the necessary appropriate level of expenditure , for the effective performance of its tasks , including those related to cooperation with other bodies involved in health data access throughout the union. all bodies involved in the secondary use of health data should have a separate , public annual budget , which may be part of the overall state or national budget. with regard to application processing bodies , a certification system should be set up to ensure their competence and uniform assessment standards for data use applications.


### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets. ### (43) supervisory bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , supervisory bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. supervisory bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , supervisory bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the application processing body , in concert with the health data access body , should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. together with the pseudonymisation body , they should apply tested techniques that ensure that electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. health data access bodies and pseudonymisation bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets.


### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities. ### (44) considering the administrative burden for health data access bodies , application processing bodies and pseudonymisation bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , bodies involved in accessing health data should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the data holder , if appropriate with the involvement of the application processing body , which , with the involvement of the pseudonymisation body , should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the application processing body or a central website , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each application processing body should publish an annual activity report providing an overview of its activities.


### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities. ### (44) considering the administrative burden for health data access bodies , application processing bodies and pseudonymisation bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , bodies involved in health data access should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the data holder , where appropriate with the involvement of the application processing body , which , with the involvement of the pseudonymisation body , should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the application processing body or a central website , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each application processing body should publish an annual activity report providing an overview of its activities.


### (47) health data access bodies and single data holders should be allowed to charge fees based on the provisions of regulation […] [data governance act com/2020/767 final] in relation to their tasks. such fees may take into account the situation and interest of smes , individual researchers or public bodies. data holders should be allowed to also charge fees for making data available. such fees should reflect the costs for providing such services. private data holders may also charge fees for the collection of data. in order to ensure a harmonised approach concerning fee policies and structure , the commission may adopt implementing acts. provisions in article 10 of the regulation [data act com/2022/68 final] should apply for fees charged under this regulation. ### (47) health data access bodies and single data holders should be allowed to charge fees based on the provisions of regulation […] [data governance act com/2020/767 final] in relation to their tasks. such fees may take into account the situation and interest of smes , individual researchers or public bodies. data holders should be allowed to also charge fees for making data available. such fees should reflect the costs for providing such services but not be significantly higher or unjustified. private data holders may also charge fees for the collection of data. in order to ensure a harmonised approach concerning fee policies and structure , the commission may adopt implementing acts. provisions in article 10 of the regulation [data act com/2022/68 final] should apply for fees charged under this regulation.


### (47) health data access bodies and single data holders should be allowed to charge fees based on the provisions of regulation […] [data governance act com/2020/767 final] in relation to their tasks. such fees may take into account the situation and interest of smes , individual researchers or public bodies. data holders should be allowed to also charge fees for making data available. such fees should reflect the costs for providing such services. private data holders may also charge fees for the collection of data. in order to ensure a harmonised approach concerning fee policies and structure , the commission may adopt implementing acts. provisions in article 10 of the regulation [data act com/2022/68 final] should apply for fees charged under this regulation. ### (47) health data access bodies , pseudonymisation bodies , application processing bodies and single data holders should be allowed to charge fees based on the provisions of regulation […] [data governance act com/2020/767 final] in relation to their tasks. such fees may take into account the situation and interest of smes , individual researchers or public bodies. data holders should be allowed to also charge fees for making data available. such fees should reflect the costs for providing such services. private data holders may also charge fees for the collection of data. in order to ensure a harmonised approach concerning fee policies and structure , the commission may adopt implementing acts. provisions in article 10 of the regulation [data act com/2022/68 final] should apply for fees charged under this regulation.


### (48) in order to strengthen the enforcement of the rules on the secondary use of electronic health data , appropriate measures that can lead to penalties or temporary or definitive exclusions from the ehds framework of the data users or data holders that do not comply with their obligations. the health data access body should be empowered to verify compliance and give data users and holders the opportunity to reply to any findings and to remedy any infringement. the imposition of penalties should be subject to appropriate procedural safeguards in accordance with the general principles of law of the relevant member state , including effective judicial protection and due process. ### (48) in order to strengthen the enforcement of the rules on the secondary use of electronic health data , appropriate measures that can lead to penalties or temporary or definitive exclusions from the ehds framework of the data users or data holders that do not comply with their obligations. supervisory bodies should be empowered to verify compliance and give data users and holders the opportunity to reply to any findings and to remedy any infringement. the imposition of penalties should be subject to appropriate procedural safeguards in accordance with the general principles of law of the relevant member state , including effective judicial protection and due process.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , common standards for data anonymisation will be further developed and the use of anonymised electronic health data without any personal data will be facilitated wherever possible , excluding possibilities for re-use of data that cannot be anonymised or pseudonymised. requests for pseudonymised data shall be duly justified. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data that ensures , to the maximum extent possible , by making use of state-of-the-art technologies , that a person cannot be reidentified , should be made available by the health data access bodies when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the permanent encryption key can only be held by the pseudonymisation body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the application processing bodies , which in turn would request the pseudonymisation body to inform the concerned natural person(s) about this. moreover , via the application processing bodies the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format -e.g data encryption- and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it must clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data must only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users must not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (50) in order to ensure that all health data access bodies issue permits in a similar way , it is necessary to establish a standard common process for the issuance of data permits , with similar requests in different member states. the applicant should provide health data access bodies with several information elements that would help the body evaluate the request and decide if the applicant may receive a data permit for secondary use of data , also ensuring coherence between different health data access bodies. such information include: the legal basis under regulation (eu) 2016/679 to request access to data (exercise of a task in the public interest assigned by law or legitimate interest) , purposes for which the data would be used , description of the needed data and possible data sources , a description of the tools needed to process the data , as well as characteristics of the secure environment that are needed. where data is requested in pseudonymised format , the data applicant should explain why this is necessary and why anonymous data would not suffice. an ethical assessment may be requested based on national law. the health data access bodies and , where relevant data holders , should assist data users in the selection of the suitable datasets or data sources for the intended purpose of secondary use. where the applicant needs anonymised statistical data , it should submit a data request application , requiring the health data access body to provide directly the result. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data application , as well as data request. ### (50) in order to ensure that all application processing bodies responsible for access to health data issue permits in a similar way , it is necessary to establish a standard common process for the issuance of data permits , with similar requests in different member states. the applicant should provide the application processing bodies with several information elements that would help the body evaluate the request and decide if the applicant may receive a data permit for secondary use of data , also ensuring coherence between different application processing bodies. such information include: the legal basis under regulation (eu) 2016/679 to request access to data (exercise of a task in the public interest assigned by law or legitimate interest) , purposes for which the data would be used , description of the needed data and possible data sources , a description of the tools needed to process the data , as well as characteristics of the secure environment that are needed. where data is requested in pseudonymised format , the data applicant should explain why this is necessary and why anonymous data would not suffice. an ethical assessment may be requested based on national law. application processing bodies and , where relevant , data holders should assist data users in the selection of the suitable datasets or data sources for the intended purpose of secondary use. where the applicant needs anonymised statistical data , it should submit a data request application , requiring the application processing body to provide directly the result with the assistance of the access body. in order to ensure a harmonised approach between application processing bodies , the commission should support the harmonisation of data application , as well as data request.


### (50) in order to ensure that all health data access bodies issue permits in a similar way , it is necessary to establish a standard common process for the issuance of data permits , with similar requests in different member states. the applicant should provide health data access bodies with several information elements that would help the body evaluate the request and decide if the applicant may receive a data permit for secondary use of data , also ensuring coherence between different health data access bodies. such information include: the legal basis under regulation (eu) 2016/679 to request access to data (exercise of a task in the public interest assigned by law or legitimate interest) , purposes for which the data would be used , description of the needed data and possible data sources , a description of the tools needed to process the data , as well as characteristics of the secure environment that are needed. where data is requested in pseudonymised format , the data applicant should explain why this is necessary and why anonymous data would not suffice. an ethical assessment may be requested based on national law. the health data access bodies and , where relevant data holders , should assist data users in the selection of the suitable datasets or data sources for the intended purpose of secondary use. where the applicant needs anonymised statistical data , it should submit a data request application , requiring the health data access body to provide directly the result. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data application , as well as data request. ### (50) in order to ensure that all application processing bodies issue permits in a similar way , it is necessary to establish a standard common process for the issuance of data permits , with similar requests in different member states. the applicant should provide the application processing bodies with several information elements that would help the body evaluate the request and decide if the applicant may receive a data permit for secondary use of data , also ensuring coherence between different application processing bodies. such information include: the legal basis under regulation (eu) 2016/679 to request access to data (exercise of a task in the public interest assigned by law or legitimate interest) , purposes for which the data would be used , description of the needed data and possible data sources , a description of the tools needed to process the data , as well as characteristics of the secure environment that are needed. where data is requested in pseudonymised format , the data applicant should explain why this is necessary and why anonymous data would not suffice. an ethical assessment may be requested based on national law. application processing bodies and , where relevant , data holders should assist data users in the selection of the suitable datasets or data sources for the intended purpose of secondary use. where the applicant needs anonymised statistical data , it should submit a data request application , requiring the application processing health data access body to provide directly the result with the help of the access body. in order to ensure a harmonised approach between application processing bodies , the commission should support the harmonisation of data application , as well as data request.


### (51) as the resources of health data access bodies are limited , they can apply prioritisation rules , for instance prioritising public institutions before private entities , but they should not make any discrimination between the national or from organisations from other member states within the same category of priorities. the data user should be able to extend the duration of the data permit in order , for example , to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. this would require an amendment of the data permit and may be subject to an additonal fee. however , in all the cases , the data permit should reflect theses additionals uses of the dataset. preferably , the data user should mention them in their initial request for the issuance of the data permit. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data permit. ### (51) as the resources of health data access bodies are limited , they can apply prioritisation rules but they should not make any discrimination between the national or from organisations from other member states within the same category of priorities. the data user should be able to extend the duration of the data permit in order , for example , to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. this would require an amendment of the data permit and may be subject to an additonal fee. however , in all the cases , the data permit should reflect theses additionals uses of the dataset. preferably , the data user should mention them in their initial request for the issuance of the data permit. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data permit.


### (51) as the resources of health data access bodies are limited , they can apply prioritisation rules , for instance prioritising public institutions before private entities , but they should not make any discrimination between the national or from organisations from other member states within the same category of priorities. the data user should be able to extend the duration of the data permit in order , for example , to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. this would require an amendment of the data permit and may be subject to an additonal fee. however , in all the cases , the data permit should reflect theses additionals uses of the dataset. preferably , the data user should mention them in their initial request for the issuance of the data permit. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data permit. ### (51) as the resources of application processing bodies are limited , they can apply prioritisation rules , for instance prioritising research projects on specific diseases , but they should not make any discrimination between the national or from organisations from other member states within the same category of priorities. the data user should be able to extend the duration of the data permit in order , for example , to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. this would require an amendment of the data permit and may be subject to an additonal fee. however , in all the cases , the data permit should reflect theses additionals uses of the dataset. preferably , the data user should mention them in their initial request for the issuance of the data permit. in order to ensure a harmonised approach between bodies , the commission should support the harmonisation of data permit.


### (51) as the resources of health data access bodies are limited , they can apply prioritisation rules , for instance prioritising public institutions before private entities , but they should not make any discrimination between the national or from organisations from other member states within the same category of priorities. the data user should be able to extend the duration of the data permit in order , for example , to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. this would require an amendment of the data permit and may be subject to an additonal fee. however , in all the cases , the data permit should reflect theses additionals uses of the dataset. preferably , the data user should mention them in their initial request for the issuance of the data permit. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data permit. ### (51) as the resources of application processing bodies are limited , they can apply prioritisation rules , for instance prioritising research projects on specific diseases , but they should not make any discrimination between the national or from organisations from other member states within the same category of priorities. the data user should be able to extend the duration of the data permit in order , for example , to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. this would require an amendment of the data permit and may be subject to an additional fee. however , in all the cases , the data permit should reflect theses additionals uses of the dataset. preferably , the data user should mention them in their initial request for the issuance of the data permit. in order to ensure a harmonised approach between bodies , the commission should support the harmonisation of data permit.


### (53) for requests to access electronic health data from a single data holder in a single member state and in order to alieviate the administrative burden for heath data access bodies of managing such request , the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide. ### (53) access to health data should be arranged directly between the data holder and the data user. in this case , in principle , only the application processing body is involved in making electronic health data available and the data holder takes over the operational tasks of the pseudonymisation and access body if the data holder can make that possible. however , the pseudonymisation body may involve the data holder. should a secure processing environment not be available to the data user for making the data available , access should be provided via the relevant health data access body.


### (53) for requests to access electronic health data from a single data holder in a single member state and in order to alieviate the administrative burden for heath data access bodies of managing such request , the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide. ### (53) access to health data should be arranged directly between the data holder and the data user. in this case , in principle , only the application processing body is involved in making electronic health data available and the data holder takes over the operational tasks of the pseudonymisation and access body if the data holder can make that possible. however , the pseudonymisation body may be consulted by the data holder. should a secure processing environment not be available to the data user for making the data available , access should be provided via the relevant health data access body.


### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body or , where relevant , single data holder should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments. ### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body or , where relevant , single data holder should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. the requirements for secure processing environments and their development should strike an appropriate balance between security and functionality , taking into account technical feasibility and building on existing best practices. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments.


### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services.the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces.for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51. ### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950 or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51.


### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51. ### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border and interconnected infrastructure should be established. sharing a federated cloud represents a good basis. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51.