### the purpose of this directive is to enable qualified entities , which represent the collective interest of consumers , to seek remedy through representative actions against infringements of provisions of union law . the qualified entities should be able to ask for stopping or prohibiting an infringement , for confirming that an infringement took place and to seek redress , such as compensation , repair or price reduction as available under national laws . ### the purpose of this directive is to enable qualified entities , which represent a collective interest , to seek remedy through representative actions against infringements of provisions of union law . the qualified entities should be able to ask for stopping or prohibiting an infringement , for confirming that an infringement took place and to seek redress as available under national laws , such as compensation , repair or price reduction in case of consumers , compensation or reinstatement after unlawful dismissals in case of workers , or compensation or repair of the damage causes in case of environmental damage or violation of fundamental rights .


### directive 2009 / 22 / ec of the european parliament and of the council29 enabled qualified entities to bring representative actions primarily aimed at stopping and prohibiting infringements of union law harmful to the collective interests of consumers . however , that directive did not sufficiently address the challenges for the enforcement of consumer law . to improve the deterrence of unlawful practices and to reduce consumer detriment , it is necessary to strengthen the mechanism for protection of collective interests of consumers . given the numerous changes , for the sake of clarity it is appropriate to replace directive 2009 / 22 / ec . _________________ 29 oj l 110 / 30 , 1 . 5 . 2009 . ### directive 2009 / 22 / ec of the european parliament and of the council29 enabled qualified entities to bring representative actions primarily aimed at stopping and prohibiting infringements of union law harmful to the collective interests of consumers . however , that directive did not sufficiently address the challenges for the enforcement of consumer law . to improve the deterrence of all unlawful practices by traders and to reduce detriment , it is necessary to strengthen the mechanism for protection of collective interests of all individuals . given the numerous changes , for the sake of clarity it is appropriate to replace directive 2009 / 22 / ec . _________________ 29 oj l 110 / 30 , 1 . 5 . 2009 .


### a representative action should offer an effective and efficient way of protecting the collective interests of consumers . it should allow qualified entities to act with the aim of ensuring compliance with relevant provisions of union law and to overcome the obstacles faced by consumers within individual actions , such as the uncertainty about their rights and available procedural mechanisms , psychological reluctance to take action and the negative balance of the expected costs and benefits of the individual action . ### a representative action should offer an effective and efficient way of protecting the collective interests and public interests , including inter alia the following grounds : data protection , privacy and confidentiality of communications , public security , public safety , public health , preserving social security systems , the protection of consumers , recipients of services and workers , fairness of trade transactions , combating fraud , the protection of the environment and animal health , the conservation of the national and artistic heritage , social and cultural policy objectives . it should allow qualified entities to act with the aim of ensuring compliance with relevant provisions of union law and to overcome the obstacles faced by people within individual actions , such as the uncertainty about their rights and available procedural mechanisms , psychological reluctance to take action and the negative balance of the expected costs and benefits of the individual action .


### this directive should cover a variety of areas such as data protection , financial services , travel and tourism , energy , telecommunications and environment . it should cover infringements of provisions of union law which protect the interests of consumers , regardless of whether they are referred to as consumers or as travellers , users , customers , retail investors , retail clients or other in the relevant union law . to ensure adequate response to infringement to union law , the form and scale of which is quickly evolving , it should be considered , each time where a new union act relevant for the protection of the collective interests of consumers is adopted , whether to amend the annex to the present directive in order to place it under its scope . ### this directive should cover a variety of areas such as data protection , non - discrimination , the protection of workers’ rights , the protection of the environment , health , competition , consumer protection including regarding financial services , travel and tourism , energy and telecommunications . it should cover infringements of provisions of union law including the charter of fundamental rights , which protect the interests of individuals , regardless of the capacity in which they are referred to in the relevant union law . to ensure adequate response to infringement to union law , the form and scale of which is quickly evolving , it should be considered , each time where a new union act relevant for the protection of the collective interests of individuals is adopted , whether to amend the annex to the present directive in order to place it under its scope .


### qualified entities should be able to seek measures aimed at eliminating the continuing effects of the infringement . these measures should take the form of a redress order obligating the trader to provide for , inter alia , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid , as appropriate and as available under national laws . ### qualified entities should be able to seek measures aimed at eliminating the continuing effects of the infringement . these measures should take the form of a redress order for a material or non - material damage obligating the trader to provide for , inter alia , in case of consumers , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid , in case of workers , compensation or reinstatement after unlawful dismissals , or in case of environmental damage or violation of fundamental rights , compensation or repair of the damage causes , as appropriate and as available under national laws .


### this directive provides for a procedural mechanism , which does not affect the rules establishing substantive rights of consumers to contractual and non - contractual remedies in case their interests have been harmed by an infringement , such as the right to compensation for damages , contract termination , reimbursement , replacement , repair or price reduction . a representative action seeking redress under this directive can only be brought where union or national law provides for such substantive rights . ### this directive provides for a procedural mechanism , which does not affect the rules establishing substantive rights to contractual and non - contractual remedies in case their interests have been harmed by an infringement , such as , in case of consumers , the right to compensation for damages , contract termination , reimbursement , replacement , repair or price reduction , in case of workers , compensation or reinstatement after unlawful dismissals , or in case of environmental damage or violation of fundamental rights , compensation or repair of the damage causes . a representative action seeking redress under this directive can only be brought where union or national law provides for such substantive rights .


### any out - of - court settlement reached within the context of a representative action or based on a final declaratory decision should be approved by the relevant court or the administrative authority to ensure its legality and fairness , taking into consideration the interests and rights of all parties concerned . individual consumers concerned shall be given the possibility to accept or to refuse to be bound by such a settlement . ### any out - of - court settlement reached within the context of a representative action should be approved by the relevant court or the administrative authority to ensure its legality and fairness , taking into consideration the interests and rights of all parties concerned . individual consumers concerned shall be given the possibility to accept or to refuse to be bound by such a settlement .


### to be effective , the information should be adequate and proportional to the circumstances of the case . the infringing trader should adequately inform all consumers concerned of a final injunction and redress orders issued within the representative action as well as of a settlement approved by a court or administrative authority . such information may be provided for instance on the trader ' s website , social media , online market places , or in popular newspapers , including those distributed exclusively by electronic means of communication . if possible , consumers should be informed individually through electronic or paper letters . this information should be provided in accessible formats for persons with disabilities upon request . ### to be effective , the information should be accessible , adequate and proportional to the circumstances of the case . the infringing trader should adequately inform all individuals concerned as well as the general public of a final injunction and redress orders issued within the representative action as well as of a settlement approved by a court or administrative authority . such information may be provided for instance on the trader ' s website , social media , online market places , or in popular newspapers , including those distributed exclusively by electronic means of communication . if possible , the individuals concerned should be informed individually through electronic or paper letters . this information should be provided in accessible formats for persons with disabilities .


### actions for redress based on the establishment of an infringement by a final injunction order or by a final declaratory decision regarding the liability of the trader towards the harmed consumers under this directive should not be hindered by national rules on limitation periods . the submission of a representative action shall have the effect of suspending or interrupting the limitation periods for any redress actions for the consumers concerned by this action . ### actions for redress based on the establishment of an infringement by a final injunction order regarding the liability of the trader towards the harmed individuals under this directive should not be hindered by national rules on limitation periods . the submission of a representative action shall have the effect of suspending or interrupting the limitation periods for any redress actions for the individuals concerned by this action .


### having regard to the fact that representative actions pursue a public interest by protecting the collective interests of consumers , member states should ensure that qualified entities are not prevented from bringing representative actions under this directive because of the costs involved with the procedures . ### having regard to the fact that representative actions pursue a public interest by protecting collective interests , member states should ensure that qualified entities are not prevented from bringing representative actions under this directive because of the costs involved with the procedures .


### member states shall ensure that in particular consumer organisations and independent public bodies are eligible for the status of qualified entity . member states may designate as qualified entities consumer organisations that represent members from more than one member state . ### member states shall ensure that established or ad - hoc organisations defending a public interest , in particular consumer organisations , environmental organisations , human rights and equality organisations and trade unions , and , where applicable , independent public bodies are eligible for the status of qualified entity . member states may designate as qualified entities organisations that represent individuals from more than one member state .


### for the purposes of article 5 , member states shall ensure that qualified entities are entitled to bring representative actions seeking a redress order , which obligates the trader to provide for , inter alia , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid , as appropriate . a member state may require the mandate of the individual consumers concerned before a declaratory decision is made or a redress order is issued . ### for the purposes of article 5 , member states shall ensure that qualified entities are entitled to bring representative actions seeking a redress order for material or non - material damage , which obligates the trader to provide for , as appropriate , inter alia , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid in case of consumers , compensation or reinstatement after unlawful dismissals in case of workers , or compensation or repair of the damage causes in case of environmental damage or violation of fundamental rights .


### the redress obtained through a final decision in accordance with paragraphs 1 , 2 and 3 shall be without prejudice to any additional rights to redress that the consumers concerned may have under union or national law . ### the redress obtained through a final redress order shall be without prejudice to any additional rights to redress that the individuals concerned may have under union or national law .


### member states may provide that a qualified entity and a trader who have reached a settlement regarding redress for consumers affected by an allegedly illegal practice of that trader can jointly request a court or administrative authority to approve it . such a request should be admitted by the court or administrative authority only if there is no other ongoing representative action in front of the court or administrative authority of the same member state regarding the same trader and regarding the same practice . ### member states may provide that a qualified entity and a trader who have reached a settlement regarding redress for individuals affected by an allegedly illegal practice of that trader can jointly request a court or administrative authority to approve it . such a request should be admitted by the court or administrative authority only if there is no other ongoing representative action in front of the court or administrative authority of the same member state regarding the same trader , regarding the same practice and the same individuals concerned .


### the commission may screen foreign direct investments that are likely to affect projects or programmes of union interest on the grounds of security or public order . ### the commission may screen foreign direct investments that are likely to affect programmes or projects of union interest on the grounds of security or public order .


### where the commission considers that a foreign direct investment is likely to affect security or public order in one or more member states , it may issue an opinion addressed to the member state in which the foreign direct investment is planned or has been completed . the commission may issue an opinion irrespective of whether other member states have provided comments . ### where the commission considers that a foreign direct investment is likely to affect security or public order in one or more member states , it may issue an opinion addressed to the member state in which the foreign direct investment is planned . the commission may issue an opinion irrespective of whether other member states have provided any comments .


### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. ### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , aggregated genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and healthcare professionals to use those data for different purposes , including research , development , policy-making , regulatory purposes and patient safety. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders , except for micro enterprises and small enterprises in the context of healthcare professionals’ practices and pharmacies , should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. likewise , beneficiaries should respect the principle of open science and provide open access to research or processing results.


### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices , wellness applications or other wearables and digital health applications. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other. ### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as non-personal data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices. the data user who benefits from access to datasets provided under this regulation pursuant to a data permit could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other.


### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector. ### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. as such , they are controllers in the meaning of regulation (eu) 2016/679 in the health or care sector since they process personal electronic health data. in order to avoid a disproportionate burden on small entities , micro-enterprises and small enterprises in healthcare professional setting are excluded from the obligation to make their data available for secondary use in the framework of ehds. it should be noted that making anonymised data available for secondary use will require additional resources for healthcare systems , including often understaffed public hospitals. this additional burden for public entities should be addressed and minimised to the greatest possible extent during the implementation phase of the ehds and , where necessary , allocation of additional resources should be ensured. to safeguard the long-term sustainability and durability of european healthcare systems and the provision of public goods across the union , sufficient and adequate return to public investment in the field of health must be ensured via adequate societal access to access products and services developed via the ehds framework on a just , fair , transparent , and redistributive basis that can contribute to greater social justice. the public good nature of european healthcare systems and equality of access need to be safeguarded by demonstrating the public value stemming from private investments via the ehds framework and by enhancing the role of public institutions in the field. likewise , when electronic health data is made available for secondary use , research and processing results should be made publicly available based on the principles of open science so that society at large can access relevant results in the field , enhance transparency , and further contribute to new innovative products and services that can benefit society at large. data generated by individuals and shared through the ehds must be considered a public investment. uses that are detrimental to individuals , in particular to vulnerable groups , should be prohibited and subject to aggravated penalties. in light of possible future risks , a moratorium on certain uses and users should be made possible.


### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited. ### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research and development , policy making , patient safety or regulatory activities in line with the purposes set out in this regulation. access to data for secondary use should be based on the data subject's explicit consent in the case of personal data and contribute to the general interest of the society as well as to high quality , accessibility and affordability of medical products. without the data subject’s consent , any health data may only be made accessible after it has been fully and irreversibly anonymised by the data holder , where necessary by aggregating the health data of several persons. real world evidence collected through the ehds should in no way substitute data generated in clinical trials , which remain a gold standard in terms of data generation for regulatory purposes. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies which are necessary to meet a substantial public interest , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remains at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , related to health or care sectors for the prevention , early detection , diagnosis , treatment , rehabilitation , supportive care or healthcare management. it should also contribute to development activities aimed at producing goods and services for the health or care sectors. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , to profile and discriminate against individuals , or develop harmful products should be prohibited.


### (42) the establishment of one or more health data access bodies , supporting access to electronic health data in member states , is an essential component for promoting the secondary use of health-related data. member states should therefore establish one or more health data access body , for instance to reflect their constitutional , organisational and administrative structure. however , one of these health data access bodies should be designated as a coordinator in case there are more than one data access body. where a member state establishes several bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one health data access body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other health data access bodies , the ehds board and the commission. health data access bodies may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization) but should have the same functions , responsibilities and capabilities. health data access bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that the health data access body cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each health data access body should be provided with the financial and human resources , premises and infrastructure necessary for the effective performance of its tasks , including those related to cooperation with other health data access bodies throughout the union. each health data access body should have a separate , public annual budget , which may be part of the overall state or national budget. in order to enable better access to health data and complementing article 7(3) of regulation […] of the european parliament and of the council [data governance act com/2020/767 final] , member states should entrust health data access bodies with powers to take decisions on access to and secondary use of health data. this could consist in allocating new tasks to the competent bodies designated by member states under article 7(1) of regulation […] [data governance act com/2020/767 final] or in designating existing or new sectoral bodies responsible for such tasks in relation to access to health data. ### (42) the establishment of one or more health data access bodies , supporting access to electronic health data in member states , is an essential component for promoting the secondary use of health-related data. member states should therefore establish one or more health data access body , for instance to reflect their constitutional , organisational and administrative structure. however , one of these health data access bodies should be designated as a coordinator in case there are more than one data access body. likewise , despite member states’ constitutional , organisational and administrative specificities , health data access bodies should at least consist of authorization bodies to decide on the validity of data access applications and data requests , and of trust bodies that receive the electronic health data from data holders and disclose it to authorisation bodies. where a member state establishes several bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one health data access body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other health data access bodies , the ehds board and the commission. health data access bodies may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization) but should have the same functions , responsibilities and capabilities. health data access bodies should not be influenced in their decisions on access to electronic data for secondary use and their staff should not have any conflict of interest that is prejudicial to their independence and impartial conduct. however , their independence should not mean that the health data access body cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each health data access body should be provided with the financial and human resources , legal and technical expertise , including ethical boards and committees premises and infrastructure necessary for the effective performance of its tasks , including those related to cooperation with other health data access bodies throughout the union. each health data access body should have a separate , public annual budget , which may be part of the overall state or national budget. in order to enable better access to health data and complementing article 7(3) of regulation […] of the european parliament and of the council [data governance act com/2020/767 final] , member states should entrust health data access bodies with powers to take decisions on access to and secondary use of health data. this could consist in allocating new tasks to the competent bodies designated by member states under article 7(1) of regulation […] [data governance act com/2020/767 final] or in designating existing or new sectoral bodies responsible for such tasks in relation to access to health data.


### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets. ### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. the selection procedure for health stakeholders should be transparent , public , and free of any conflict of interest. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should duly and expeditiously inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets.


### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities. ### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned , while fully respecting the principles of medical confidentiality and professional secrecy. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities.


### (47) health data access bodies and single data holders should be allowed to charge fees based on the provisions of regulation […] [data governance act com/2020/767 final] in relation to their tasks. such fees may take into account the situation and interest of smes , individual researchers or public bodies. data holders should be allowed to also charge fees for making data available. such fees should reflect the costs for providing such services. private data holders may also charge fees for the collection of data. in order to ensure a harmonised approach concerning fee policies and structure , the commission may adopt implementing acts. provisions in article 10 of the regulation [data act com/2022/68 final] should apply for fees charged under this regulation. ### (47) health data access bodies should be allowed to charge fees based on the provisions of regulation […] [data governance act com/2020/767 final] in relation to their tasks. such fees may take into account the situation and interest of smes , individual researchers or public bodies. data holders should be allowed to also charge fees for making data available. such fees should reflect the costs for providing such services. private data holders may also charge fees for the collection of data. in order to ensure a harmonised approach concerning fee policies and structure , the commission may adopt delegated acts. provisions in article 10 of the regulation [data act com/2022/68 final] should apply for fees charged under this regulation.


### (48) in order to strengthen the enforcement of the rules on the secondary use of electronic health data , appropriate measures that can lead to penalties or temporary or definitive exclusions from the ehds framework of the data users or data holders that do not comply with their obligations. the health data access body should be empowered to verify compliance and give data users and holders the opportunity to reply to any findings and to remedy any infringement. the imposition of penalties should be subject to appropriate procedural safeguards in accordance with the general principles of law of the relevant member state , including effective judicial protection and due process. ### (48) in order to strengthen the enforcement of the rules on the secondary use of electronic health data , appropriate measures that can lead to penalties or temporary or definitive exclusions from the ehds framework of the data users or data holders that do not comply with their obligations. the health data access body should be empowered to verify compliance and give data users and holders the opportunity to reply to any findings and to remedy any infringement. when deciding on the amount of the penalty for each individual case , member states should take into account the margins and criteria set out in this regulation.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when the purpose of processing by the data user can be achieved with such data and the data subject has not given explicit consent for the secondary use of his/her personal data. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. to this end , the commission can adopt implementing acts to identify the procedures and requirements for a unified and irreversible procedure for anonymising and pseudonymising electronic health data. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (50) in order to ensure that all health data access bodies issue permits in a similar way , it is necessary to establish a standard common process for the issuance of data permits , with similar requests in different member states. the applicant should provide health data access bodies with several information elements that would help the body evaluate the request and decide if the applicant may receive a data permit for secondary use of data , also ensuring coherence between different health data access bodies. such information include: the legal basis under regulation (eu) 2016/679 to request access to data (exercise of a task in the public interest assigned by law or legitimate interest) , purposes for which the data would be used , description of the needed data and possible data sources , a description of the tools needed to process the data , as well as characteristics of the secure environment that are needed. where data is requested in pseudonymised format , the data applicant should explain why this is necessary and why anonymous data would not suffice. an ethical assessment may be requested based on national law. the health data access bodies and , where relevant data holders , should assist data users in the selection of the suitable datasets or data sources for the intended purpose of secondary use. where the applicant needs anonymised statistical data , it should submit a data request application , requiring the health data access body to provide directly the result. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data application , as well as data request. ### (50) in order to ensure that all health data access bodies issue permits in a similar way , it is necessary to establish a standard common process for the issuance of data permits , with similar requests in different member states. the applicant should provide health data access bodies with several information elements that would help the body evaluate the request and decide if the applicant may receive a data permit for secondary use of data , also ensuring coherence between different health data access bodies. such information include: a description of the applicant’s identity , professional function , and operation , the legal basis under regulation (eu) 2016/679 to request access to data (exercise of a task in the public interest assigned by law or legitimate interest) , purposes for which the data would be used , description of the needed data and possible data sources , a description of the tools needed to process the data , as well as characteristics of the free and open source tools and computing resources that are needed for the secure environment. where data is requested in pseudonymised format , the data applicant should explain why this is necessary and why anonymous data would not suffice. an ethical assessment may be requested based on national law. the health data access bodies and , where relevant data holders , should assist data users in the selection of the suitable datasets or data sources for the intended purpose of secondary use. where the applicant needs anonymised statistical data , it should submit a data request application , requiring the health data access body to provide directly the result. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data application , as well as data request.


### (51) as the resources of health data access bodies are limited , they can apply prioritisation rules , for instance prioritising public institutions before private entities , but they should not make any discrimination between the national or from organisations from other member states within the same category of priorities. the data user should be able to extend the duration of the data permit in order , for example , to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. this would require an amendment of the data permit and may be subject to an additonal fee. however , in all the cases , the data permit should reflect theses additionals uses of the dataset. preferably , the data user should mention them in their initial request for the issuance of the data permit. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data permit. ### (51) as the resources of health data access bodies are limited , they can apply prioritisation rules , for instance prioritising public institutions before private entities , but they should not make any discrimination between the national or from organisations from other member states within the same category of priorities. the data user should be able to extend the duration of the data permit by a maximum period of two additional months in order , for example , to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. this would require an amendment of the data permit and may be subject to an additonal fee. however , in all the cases , the data permit should reflect theses additionals uses of the dataset. preferably , the data user should mention them in their initial request for the issuance of the data permit. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data permit.


### (52) as the covid-19 crisis has shown , the union institutions , bodies , offices and agencies , especially the commission , need access to health data for a longer period and on a recurring basis. this is may be the case not only in specific circumstances in times of crisis but also to provide scientific evidence and technical support for union policies on a regular basis. access to such data may be required in specific member states or throughout the whole territory of the union. ### (52) as the covid-19 crisis has shown , the union institutions , bodies , offices and agencies , especially the commission , need access to health data for a longer period and on a recurring basis. this may be the case for specific circumstances stipulated by union or member states law in times of crisis and to provide scientific evidence and technical support for union policies on a regular basis. access to such data may be required in specific member states or throughout the whole territory of the union.


### (53) for requests to access electronic health data from a single data holder in a single member state and in order to alieviate the administrative burden for heath data access bodies of managing such request , the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide. ### deleted


### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body or , where relevant , single data holder should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments. ### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment based on free and open-source software. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body or , where relevant , single data holder should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments.


### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51. ### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. however , the use of such a template shall not relieve health data access bodies or the data users from any of their duties and responsibilities. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51.


### (63) the use of funds should also contribute to attaining the objectives of the ehds. public procurers , national competent authorities in the member states , including digital health authorities and health data access bodies , as well as the commission should make references to applicable technical specifications , standards and profiles on interoperability , security and data quality , as well as other requirements developed under this regulation when defining the conditions for public procurement , calls for proposals and allocation of union funds , including structural and cohesion funds. ### (63) the use of funds should also contribute to attaining the objectives of the ehds. public procurers , national competent authorities in the member states , including digital health authorities and health data access bodies , as well as the commission should make references to applicable technical specifications , standards and profiles on interoperability , security and data quality , as well as other requirements developed under this regulation when defining the conditions for public procurement , calls for proposals and allocation of union funds , including structural and cohesion funds. to procure or fund services provided by controllers and processors established in the union that process personal electronic health data , they are required to demonstrate that they will store the data in the union and that they are not subject to third country legislation that conflicts with union data protection rules.


### (64) certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal , as already specifically foreseen in the data governance act. even in situations of the use of state of the art anonymization techniques , there remains a residual risk that the capacity to re-identify could be or become available , beyond the means reasonably likely to be used. such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the union) , where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. it can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects , the number of people affected or and for instance in cases of data included in electronic health records , disease registries , biobanks , person generated data etc. where the identification characteristics are broader and where , in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation , can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. the realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this regulation at risk. furthermore , aggregation techniques are less tested for non-personal data containing for example trade secrets , as in the reporting on clinical trials , and enforcement of breaches of trade secrets outside the union is more difficult in the absence of a sufficient international protection standard. therefore , for these types of health data , there remains a risk for re-identification after the anonymisation or aggregation , which could not be reasonably mitigated initially. this falls within the criteria indicated in article 5(13) of regulation […] [data governance act com/2020/767 final]. these types of health data would thus fall within the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final] for transfer to third countries. the protective measures , proportional to the risk of re-identification , would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### (64) certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal , as already specifically foreseen in the data governance act. even in situations of the use of state of the art anonymization techniques , there remains a residual risk that the capacity to re-identify could be or become available , beyond the means reasonably likely to be used. such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the union) , where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. it can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects , the number of people affected or and for instance in cases of data included in electronic health records , disease registries , biobanks , person generated data etc. where the identification characteristics are broader and where , in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation , can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. the realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this regulation at risk. furthermore , aggregation techniques are less tested for non-personal data containing for example trade secrets , as in the reporting on clinical trials , and enforcement of breaches of trade secrets outside the union is more difficult in the absence of a sufficient international protection standard. therefore , for these types of health data , there remains a risk for re-identification after the anonymisation or aggregation , which could not be reasonably mitigated initially. this falls within the criteria indicated in article 5(13) of regulation […] [data governance act com/2020/767 final]. these types of health data would thus fall within the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final] for transfer to third countries. the protective measures , proportional to the risk of re-identification , would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. in case of mixed datasets , where personal and non-personal data are inextricably linked , the protections in eu data protection legislation and in this regulation concerning personal electronic health data shall be fully applicable.


### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act]. ### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient , independent , and public interest driven working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act].


### (70) member states should take all necessary measures to ensure that the provisions of this regulation are implemented , including by laying down effective , proportionate and dissuasive penalties for their infringement. for certain specific infringements , member states should take into account the margins and criteria set out in this regulation. ### (70) member states should take all necessary measures to ensure that the provisions of this regulation are implemented , including by laying down effective , proportionate and dissuasive penalties for their infringement. when deciding on the amount of the penalty for each individual case , member states should take into account the margins and criteria set out in this regulation.


### 1. any natural or legal person may submit a data request for the purposes referred to in article 34. a health data access body shall only provide an answer to a data request in an anonymised statistical format and the data user shall have no access to the electronic health data used to provide this answer. ### 1. any entity active in the area of health care , public health , or scientific or medical research may submit a data request for the purposes referred to in article 34. a health data access body shall only provide an answer to a data request in an anonymised statistical format and the data user shall have no access to the electronic health data used to provide this answer.


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### the requirement for a data permit shall be without prejudice to the right to access the electronic health data of public sector bodies and union institutions , bodies , offices and agencies that carry out relevant activities within their mandate pursuant to union or member state law , where this mandate provides for such data access under this regulation. by derogation from article 46 of this regulation , the data permit for public authorities may allow for data access for unlimited periods and for the possibility for periodic updates of data under a single data access application. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe that shall not be longer than 2 additional months. accelerated timelines shall be established in exceptional circumstances , including public health emergencies.


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### by derogation from article 46 of this regulation , a data permit shall not be required in the case of justified requests for access to the electronic health data under this article by public sector bodies and union institutions , bodies , offices and agencies that carry relevant activities under this regulation. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe that cannot be longer than 2 additional months.


### article 49 ### deleted


### minimise the risk of the unauthorised reading , copying , modification or removal of electronic health data hosted in the secure processing environment through state-of-the-art technological means; ### minimise the risk of the unauthorised reading , copying , modification or removal of electronic health data hosted in the secure processing environment through state-of-the-art technical and organisational measures;


### keep identifiable logs of access to the secure processing environment for the period of time necessary to verify and audit all processing operations in that environment; ### keep identifiable logs of access to the secure processing environment for the period of time necessary to verify and audit all processing operations in that environment and not shorter than one year;


### 2. the health data access bodies shall ensure that electronic health data can be uploaded by data holders and can be accessed by the data user in a secure processing environment. the data users shall only be able to download non-personal electronic health data from the secure processing environment. ### 2. the health data access bodies shall ensure that electronic health data can be uploaded by data holders and can be accessed by the data user in a secure processing environment. the data users shall only be able to download or copy non-personal electronic health data from the secure processing environment.


### 4. the commission shall , by means of implementing acts , provide for the technical , information security and interoperability requirements for the secure processing environments. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 4. the commission shall , by means of implementing acts , provide for the technical , organisational , information security and interoperability requirements for the secure processing environments. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2).


### 2. the commission shall , by means of implementing acts , establish a template for the joint controllers’ arrangement. those implementing acts shall be adopted in accordance with the advisory procedure set out in article 68(2). ### 2. the commission shall , by means of implementing acts , establish a template for the joint controllers’ arrangement that meets the requirements laid down in article 28(3) of regulation (eu) 2016/679. those implementing acts shall be adopted in accordance with the advisory procedure set out in article 68(2). the use of that template shall not relieve the health data access bodies or the data users from any of their duties and responsibilities.


### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available. ### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available. this paragraph is without prejudice to the requirements and safeguards for international transfer of personal data pursuant to chapter v of regulation (eu) 2016/679.


### 9. the commission shall develop , deploy and operate a core platform for healthdata@eu by providing information technology services needed to facilitate the connection between health data access bodies as part of the cross-border infrastructure for the secondary use of electronic health data. the commission shall only process electronic health data on behalf of the joint controllers as a processor. ### 9. the commission shall develop , deploy and operate a core platform for healthdata@eu by providing information technology services needed to facilitate the connection between health data access bodies as part of the cross-border infrastructure for the secondary use of electronic health data.


### 10. where requested by two or more health data access bodies , the commission may provide a secure processing environment for data from more than one member state compliant with the requirements of article 50. where two or more health data access bodies put electronic health data in the secure processing environment managed by the commission , they shall be joint controllers and the commission shall be processor. ### deleted


### 11. the authorised participants shall act as joint controllers of the processing operations in which they are involved carried out in healthdata@eu and the commission shall act as a processor. ### deleted


### 12. member states and the commission shall seek to ensure interoperability of healthdata@eu with other relevant common european data spaces as referred to in regulations […] [data governance act com/2020/767 final] and […] [data act com/2022/68 final]. ### deleted


### the commission may , by means of implementing acts , set out: ### the commission may , by means of delegated acts , set out:


### requirements , technical specifications , the it architecture of healthdata@eu , conditions and compliance checks for authorised participants to join and remain connected to healthdata@eu and conditions for temporary or definitive exclusion from healthdata@eu; ### requirements , technical specifications , the it architecture of healthdata@eu , which shall guarantee a high level of data security , confidentiality and protection of electronic data pursuant to the state-of-the-art;


### the responsibilities of the joint controllers and processor(s) participating in the cross-border infrastructures; ### deleted


### the responsibilities of the joint controllers and processor(s) for the secure environment managed by the commission; ### deleted


### common specifications for the interoperability and architecture concerning healthdata@eu with other common european data spaces. ### deleted


### those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### those delegated acts shall be adopted in accordance with the procedure referred to in article 67.


### 3. the commission may , by means of implementing acts , adopt the necessary rules for facilitating the handling of data access applications for healthdata@eu , including a common application form , a common data permit template , standard forms for common electronic health data access contractual arrangements , and common procedures for handling cross-border requests , pursuant to articles 45 , 46 , 47 and 48. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 3. the commission may , by means of delegated acts , adopt the necessary rules for facilitating the handling of data access applications for healthdata@eu , including a common application form , a common data permit template , standard forms for common electronic health data access contractual arrangements , and common procedures for handling cross-border requests , pursuant to articles 45 , 46 , 47 and 48. those delegated acts shall be adopted in accordance with the procedure referred to in article 67.


### 2. the commission shall , by means of implementing acts , set out the minimum information elements data holders are to provide for datasets and their characteristics. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 2. the commission shall , by means of delegated acts , set out the minimum information elements data holders are to provide for datasets and their characteristics. those delegated acts shall be adopted in accordance with the procedure referred to in article 67.


### the commission shall support sharing of best practices and expertise , aimed to build the capacity of member states to strengthen digital health systems for primary and secondary use of electronic health data. to support capacity building , the commission shall draw up benchmarking guidelines for the primary and secondary use of electronic health data. ### the commission shall support sharing of best practices and expertise , aimed to build the capacity of member states to strengthen digital health literacy and systems for primary and secondary use of electronic health data. to support capacity building , the commission shall draw up benchmarking guidelines for the primary and secondary use of electronic health data.


### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. ### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final].