### setting minimum targets for clean vehicle procurement by 2025 and by 2030 at member state level should contribute to policy certainty for markets where investments in low - and zero - emission mobility are warranted . the minimum targets support market creation throughout the union . they provide time for the adjustment of public procurement processes and give a clear market signal . the impact assessment notes that member states increasingly set targets , depending on their economic capacity and how serious the problem is . different targets should be set for different member states in accordance with their economic capacity and exposure to pollution . minimum procurement targets should be complemented by the obligation of the contracting authorities , entities and operators to consider relevant energy and environmental aspects in all their procurement procedures . the territorial impact assessment of this amended directive illustrated that the impact will be evenly distributed among regions in the union . ### setting minimum targets for clean vehicle procurement to be achieved by 2025 and by 2030 is key for ensuring policy certainty for markets where investments in low - and zero - emission mobility are warranted . the minimum targets support market development throughout the union . they provide time for the adjustment of public procurement processes and give a clear market signal , while at the same time helping to provide a good example for the public . the impact assessment notes that member states increasingly set targets , depending on their economic capacity and how serious the problem is . member states are , however encouraged to apply more ambitious targets in accordance with their economic performance and exposure to pollution . considering that these parameters are often not uniform within a member state , an assessment of their reliability will be necessary so that the methodology can eventually be complemented . minimum procurement targets should be complemented by the obligation of the contracting authorities , entities and operators to consider relevant energy and environmental aspects in all their procurement procedures . the territorial impact assessment of this amended directive illustrated that the impact will be evenly distributed among regions in the union . in view of the on - going developments in transport technologies , a mid - term review of these minimum target and an assessment of national parameters might be necessary to allow for an adaption of the values at a later stage .


### the maximum impact can be achieved if public procurement of clean vehicles is targeted in areas that have a relatively high degree of air pollution . public authorities in member states are encouraged to particularly focus on those areas when concluding the implementation of their domestic minimum targets and to reflect related action in their reporting under this amended directive . ### the maximum impact can be achieved if public procurement of clean vehicles is targeted in areas that have a relatively high degree of air and noise pollution . public authorities in member states are encouraged to particularly focus on those areas when concluding the implementation of their domestic minimum targets and to reflect related action in their reporting under this amended directive . in order to avoid disproportionate burden and optimise the potential results of this directive , appropriate technical assistance should be provided to the public authorities .


### member states shall ensure that purchase , lease , rent or hire - purchase of road transport vehicles , and public service contracts on public passenger transport by road and rail and public service contracts as referred to in article 3 of this directive comply with the minimum procurement targets for light - duty vehicles referred to in table 4 of the annex and for heavy - duty vehicles referred to in table 5 in the annex . ### member states shall ensure that purchase , lease , rent or hire - purchase of road transport vehicles and public service contracts on public passenger transport by road and rail and public service contracts and transport services as referred to in article 3 of this directive comply with the minimum procurement targets and in the case of transport services with state - aid benefits for light - duty vehicles referred to in table 4 of the annex and for heavy - duty vehicles referred to in table 5 in the annex .


### the communication from the commission to the european parliament , the council , the european economic and social committee and the committee of the regions entitled ' the future of food and farming ' of 29 november 2017 sets out the challenges , objectives and orientations for the future common agricultural policy after 2020 . these objectives include , inter alia , the need for the cap to be more result - driven , to boost modernisation and sustainability , including the economic , social , environmental and climate sustainability of the agricultural , forestry and rural areas , and to help reducing the union legislation - related administrative burden for beneficiaries . ### the communication from the commission to the european parliament , the council , the european economic and social committee and the committee of the regions entitled ' the future of food and farming ' of 29 november 2017 sets out the challenges , objectives and orientations for the future common agricultural policy after 2020 . these objectives include , inter alia , the need for the cap to be more result - driven , to boost modernisation and sustainability , including the economic , social , environmental and climate sustainability , including the incorporation of sustainable development goals in the development of agricultural systems , forestry and rural areas , and to help reducing the union legislation - related administrative burden for beneficiaries .


### ' a designation of origin ' means a name which identifies a product , referred to in article 92 : ### ' a designation of origin ' means the name of a region , a specific place or , in exceptional and duly justifiable cases , a country used to describe a product referred to in article 92 fulfilling the following requirements :


### whose quality or characteristics are essentially or exclusively due to a particular geographical environment , with its inherent natural factors and , where relevant , human factors ; ### the quality and characteristics of the product are essentially or exclusively due to a particular geographical environment with its inherent natural and human factors ;


### the term ' de - alcoholised ' may be used together with the name of the grapevine products referred to in points 1 and 4 to 9 , where the product : ### ' de - alcoholised wine ' or ' de - alcoholised ' means the product which :


### the term ' partially de - alcoholised ' may be used together with the name of the grapevine products referred to in points 1 and 4 to 9 , where the product : ### ' partially de - alcoholised wine ' or ' partially de - alcoholised ' means the product which :


### directive 2009 / 22 / ec of the european parliament and of the council29 enabled qualified entities to bring representative actions primarily aimed at stopping and prohibiting infringements of union law harmful to the collective interests of consumers . however , that directive did not sufficiently address the challenges for the enforcement of consumer law . to improve the deterrence of unlawful practices and to reduce consumer detriment , it is necessary to strengthen the mechanism for protection of collective interests of consumers . given the numerous changes , for the sake of clarity it is appropriate to replace directive 2009 / 22 / ec . ### directive 2009 / 22 / ec of the european parliament and of the council enabled qualified entities to bring representative actions primarily aimed at stopping and prohibiting infringements of union law harmful to the collective interests of consumers . however , that directive did not sufficiently address the challenges for the enforcement of union law . to improve the deterrence of unlawful practices and to reduce consumer or citizen detriment , it is necessary to strengthen the mechanism for protection of collective interests of consumers or citizens . given the numerous changes , for the sake of clarity it is appropriate to replace directive 2009 / 22 / ec .


### a representative action should offer an effective and efficient way of protecting the collective interests of consumers . it should allow qualified entities to act with the aim of ensuring compliance with relevant provisions of union law and to overcome the obstacles faced by consumers within individual actions , such as the uncertainty about their rights and available procedural mechanisms , psychological reluctance to take action and the negative balance of the expected costs and benefits of the individual action . ### a representative action should offer an effective and efficient way of protecting the collective interests of all consumers , without discrimination . it should allow qualified entities to act with the aim of ensuring compliance with relevant provisions of union law and to overcome the obstacles faced by consumers within individual actions with regard to their generally weaker position , such as the uncertainty about their rights and available procedural mechanisms , psychological reluctance to take action and the negative balance of the expected costs and benefits of the individual action .


### this directive should cover a variety of areas such as data protection , financial services , travel and tourism , energy , telecommunications and environment . it should cover infringements of provisions of union law which protect the interests of consumers , regardless of whether they are referred to as consumers or as travellers , users , customers , retail investors , retail clients or other in the relevant union law . to ensure adequate response to infringement to union law , the form and scale of which is quickly evolving , it should be considered , each time where a new union act relevant for the protection of the collective interests of consumers is adopted , whether to amend the annex to the present directive in order to place it under its scope . ### this directive should cover a variety of consumer law and related areas in line in particular with article 169 tfeu and article 47 of the charter of fundamental rights of the european union . these rights should include data protection , financial services , travel and tourism , energy , telecommunications , equality and non - discrimination , environment or any other relevant area . it should cover infringements of provisions of union law which protect the interests of consumers , regardless of whether they are referred to as consumers or as travellers , users , customers , retail investors , retail clients or other in the relevant union law . to ensure adequate response to infringement to union law , the form and scale of which is quickly evolving , it should be considered , each time where a new union act relevant for the protection of the collective interests of consumers is adopted , whether to amend the annex to the present directive in order to place it under its scope .


### this directive should cover a variety of areas such as data protection , financial services , travel and tourism , energy , telecommunications and environment . it should cover infringements of provisions of union law which protect the interests of consumers , regardless of whether they are referred to as consumers or as travellers , users , customers , retail investors , retail clients or other in the relevant union law . to ensure adequate response to infringement to union law , the form and scale of which is quickly evolving , it should be considered , each time where a new union act relevant for the protection of the collective interests of consumers is adopted , whether to amend the annex to the present directive in order to place it under its scope . ### this directive should cover a variety of areas such as data protection , financial services , travel and tourism , energy , telecommunications , competition and environment . therefore , member states should ensure that organisations representing all these subject areas can be designated as qualified entities . the directive should cover infringements of provisions of union law which protect the interests of consumers and citizens , regardless of whether they are referred to as consumers or citizens as travellers , users , customers , retail investors , retail clients or other in the relevant union law . to ensure adequate response to infringement to union law , the form and scale of which is quickly evolving , it should be considered , each time where a new union act relevant for the protection of the collective interests of consumers is adopted , whether to amend the annex to the present directive in order to place it under its scope .


### this directive provides for a procedural mechanism , which does not affect the rules establishing substantive rights of consumers to contractual and non - contractual remedies in case their interests have been harmed by an infringement , such as the right to compensation for damages , contract termination , reimbursement , replacement , repair or price reduction . a representative action seeking redress under this directive can only be brought where union or national law provides for such substantive rights . ### this directive provides for a procedural mechanism , which does not affect the rules establishing substantive rights of consumers to contractual and non - contractual remedies in case their interests have been harmed by an infringement , such as the right to compensation for damages , contract termination , reimbursement , replacement , removal , repair or price reduction . a representative action seeking redress under this directive can only be brought where union or national law provides for such substantive rights .


### qualified entities should be fully transparent about the source of funding of their activity in general and regarding the funds supporting a specific representative action for redress in order to enable courts or administrative authorities to assess whether there may be a conflict of interest between the third party funder and the qualified entity and to avoid risks of abusive litigation as well as to assess whether the funding third party has sufficient resources in order to meet its financial commitments to the qualified entity . the information provided by the qualified entity to the court or administrative authority overseeing the representative action should enable it to assess whether the third party may influence procedural decisions of the qualified entity in the context of the representative action , including on settlements and whether it provides financing for a representative action for redress against a defendant who is a competitor of the fund provider or against a defendant on whom the fund provider is dependant . if any of these circumstances is confirmed , the court or administrative authority should be empowered to require the qualified entity to refuse the relevant funding and , if necessary , reject standing of the qualified entity in a specific case . ### qualified entities should , throughout each phase of the process , be fully transparent about the source of funding of their activity in general and regarding the funds supporting a specific representative action for redress in order to enable courts or administrative authorities to assess whether there may be a conflict of interest between the third party funder and the qualified entity and to avoid risks of abusive litigation as well as to assess whether the funding third party has sufficient resources in order to meet its financial commitments to the qualified entity . the information provided by the qualified entity to the court or administrative authority overseeing the representative action should enable it to assess whether the third party may influence procedural decisions of the qualified entity in the context of the representative action , including on settlements and whether it provides financing for a representative action for redress against a defendant who is a competitor of the fund provider or against a defendant on whom the fund provider is dependant . if any of these circumstances is confirmed , the court or administrative authority should be empowered to require the qualified entity to refuse the relevant funding and , if necessary , reject standing of the qualified entity in a specific case .


### collective out - of - court settlements aimed at providing redress to harmed consumers should be encouraged both before the representative action is brought and at any stage of the representative action . ### collective out - of - court settlements aimed at providing redress to harmed consumers or citizens should be encouraged both before the representative action is brought and at any stage of the representative action . this possibility should under no circumstances jeopardize the right to access to justice .


### this directive shall not prevent member states from adopting or maintaining in force provisions designed to grant qualified entities or any other persons concerned other procedural means to bring actions aimed at the protection of the collective interests of consumers at national level . ### member states may adopt or maintain in force more stringent provisions aimed at the protection of the collective interests of consumers at national level , and the implementation of this directive shall under no circumstances constitute grounds for the reduction of protection for consumers in fields covered by the scope of union law .


### member states shall ensure that in particular consumer organisations and independent public bodies are eligible for the status of qualified entity . member states may designate as qualified entities consumer organisations that represent members from more than one member state . ### member states shall ensure that in particular consumer organisations , environmental organisations , human rights organisations and independent public bodies are eligible for the status of qualified entity . member states may designate as qualified entities consumer organisations , environmental organisations and human rights organisations that represent members from more than one member state .


### member states shall ensure that representative actions can be brought before national courts or administrative authorities by qualified entities provided that there is a direct relationship between the main objectives of the entity and the rights granted under union law that are claimed to have been violated in respect of which the action is brought . ### member states shall ensure that representative actions according to article 1 can be brought before national courts or administrative authorities by qualified entities .


### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action . it shall demonstrate that it has sufficient financial resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail . ### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action throughout the whole procedure . it shall demonstrate in a transparent way that it has sufficient resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail .


### member states shall take the necessary measures to ensure that procedural costs related to representative actions do not constitute financial obstacles for qualified entities to effectively exercise the right to seek the measures referred to in articles 5 and 6 , such as limiting applicable court or administrative fees , granting them access to legal aid where necessary , or by providing them with public funding for this purpose . ### member states shall take the necessary measures to ensure that procedural costs , including the risk of adverse costs , related to representative actions do not constitute financial obstacles for qualified entities to effectively exercise the right to seek the measures referred to in articles 5 and 6 , such as limiting applicable court or administrative fees , indemnifying them against adverse costs exposure , &#160 ; granting them access to legal aid where necessary , or by providing them with public funding for this purpose .


### member states shall take the necessary measures to ensure that procedural costs related to representative actions do not constitute financial obstacles for qualified entities to effectively exercise the right to seek the measures referred to in articles 5 and 6 , such as limiting applicable court or administrative fees , granting them access to legal aid where necessary , or by providing them with public funding for this purpose . ### member states shall take the necessary measures to facilitate access to justice and shall ensure that procedural costs related to representative actions do not constitute financial obstacles for qualified entities to effectively exercise the right to seek the measures referred to in articles 5 and 6 , in particular limiting applicable court or administrative fees , granting them access to legal aid where necessary , or by providing them with public funding for this purpose .


### member states shall take the measures necessary to ensure that any qualified entity designated in advance in one member state in accordance with article 4 may apply to the courts or administrative authorities of another member state upon the presentation of the publicly available list referred to in that article . the courts or administrative authorities shall accept this list as proof of the legal standing of the qualified entity without prejudice to their right to examine whether the purpose of the qualified entity justifies its taking action in a specific case . ### member states shall take the measures necessary to ensure that any qualified entity designated in advance in one member state in accordance with article 4 or ad hoc in accordance with article 4 may apply to the courts or administrative authorities of another member state upon the presentation of ad hoc designation in accordance with article 4 or the publicly available list referred to in article 4 . the courts or administrative authorities shall accept this list or other applicable evidence&#160 ; as proof of the legal standing of the qualified entity without prejudice to their right to examine whether the purpose of the qualified entity justifies its taking action in a specific case .


### to that end , it is also important to ensure a minimum level of information and coordination with regard to foreign direct investments falling under the scope of this regulation in all member states . this information should be made available by the member states in which the foreign direct investment is planned or has been completed upon request of the member states or of the commission . relevant information includes aspects such as the ownership structure of the foreign investor and the financing of the planned or completed investment , including , when available , information about subsides granted by third countries . ### to that end , it is also important to ensure a minimum level of information and coordination with regard to foreign direct investments falling under the scope of this regulation in all member states . this information should be made available by the member states in which the foreign direct investment is planned or has been completed upon request of the member states or of the commission . relevant information includes aspects such as the ownership structure of the direct foreign investor and the financing of the planned or completed investment , including , when available , information about subsides granted by third countries .


### ' foreign investor ' means a natural person of a third country or an undertaking of a third country intending to make or having made a foreign direct investment ; ### ‘ direct foreign investor ' means a natural or legal person of a third country intending to make or having made a foreign direct investment ;


### –critical infrastructure , including energy , transport , communications , data storage , space or financial infrastructure , as well as sensitive facilities ; ### –critical infrastructure , including energy , energy security , transport , water , communications , public health provision , data storage , space or financial infrastructure , as well as sensitive facilities and any security and defence infrastructure ;


### in determining whether a foreign direct investment is likely to affect security or public order , member states and the commission may take into account whether the foreign investor is controlled by the government of a third country , including through significant funding . ### in determining whether a foreign direct investment is likely to affect security or public order , member states and the commission may take into account whether the direct foreign investor is controlled by the government of a third country , including through significant funding .


### the ownership structure of the foreign investor and of the undertaking in which the foreign direct investment is planned or has been completed , including information on the ultimate controlling shareholder or shareholders ; ### the ownership structure of the direct foreign investor and of the undertaking in which the foreign direct investment is planned or has been completed , including information on the ultimate controlling shareholder or shareholders ;


### the value of the foreign direct investment ; ### the value of the foreign direct investment and a projection of its sectoral impact ;


### the funding of the investment , on the basis of information available to the member state . ### the funding of the investment and the guarantee of the lawfulness of its source , on the basis of information available to the member state .


### each member state shall appoint a foreign direct investment screening contact point for the screening of foreign direct investment . the commission and other member states shall involve these fdi screening contact points on all issues related to implementation of this regulation . ### each member state shall appoint a foreign direct investment screening contact point for the screening of foreign direct investment . the commission and other member states shall involve these fdi screening contact points on all issues related to implementation of this regulation . the commission and the member states shall meet regularly to discuss best practice in investment screening and coordinate on factors for the purposes of article 4 with a view to harmonising those factors .


### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. ### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , health surveillance , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use insofar as such effort is always conducted through effective and secured processes , such as aggregation and randomisations and with due respect to professional duties , including but not limited to , confidentiality duties.


### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. ### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provision of healthcare (e.g. electronic health records , genetic data , claims data , files on the covid pandemic and other events with a major impact on public health , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use.


### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices , wellness applications or other wearables and digital health applications. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other. ### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices , wellness applications or other wearables and digital health applications , which must comply with the data security measures. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other.


### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices , wellness applications or other wearables and digital health applications. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other. ### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices , wellness applications or other wearables and digital health applications. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset for research and innovation activities. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other.


### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector. ### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. health professionals contribute to the ehds by registering the required categories of patient data in the ehr. health professionals who are required to register data in an ehr system for primary use purposes should be exempt from providing the data again for secondary use purposes. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented or difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector.


### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector. ### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds , but they must comply with the measures on appropriate access and security in respect of such personal data. the public or private entities often receive public funding , from national or union funds to collect , store and process electronic health data for research , statistics (official or not) or other similar purposes , including in areas where the collection of such data is fragmented or difficult , such as rare diseases , cancer etc. such data , collected , stored and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , adaptation to the evolution of new healthcare technologies , patient safety and policy-making benefitting society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector.


### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited. ### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. particularly , the secondary use of health data for research and development purposes should contribute to a return to society in the form of new medicines , medical devices , health care products and services at affordable and fair prices for european citizens , as well as enhancing access and availability of such in all member states. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public health bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. national public health authorities and european union agencies related to health may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. other public sector bodies from member states and european union institutions , bodies , offices and agencies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited.


### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited. ### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities and information campaigns on a range of health matters , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities and the measures on access to , and the security of , personal data are strictly complied with. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access , be this limited or not , depending on the situation , to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited.


### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited. ### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. access to secondary health data for research and innovation to the development of medicines , medical devices , health care products and services should contribute to affordable and fair pricing for all european citizens when these products are placed on the market. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited.


### (42) the establishment of one or more health data access bodies , supporting access to electronic health data in member states , is an essential component for promoting the secondary use of health-related data. member states should therefore establish one or more health data access body , for instance to reflect their constitutional , organisational and administrative structure. however , one of these health data access bodies should be designated as a coordinator in case there are more than one data access body. where a member state establishes several bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one health data access body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other health data access bodies , the ehds board and the commission. health data access bodies may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization) but should have the same functions , responsibilities and capabilities. health data access bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that the health data access body cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each health data access body should be provided with the financial and human resources , premises and infrastructure necessary for the effective performance of its tasks , including those related to cooperation with other health data access bodies throughout the union. each health data access body should have a separate , public annual budget , which may be part of the overall state or national budget. in order to enable better access to health data and complementing article 7(3) of regulation […] of the european parliament and of the council [data governance act com/2020/767 final] , member states should entrust health data access bodies with powers to take decisions on access to and secondary use of health data. this could consist in allocating new tasks to the competent bodies designated by member states under article 7(1) of regulation […] [data governance act com/2020/767 final] or in designating existing or new sectoral bodies responsible for such tasks in relation to access to health data. ### (42) the establishment of one or more health data access bodies , supporting access to electronic health data in member states , is an essential component for promoting the secondary use of health-related data. member states should therefore establish one or more health data access body , for instance to reflect their constitutional , organisational and administrative structure. however , one of these health data access bodies should be designated as a coordinator in case there are more than one data access body. where a member state establishes several bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one health data access body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other health data access bodies , the ehds board and the commission. health data access bodies may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization) but should have the same functions , responsibilities and capabilities , and comply with all the measures on access to , and the security of , personal medical data. health data access bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that the health data access body cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each health data access body should be provided with the financial and human resources , premises and infrastructure necessary for the effective performance of its tasks , including those related to cooperation with other health data access bodies throughout the union. each health data access body should have a separate , public annual budget , which may be part of the overall state or national budget. in order to enable better access to health data and complementing article 7(3) of regulation […] of the european parliament and of the council [data governance act com/2020/767 final] , member states should entrust health data access bodies with powers to take decisions on access to and secondary use of health data. this could consist in allocating new tasks to the competent bodies designated by member states under article 7(1) of regulation […] [data governance act com/2020/767 final] or in designating existing or new sectoral bodies responsible for such tasks in relation to access to health data.


### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets. ### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. those supervisory authorities should remain the only competent authorities responsible for personal data protection issues and their decisions should not be conditioned or overruled by the health data access bodies. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets.


### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities. ### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional , with due regard for the stated wish of the data subject not to be contacted. natural persons should be able to access the results of different research projects on the website of the health data access body , in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities.


### (46) in order to support the secondary use of electronic health data , the data holders should refrain from withholding the data , requesting unjustified fees that are not transparent nor proportionate with the costs for making data available (and , where relevant , with marginal costs for data collection) , requesting the data users to co-publish the research or other practices that could dissuade the data users from requesting the data. where ethical approval is necessary for providing a data permit , its evaluation should be based on its own merits. on the other hand , union institutions , bodies , offices and agencies , including ema , ecdc and the commission , have very important and insightful data. access to data of such institutions , bodies , offices and agencies should be granted through the health data access body where the controller is located. ### (46) in order to support the secondary use of electronic health data , the data holders should refrain from withholding the data , requesting unjustified fees that are not transparent nor proportionate with the costs for making data available (and , where relevant , with marginal costs for data collection) , requesting the data users to co-publish the research or other practices that could dissuade the data users from requesting the data. where ethical approval is necessary for providing a data permit , its evaluation should be based on its own merits. on the other hand , national public health authorities , european union agencies , including ema , ecdc and emcdda have very important and insightful data. access to data of such institutions and agencies should be granted through the health data access body where the controller is located.


### (48) in order to strengthen the enforcement of the rules on the secondary use of electronic health data , appropriate measures that can lead to penalties or temporary or definitive exclusions from the ehds framework of the data users or data holders that do not comply with their obligations. the health data access body should be empowered to verify compliance and give data users and holders the opportunity to reply to any findings and to remedy any infringement. the imposition of penalties should be subject to appropriate procedural safeguards in accordance with the general principles of law of the relevant member state , including effective judicial protection and due process. ### (48) in order to strengthen the enforcement of the rules on the secondary use of electronic health data , appropriate measures that can lead to penalties or temporary or definitive exclusions from the ehds framework or even fines directed to the data users or data holders that do not comply with their obligations. the health data access body should be empowered to verify compliance and give data users and holders the opportunity to reply to any findings and to remedy any infringement. the imposition of penalties should be subject to appropriate procedural safeguards in accordance with the general principles of law of the relevant member state , including effective judicial protection and due process.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , common standards for data anonymisation shall be further developed and the use of anonymised electronic health data which is devoid of any personal data should be made available , when possible , with data that cannot be anonymised or pseudonymized being excluded of reuse possibilities. requests of pseudonymised data should be duly justified. when providing access to a pseudonymised or anonymised dataset , a data access body should follow state-of-the-art anonymisation/pseudonymisation technology. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s)'s professional , with due regard for the stated wish of the data subject not to be contacted. moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by asking for their explicit consent for the data to be used and by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s) , if the natural person has agreed in advance to receive such information. moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity and must ensure the total protection of that data. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (52) as the covid-19 crisis has shown , the union institutions , bodies , offices and agencies , especially the commission , need access to health data for a longer period and on a recurring basis. this is may be the case not only in specific circumstances in times of crisis but also to provide scientific evidence and technical support for union policies on a regular basis. access to such data may be required in specific member states or throughout the whole territory of the union. ### (52) as the covid-19 crisis has shown , the union institutions , bodies , offices and agencies , especially the commission , need access to health data for a longer period and on a recurring basis. this is may be the case not only in specific circumstances in times of crisis but also to provide scientific evidence and technical support for union policies on a regular basis. access to such data may be required in specific member states or throughout the whole territory of the union , and the conditions and period of access must be set out very clearly , while the security of the data must also be respected.


### (52) as the covid-19 crisis has shown , the union institutions , bodies , offices and agencies , especially the commission , need access to health data for a longer period and on a recurring basis. this is may be the case not only in specific circumstances in times of crisis but also to provide scientific evidence and technical support for union policies on a regular basis. access to such data may be required in specific member states or throughout the whole territory of the union. ### (52) as the covid-19 crisis has shown , the union institutions , bodies , offices and agencies , especially the commission , need access to health data for a longer period and on a recurring basis. this may be the case not only in specific circumstances in times of crisis but also to provide scientific evidence and technical support for union policies on a regular basis. access to such data may be required in specific member states or throughout the whole territory of the union.


### (53) for requests to access electronic health data from a single data holder in a single member state and in order to alieviate the administrative burden for heath data access bodies of managing such request , the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide. ### deleted


### (53) for requests to access electronic health data from a single data holder in a single member state and in order to alieviate the administrative burden for heath data access bodies of managing such request , the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide. ### (53) multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide.