The Act on the Secondary Use of Social and Health Data (552/2019) is being reformed
The Act on the Secondary Use of Social and Health Data (552/2019) (the “Secondary Use Act”), which lays out rules on the use of social and health data in Finland for secondary purposes, entered into force in May 2019. Secondary use of social and health data refers to the use of such data for statistics, scientific research, development and innovation, education, policy-making and regulatory activities by public authorities.
The Ministry of Social Affairs and Health (“STM”) is currently working on a legislative initiative to reform the Secondary Use Act1. The initiative aims to solve the challenges associated with the current legislation on the secondary use of social and health data. The initiative aims to promote both domestic and international research as well as development and innovation activities by providing the best possible framework for such activities2. The Government’s proposal regarding the reform of the Secondary Use Act is expected to be submitted for public consultation in early 2025.
There are a number of challenges associated with the current regulatory framework, especially from the perspective of data users. The users of social and health data for secondary purposes have experienced, among other things, slow and costly authorisation processes. In addition, there have been practical challenges with respect to international R&D cooperation3. The Secondary Use Act requires, inter alia, that the data is processed in a secure processing environment. Currently, such secure processing environments meeting the requirements of the Secondary Use Act are established only in Finland. Secure processing environments and facilitating international R&D cooperation are among the issues that are expected to be addressed in the reform of the Secondary Use Act. Indeed, there has been a general lack of clarity among stakeholders regarding the interpretation of the rules of the Secondary Use Act and more regulatory guidance continues to be highly expected.
The legislative initiative to reform the Secondary Use Act can therefore be described as a very welcomed initiative. This initiative creates potential for increasing cooperation between research, development and innovation actors and for marketing Finnish knowledge and research to international stakeholders. STM is also working on a legislative initiative which aims to clarify research legislation that will also contribute to achieving these objectives4. Hence, it can be expected that the reform of the Secondary Use Act and research legislation will increase R&D and innovation activities in Finland which will further boost innovation and potential for new business opportunities in the healthcare sector.
The upcoming European Health Data Space
The European Parliament and the Council of the European Union reached an agreement on the European Health Data Space Regulation (“EHDS”) in March 20245. The EHDS creates an EU-level framework for safe and secure exchange, use and reuse of electronic health data across the EU in order to benefit patients, researchers, innovators, and regulators. It is considered as a central building block of the European Health Union and a milestone in EU’s digital transformation.
The Finnish Secondary Use Act has served as an inspiration to the EHDS rules on secondary use of social and health data at EU level. Finland is, after all, considered as a pioneer in this field of legislation. However, the question remains whether the challenges experienced with the application of the Finnish Secondary Use Act will be solved in the context of the upcoming EHDS. In this context, it should be noted that the Finnish Social and Health Data Permit Authority Findata has been active in EHDS related questions6. In addition, Sitra in Finland has coordinated the TEHDAS projects, which aim to promote the secondary use of social and health data in the EU7.
The EHDS will establish, inter alia, common requirements for secure processing environments for all EU Member States. Harmonisation of the rules regarding secure processing environments is likely to increase international R&D cooperation. However, it will still take some time before the European rules are applied, as the EHDS is currently in the final stages of legislative drafting and the final text is expected to be published in the Official Journal in early 2025, and thus, 20 days after, enter into force. It should be noted that the EHDS will be subject to transition periods of several years. It is therefore important that actions are taken and the Secondary Use Act in Finland is reformed before the EHDS is applicable to accelerate international research, development and innovation in Finland in order to harness the full potential of social and health data.
General applicability of the General Data Protection Regulation
The General Data Protection Regulation (EU) 2016/679 (the “GDPR”) applies alongside the Secondary Use Act and the upcoming EHDS in the processing of social and health data to secondary use purposes when it comes to personal data. The GDPR lays out rules for the processing of personal data of natural persons, including health data. The GDPR requires, inter alia, that the processing of personal data must always be subject to one of the legal bases established under the GDPR. In Finland, the legality of processing personal data on the basis of consent in the context of the Secondary Use Act in connection with international R&D cooperation has been unclear to the data users8. In this respect, it should be noted that the legal basis should be determined by the possible legal bases under the GDPR, among which the most appropriate legal basis must be identified.
In the context of using social and health data for secondary use purposes and the GDPR, particularly the possibility for patients to opt-out has also been subject of public discussion. Currently, the EHDS text contains an opt-out possibility for natural persons in the context of secondary use of social and health data. In addition, there have been uncertainties among stakeholders regarding the concept of anonymous data. It should be noted that the concept of anonymous data must be interpreted in the light of the GDPR. With regard to the concept of anonymous data, regulatory guidance from the EU level is much expected.
1STM040:00/2024.
2STM040:00/2024.
3Preliminary study on the effects of the secondary use of social and health data in research, development and innovation and in education, January 2022 available at: https://findata.fi/esiselvitys-toisiolain-vaikutuksista-sote-tietojen-toisiokayttoon-tutkimus-kehitys-ja-innovaatiotoiminnassa-seka-opetuksessa/.
4STM111:00/2024.
5European Commission press release, 15 March 2024, available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_24_1346.
6See e.g. Findata participates in the HealthData@EU pilot project aiming to harmonise the secondary use of health data
7See e.g. https://www.sitra.fi/uutiset/sitra-on-valittu-johtamaan-terveystietojen-kayttoa-vauhdittavaa-hanketta/ and https://tehdas.eu/news/tehdas2-joint-action-to-promote-the-secondary-use-of-health-data-in-the-eu-starts/.
8Preliminary study on the effects of the secondary use of social and health data in research, development and innovation and in education, January 2022 available at: https://findata.fi/esiselvitys-toisiolain-vaikutuksista-sote-tietojen-toisiokayttoon-tutkimus-kehitys-ja-innovaatiotoiminnassa-seka-opetuksessa/.
