European Coordination Committee of the Radiological, Electromedical and healthcare IT Industry

Page 1 of 3 COCIR INPUT FOR THE ROADMAP OF THE REPORT ON THE APPLICATION OF THE GENERAL DATA PROTECTION REGULATION1 COCIR welcomes the opportunity to provide feedback to the roadmap of the report on the application of the General Data Protection Regulation (GDPR). This report comes at a most crucial time. The current COVID-19 crisis has painfully made clear the need for a consistent and coordinated approach on Member State implementation and interpretation of the GDPR, as well as the importance of strong and clear guidance for data controllers, processors and other relevant stakeholders. This has been clearly the case for the processing of health data, not only in clinical but also other contexts, such as in the development of apps and in the context of employment (e.g. temperature checks).

…but also other contexts, such as in the development of apps and in the context of employment (e.g. temperature checks). Coordinated actions should create legal certainty to fully enable scientific research while safeguarding the fundamental rights and freedoms of data subjects. While urgent and critical in these challenging times, actions and statements from the European Data Protection Board and the Data Protection Authorities should form part of a more comprehensive long-term approach, particularly when it comes to the processing of health data.

…form part of a more comprehensive long-term approach, particularly when it comes to the processing of health data. The ambition of the European Commission to establish a European Health Data Space will depend on the ability to overcome the current fragmented approach and to provide legal certainty in order to enable a trusted framework where all stakeholders feel confident in using and sharing health data, leading to better insights and health outcomes benefiting all. Pursuant to Article 97 of the GDPR the European Commission is to submit a report on the evaluation and review of the GDPR, in particular, the application and functioning of international data transfers and cooperation and consistency.

GDPR, in particular, the application and functioning of international data transfers and cooperation and consistency. Considering that in accordance with the legal text the next report will only come four years from now, it is most regrettable that only a very limited stakeholder process is foreseen, that might be unable to capture and address concerning issues from the healthcare industry. COCIR herewith would like to highlight the most pressing concerns with regard to the legal chapters that will be subject of the report. • International data transfer The GDPR specifies a number of mechanisms for transfers of personal data to third countries or international organisations. 1 https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12322-Report-on-the-application- of-the-General-Data-Protection-Regulation Ref.

…ter-regulation/have-your-say/initiatives/12322-Report-on-the-application- of-the-General-Data-Protection-Regulation Ref. Ares(2020)2298530 - 29/04/2020 Page 2 of 3 The European Commission has in the past so far assessed and recognised the adequacy of only a limited number of third countries. Most of the existing adequacy decisions have not been reviewed since the GDPR implementation and there is an ongoing battle on the validity of the existing EU-US mechanism of the Privacy Shield. Repeal or annulment of these decisions could undermine existing data flows. Standard Contractual Clauses (SCCs) have been regarded as the most common and practical way to safeguard the transfer of personal data to third countries. The existing instruments are however incomplete, both in terms of scope and content.

…personal data to third countries. The existing instruments are however incomplete, both in terms of scope and content. The available SCC templates are only applicable for Controller-Controller and Controller- Processor relationships. Next to that, the existing templates pre-date the GDPR and do not appropriately reflect the current legal provisions and obligations. To further aggravate the situation, SCCs form the subject of a number of pending cases before the EU Court of Justice that could put international data transfers into jeopardy. It is paramount that the Commission provides robust and futureproof mechanisms that solidify the legal validity of international data transfers instruments.

…robust and futureproof mechanisms that solidify the legal validity of international data transfers instruments. • Consistency The GDPR is directly applicable in all Member States since one of its key objectives was to move away from the fragmented landscape of 28 different national laws that existed under Directive 95/46/EC and to provide legal certainty for individuals and businesses across the EU. The GDPR has however left a margin for national legislators to maintain or introduce more specific provisions to adapt the application of certain rules of the GDPR. As a consequence, the national margin has contributed to a more fragmented legal landscape than was originally foreseen. For instance, Member States may maintain or introduce further conditions, including limitations, with regard to: o The processing of data concerning health.

…or introduce further conditions, including limitations, with regard to: o The processing of data concerning health. This has resulted in Member States adopting different approaches to processing of health data, making it difficult to access data and electronic health records from various institutions (Art.9.4 GDPR). o Derogations for scientific research purposes: in some Member States (e.g. The Netherlands) consent should be obtained and becomes the legal basis instead of the derogation for scientific research applied in other Member States (e.g. Germany). This is very challenging for businesses operating in these different Member States (Art. 89.2 GDPR). Next to that we have also seen diverging views across Member States on the processing activities that should be subject to a data protection impact assessments.

…views across Member States on the processing activities that should be subject to a data protection impact assessments. Although some guidance clarifying the application of the GDPR at EU level has already been published, there is still a need for more clarification and guidance from the EDPB. Page 3 of 3 The Commission’s upcoming evaluation report should also highlight the broad need for practical guidelines and other suitable means to meet this need. For instance, drafting sector-specific codes of conduct in accordance with Article 40 of the GDPR could be a suitable way to contribute to the proper application of the GDPR. Such codes of conduct could pay particular attention to issues such as the processing of health data, anonymization, scientific research, etc.

…pay particular attention to issues such as the processing of health data, anonymization, scientific research, etc. The recently published EU Data Strategy 2 encourages the establishment of a code of conduct for processing of personal data in the health sector. The Commission could also look into national initiatives that might be replicated at EU level, such as in France3, Finland4 or Germany5. Solid alignment should also be ensured between the draft ePrivacy Regulation and the GDPR, specifically when it comes to the issues relating to personal data, management of consent for lawful processing, law enforcement and confidentiality of communications in the context of legal instruments that already address these topics.

…and confidentiality of communications in the context of legal instruments that already address these topics. Lack of legal clarity and consistency not only undercuts the Digital Single Market, but also strongly hampers a pan-European approach on the processing of personal data, and specifically health data. The European Health Data Space can only happen once the implementation and interpretation challenges of the GDPR are resolved. Otherwise, ‘free movement of data across the EU is impossible. This in turn will prevent the large scale availability of data for scientific research, which is vital to address not only the current sanitary crisis but also the multitude of other healthcare challenges,, such as an ageing population, the increase of non-communicable diseases and comorbidity factors, and the sustainability of public health systems.

…the increase of non-communicable diseases and comorbidity factors, and the sustainability of public health systems. We urge the European Commission and the European Data Protection Board to further explore the availability of tools and policies to ensure a more coherent and consistent approach of data protection at the European level. Brussels, 29 April 2020 About COCIR COCIR is the European Trade Association representing the medical imaging, radiotherapy, health ICT and electromedical industries. Founded in 1959, COCIR is a non-profit association headquartered in Brussels (Belgium) with a China Desk based in Beijing since

13 → 12

originalus šaltinis (PDF) ↗