‘A Maze Of Rules’: EFPIA On EU’s Proposed Health Data Sharing Law
Executive Summary
While some progress has been made in strengthening the proposed European Health Data Space during legislative negotiations, further amendments must be made to protect trade secrets and avoid fragmentation, pharma industry federation EFPIA says.
The European Parliament and Council of the EU have made changes to the draft European Health Data Space (EHDS) text to ensure the legislation is aligned with the EU Clinical Trials Regulation (CTR), a move that has been praised by pharmaceutical R&D trade body EFPIA.
Aneta Tyszkiewicz, director for digital data at EFPIA, told the Pink Sheet that the EHDS was an “unprecedented opportunity,” but that there were “many aspects of the EHDS that need to be addressed,” particularly around the protection of intellectual property, consistency with other EU data laws, and the use of an opt-out mechanism.
The EHDS, an initiative that would be introduced under EU-wide regulation, was first proposed by the European Commission in May 2022.
Its key purpose is to enable the secondary use of anonymized or pseudo-anonymized patient health data for purposes including scientific research and health policy development.
If adopted, the EHDS could benefit the pharmaceutical industry by permitting researchers to access huge swathes of data collected from patients across the EU for use in certain R&D activities and other purposes, as specified under Article 34 of the draft text.
Although companies could benefit from access to more patient data, they would also be required to share certain types of health data such as that collected during clinical trials. (Also see "EU Health Data Project: More Use Of Real-World Evidence In Price Negotiations" - Pink Sheet, 10 May, 2022.).
“We cannot create a maze of rules, we have to have a clearly defined interplay between different rules in different scenarios,” Tyszkiewicz said, although she acknowledged that the main EHDS proposal “cannot address every possible scenario” for data sharing, and that secondary legislation and guidance will support its implementation.
The EHDS draft text is currently undergoing the final negotiation stage, known as “trilogues” before a draft text is adopted. During trilogues, the parliament and council debate and discuss the finer details of draft regulations, with the commission acting as a mediator, until the three parties agree on a final draft text for adoption. (Also see "EU Parliament Says Pharma IP & Trade Secrets Must Be Protected Under Health Data Space" - Pink Sheet, 1 Dec, 2023.).
Tyszkiewicz acknowledged that the EHDS forms part of the EU’s data evolution, something that is critical to pharmaceutical R&D and is the future of health care. She noted that real-world data are being used to inform regulatory and health technology assessment (HTA) decisions, and said the EHDS could “pave the way” towards a more “learning-based health care system” if it is implemented well.
Clinical Trial Regulation Alignment
One of the main purposes of the EHDS is to make anonymized patient health data, such as that collected by pharmaceutical companies during R&D activities, available for specific, pre-defined, secondary purposes in the EU.
The sharing of data collected during clinical trials is already regulated in the EU, as part of the CTR. For this reason, the recent move to align the CTR and EHDS has been backed by EFPIA.
“We are already a highly regulated sector, there are well-defined pathways for disclosing this data,” Tyszkiewicz said, adding that the objective of any new law “should be to harmonize the processes and ensure the consistency and alignment with existing laws.”
“From our perspective, the changes proposed by the parliament and the council ensuring the alignment with the clinical trial regulation is very welcome. Specifically as this legislation was intended, negotiated and drafted with clinical trials and clinical trial data in mind.”
Protecting Trade Secrets
However, the CTR does not regulate the sharing of all types of data, and according to Tyszkiewicz, there is a risk that pharmaceutical companies would be obliged to share commercially sensitive data with competitors under the EHDS framework.
“The EHDS proposals are in direct contradiction with the existing frameworks for the protection of intellectual property rights and trade secrets.”
She said that the latest amendments made to the text by the parliament and council “fail in actually narrowing the scope” of data that would be available for secondary purposes under the proposed system, which means there is a lack of certainty around what types of data, and in which formats, would be eligible for secondary use.
This could mean that data from early research, exploratory data from biobanks, and genetic data from research cohorts or from patient surveys, which are “not patentable but sensitive by nature,” could be accessed by third parties under the EHDS. Such data are used by companies to make investment decisions, for instance by identifying diseases that would benefit from new medicines.
“So in our opinion, further work is required when it comes to the actual definition of the scope of the data that companies would be obliged to make available in the future ecosystem,” Tyszkiewicz declared.
Not only this, but the current proposals are in “direct contradiction with the existing frameworks for the protection of intellectual property rights and trade secrets,” she said, because under the EHDS, health data access bodies will “act as a gatekeeper for assessing what constitutes commercially sensitive information and providing sufficient safeguarding mechanisms.”
Health data access bodies “might not have the technical, scientific and commercial knowledge to deal with such a request,” she said, adding that legally, assessment bodies cannot take precedence over a private company’s assessment of what constitutes a trade secret.
Nonetheless, the EHDS does not allow companies to refuse a data request or determine what constitutes a trade secret. In December, the parliament adopted changes that it claimed would protect IP and trade secrets, but EFPIA has called for more concrete changes to be introduced. (Also see "EU Parliament Says Pharma IP & Trade Secrets Must Be Protected Under Health Data Space" - Pink Sheet, 1 Dec, 2023.).
“This is something that we would want to be further elaborated, ideally addressed in the primary texts, if not in the secondary legislation,” Tyszkiewicz said.
Data Act And GDPR
As it stands, the EHDS contains provisions that directly contradict the EU GDPR, the Data Governance Act, and the recently adopted Data Act, according to Tyszkiewicz.
Under the Data Act, data holders can refuse access to commercially sensitive data if its disclosure could cause serious economic damage to the data holder, in line with the EU rules around trade secrets and IP.
“So the EHDS is already inconsistent with the law that has been very recently finalized and adopted, and will be applied as of 2025,” Tyszkiewicz said.
“When it comes to GDPR, our main message is to ensure an alignment of all the definitions, such as ‘data holder,’ ‘data user,’ what constitutes ‘personal data and non-personal data,’” she continued.
“The EHDS is already inconsistent with the law that has been very recently finalized and adopted, and will be applied as of 2025.”
These inconsistencies mean that companies would be left to assess all the different definitions within the different horizontal and vertical laws, and understand which rules they would need to comply with in a specific scenario.
Opt-Out Clause
In the original EHDS proposal, there was no provision for patients to opt in – or out – of their data being used for secondary purposes. In a draft report published a year ago, however, the parliament recommended including an opt-out mechanism, and it seems that this will appear in the final version of the text.
EFPIA was among 35 stakeholders to speak out against the opt-out model last year, a stance on which it remains firm, Tyszkiewicz noted. (Also see "EU Health Data Access Proposal Should Not Include Opt-Out Model, Pharma Says" - Pink Sheet, 7 Sep, 2023.).
She explained that the EHDS contains sufficient safeguarding measures to protect patient privacy, and that an opt-out clause would cause any data collected from patients in the EU to be inherently biased.
Given that both the parliament and council seem steadfast in their decision to include an opt-out mechanism in the EHDS framework, the focus should now be on ensuring the model is implemented in a way that avoids data becoming biased or fragmented as far as possible, she contended.
The opt-out model, if it offers a “granular choice” to patients around how their data are used, could create an “extreme burden” on clinical trial sponsors and health care professionals, Tyszkiewicz said, adding that member states too could be left to decide whether their citizens can opt out of the EHDS, and to what extent.
“That might create a fragmented approach across the EU, resulting in fragmented rights for citizens across the region. This is not something we originally wanted when the proposal was published.”