GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
(d) appointing a DPO. In view of the above, companies that provide products or services to healthcare providers may anonymise patient personal data for the purposes of product development or scientific research. Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the Euro - pean Health Data Space (EHDS) entered into force in March 2025 and aims to establish a common frame - work for the use and exchange of electronic health data across the EU. It strengthens individuals’ access to and control over their personal electronic health data, while also allowing the further use of certain data for purposes of public interest, policy support and scientific research. It promotes a data environ - ment specifically tailored to health, and supports the single market for digital health services and products. In addition, the Regulation establishes a harmonised legal and technical framework for Electronic Health Record (EHR) systems, enhancing interoperability, innovation and the smooth functioning of the internal market. The EHDS Regulation will: • enable individuals to access, control and exchange their electronic health data across borders for the provision of healthcare; • allow the secure and trustworthy re‑use of health data for research, innovation, policymaking and regulatory activities; and • promote a single market for electronic health record systems, supporting both primary and sec - ondary uses of data. Chapter IV of the EHDS Regulation sets out the con - ditions for the so-called “secondary use” of health data, including the use of personal data for research and development purposes. The data access bodies indicated by the member states shall grant access to electronic health data for secondary use when the processing of such health data is necessary for any of the following purposes: • the public interest in the domain of public health;
• policy making and regulatory activities in the public sector; • statistics; • education or teaching activities in the sectors of health or care; • scientific research and improvement in the fields of health or care, with the aim of benefiting end users such as patients, healthcare professionals and health system managers – this includes: (a) development and innovation activities for prod - ucts or services; and (b) training, testing and evaluating algorithms, including those used in medical devices, in vitro diagnostic medical devices, AI systems and digital health applications. Health data provided for the above purposes shall be limited to what is absolutely necessary, adequate and relevant to the purpose of the processing. Health data shall be provided in an anonymised format; if the spe - cific processing cannot be achieved with anonymised data, then health data shall be provided in a pseu - donymised format, while access to the information necessary to reverse the pseudonymisation shall be restricted and controlled. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Regulation (EU) 2024/1689, known as the AI Act, establishes harmonised rules on artificial intelligence and represents the first comprehensive legal frame - work for AI worldwide. It covers AI systems’ devel - opment, marketing, deployment and use. In Greece, there have been no recent legislative updates con - cerning the regulation of artificial intelligence that would affect data protection. Existing data protection laws continue to apply directly to the safeguarding of personal data, even in the context of using AI systems. The AI Act does not seek to affect: • the application of existing EU law governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments; • the obligations of providers and deployers of AI systems in their role as data controllers or proces -
135 CHAMBERS.COM
Powered by FlippingBook