EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
The GDPR also provides a specific regime for chil - dren’s data in the context of information society ser - vices. Where processing is based on consent (Article 6 (1)(a), GDPR) and relates to the direct offer of such services to a child, consent is valid only if the child is at least 16 years old, unless member states lower the age threshold (not below 13) (Article 8 (1), GDPR). For children below the applicable age, consent must be given or authorised by the holder of parental respon - sibility, and controllers must make reasonable efforts to verify this (Article 8 (2), GDPR). Data relating to criminal convictions, offences and related security measures are governed separately under Article 10, GDPR. Unlike Article 9 data, such data may be processed only under the control of a public authority or where authorised by EU or member state law providing appropriate safeguards. Comprehensive registers of criminal convictions may be kept only under the control of a public authority. In the law enforcement context, processing by com - petent authorities falls under Directive (EU) 2016/680 (Law Enforcement Directive), which establishes a par - allel regime. 1.4 Processing of Personal Data for Research and Development Purposes Patient data is a special category of personal data under Article 9, GDPR. As a principle, processing health data is prohibited, unless an Article 6 legal basis and an Article 9 (2) exception applies. Health data includes information relating to physical or mental health, such as healthcare services, genetic and biometric data. Only data that is truly anonymised falls outside the GDPR. Pseudonymised data remains personal data. The processing carried out to achieve anonymisation must itself be lawful. In practice, life sciences companies most commonly rely on: • explicit consent (Article 9 (2)(a)), given specifically for research or product development purposes,
and provided it is explicit, freely given, specific and informed; • scientific research purposes (Article 9 (2)(j)), pro - vided the processing is based on EU or member state law and subject to appropriate safeguards under Article 89 (1), GDPR (eg, pseudonymisation, access controls, data minimisation); • public interest in the area of public health (Article 9 (2)(i)), such as ensuring high standards of quality and safety of healthcare or medical devices, where supported by EU or member state law; and • preventive or occupational medicine, diagnosis or management of healthcare systems (Article 9 (2) (h) GDPR), particularly where the company acts on behalf of or in co-operation with healthcare provid - ers subject to professional secrecy. The European Health Data Space Regulation (EHDS), once applicable, will significantly impact life sciences companies operating in the EU by establishing a har - monised framework for secondary use of electronic health data. Secondary use for research, innovation, regulatory purposes and public health policy will require a data permit issued by a national health data access body. Permits will specify the authorised purpose, data - sets and conditions of use, and data will generally be accessed through secure processing environments, subject to strict purpose limitation, security, govern - ance controls and a prohibition on re-identification. The EHDS expressly prohibits certain uses (eg, adver - tising, discriminatory decision-making, decisions det - rimental to individuals in areas such as employment or insurance). It further strengthens individuals’ rights (including enhanced access and portability, and in some cases the ability to restrict secondary use) and introduces interoperability obligations for electronic health record systems, reinforcing privacy by design under the GDPR. Overall, the EHDS aims to facilitate innovation by expanding lawful access to large-scale health data - sets while tightening governance and limiting purely commercial uses. Together, the GDPR and EHDS create a high-compliance but innovation-oriented
90 CHAMBERS.COM
Powered by FlippingBook