On May 3, 2022, the European Commission published its proposal to create a European Health Data Space (the “EHDS Proposal”) [1]. The EHDS Proposal aims to introduce a new, unprecedented framework to make electronic health data available for re-use for various purposes, including research. This proposal is groundbreaking on two counts: (1) the electronic health data to be made available for re-use include data held by both public sector bodies and private sector organizations—meaning that private companies would be required to disclose certain electronic health data to third parties for re-use; and (2) the recipients of the data (called data users) are allowed to use the data for a number of purposes, including, among others, scientific research, product development, artificial intelligence (AI) training, and personalized healthcare—meaning that data can be used for commercial purposes. The background to this proposal is that, in the eyes of European policymakers, the coronavirus disease 2019 (COVID-19) pandemic highlighted the importance of having up-to-date health data to respond to public health crises.

The EHDS Proposal is anticipated to have wide-reaching consequences for the healthcare sector, transforming the way in which electronic health data will be shared and reused in Europe. The EHDS Proposal is still in draft form and progressing through the European legislative process, so it is likely to change. This article analyzes the EHDS Proposal as first published by the European Commission, with a focus on the provisions on secondary use of electronic health data. This article discusses the newly proposed mandatory data sharing regime for secondary use of electronic health data, and the responses to this proposal from industry and academia. The final section of this article discusses the potential policy implications of the EHDS Proposal in Korea.

The European Commission published the initial text of the EHDS Proposal on May 3, 2022. The draft is now under review by the European Parliament and the Council of the European Union (EU). Each of these institutions will formulate their own version of the proposal, and they will then enter into negotiations to agree on a compromise text to be adopted. Agreement on the EHDS Proposal is expected at the end of 2023 or early 2024. The authors of this paper analyzed the EHDS Proposal and surveyed other documents published by the EU that provide insights into the EHDS Proposal, as well as the relevant literature.

The European Union has served as the model for Korea’s privacy and personal information policies. The EU’s GDPR has influenced Korea’s Personal Information Protection Act (PIPA) [13]. The first question that pops into anyone’s mind, thus, is whether Korea can implement a secondary use pathway similar to that in the EHDS Proposal. It is undeniable that putting health datasets held by private entities to secondary use has the potential to benefit society. That said, requiring privately held datasets to be made available for secondary use by third parties on a mandatory basis will likely meet significant legal challenges under Korean law.

The Korean constitution provides that the property rights of citizens must be protected and that the scope and limitations of property rights are to be set forth in a statute (Constitution, Art. 23, Para. 1). The constitution also provides that commandeering, using, or limiting a citizen’s property out of public necessity must have legal basis in a statute and be justly compensated (Constitution, Art. 23, Para. 3). The concept of trade secrets is defined broadly as information, including a production method, sale method, useful technical or business information for business activities, which is not known publicly, is managed as a secret, and has independent economic value (Unfair Competition Prevention and Trade Secret Protection Act, Art. 2, Para. 2). This means that proprietary datasets will likely constitute a trade secret, a type of property protected by the constitution [14].

Even if proprietary datasets constitute trade secrets or otherwise protected property under the constitution, one can argue that the takings clause under the Korean constitution will permit mandatory sharing of proprietary datasets for secondary use, provided that the legislature passes a law allowing it with just compensation [15]. Besides, unlike tangible properties that can be used by only a single party at a time, intangible properties, such as datasets, do not necessarily diminish in value when used by multiple parties. However, it is not clear whether the “public necessity” component of the takings clause will be met if secondary use includes research and development activities with a commercial aim. In recent years, Korean authorities have rarely granted compulsory licenses on the grounds of public necessity, although the relevant IP law allows this if just compensation is also granted [16].

This does not mean that creating a “health data space” of some kind in Korea would be impossible altogether. Many publicly held health datasets are already available for secondary use, mostly for research or public health endeavors (Table 5). Korea could conceivably create a “health data space” that includes health datasets that have been created with research grants from the government. The current government research funding regulation bestows the property rights to all byproducts of research to the research institution or the individual researcher (National Research and Development Innovation Act [NRDIA], Art. 16, Paras 1 and 2), in a manner similar to the US Bayh-Dole Act [17]. This property rights scheme was a utilitarian contrivance, after government ownership of IP created from government-funded research had failed to see active downstream development [18]. By the same utilitarian token, permitting wider access to datasets created by government-funded research may bring about even more downstream use of the datasets than proprietary control by a single entity. There are three hurdles that need to be overcome to implement wider access to health datasets generated by government-funded research: legal basis for mandatory sharing of health datasets, privacy of research participants, and IP rights embedded in datasets.

The NRDIA would be the natural place to provide a legal basis to require sharing of scientific data, including health data, created during government-funded research. The current NRDIA conceptualizes a “data management plan” as a part of research proposals, which should include the researcher’s plan to generate, store, maintain and share scientific data created by government-funded research [19]. However, a data management plan is required only selectively at the discretion of the funding ministry. The first step in widening access to health data for secondary research is to make data sharing the rule in publicly funded research, rather than the exception, as is the case in some jurisdictions [20].

For health data, the privacy of the data subjects represented in the datasets will add to the legal complexity of mandatory sharing of health datasets for secondary use by third parties. In this regard, the government must provide guidance as to how health data may be made available for secondary research without compromising the privacy of research participants. The United States’ National Institutes of Health offers a good example [21]. The “scientific research exemptions” under the PIPA as amended in 2020 provides some insights too [22]. The research exemptions under the PIPA allow pseudonymized personal data to be used for statistical purposes, scientific research purposes, and archiving purposes in the public interest—without the consent of the data subject (PIPA Art. 28-2). This provision is similar to GDPR Article 9(2)(j) and Article 89(1), although the issue in the EU is one of fragmentation of how this provision is interpreted by different member states [23]. While the constitutionality of the scientific research exemptions has not yet been tested, designing a Korean “health data space” along similar lines of the scientific research exemptions will at least find precedential support in the PIPA [24].

Safeguarding IP rights embedded in or arising from the datasets will also be a critical issue. The EHDS Proposal reads “(e)lectronic health data entailing protected IP and trade secrets from private enterprises shall be made available for secondary use. Where such data is made available for secondary use, all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken” (EHDS Proposal, Art. 33.4; similar provisions are found in Arts. 34.4 and 37.1). The proposed text is not clear on what “all measures necessary” would entail, and how any disputes that will surely arise between the parties about the appropriate measures to take would be resolved. It will be interesting to watch how the EU solves the puzzle [25]. Interestingly, the European Commission’s Data Act Proposal contains more detailed provisions relating to dispute resolution in this regard, and we may see this being reflected in future iterations of the EHDS Proposal. The same issue will have to be overcome as well if Korea were to adopt the authors’ suggestion of making datasets from government-funded research available to the public for secondary use. Regardless of whether datasets are made available to the public or not, some IP rights may have to remain proprietary to the research organization or the individual researcher in order to make downstream development feasible, especially in the life sciences industry where IP rights become key assets [26].

In conclusion, the EHDS Proposal is a reminder that facilitating secondary research by widening access to health data, whether held by the public sector or the private sector, will add value to society. It is a policy that Korea should consider in the long run. If a similar piece of legislation is not feasible in the short term in Korea, mandatory sharing of scientific data, including health data, generated by government-funded research will be a feasible and beneficial alternative.