AI Processing of Special Categories of Personal Data in the EU Healthcare Sector - From a GDPR and EHDS Perspective

Sammanfattning

The study describes and analyses the legal requirements under EU law (General Data Protection Regulation (GDPR) and the European Health Data Space (EHDS)) for artificial intelligence (AI) processing (primary use) of data concerning health within the healthcare sector. Under the GDPR, processing data concerning health, a special category of personal data, requires a legal basis (Article 6 GDPR) and an applicable exception (Article 9(2) GDPR) from the general prohibition (Article 9(1) GDPR), in addition to following general principles (Article 5 GDPR) among them, for example, transparency and data minimisation. The EHDS builds upon the GDPR as a lex specialis for electronic health data (including data concerning health) and establishes harmonised rules and an infrastructure for primary and secondary uses. The Regulation (EHDS) grants natural persons the right to access and control their electronic health data (Articles 3 and Article 8 EHDS) and requires secure processing environments (Article 73 EHDS). The study concludes that GDPR and EHDS, when combined, offer a comprehensive legal framework that provides a transparent environment for AI processing (primary use) of data concerning health within the healthcare sector. The Regulations find a balance between their objectives of patient privacy and effective flow of data for primary healthcare needs.