GermanySocial Code Book V, Research Data Centre Health: Anonymized and Pseudonymized Data, Ban on Establishing a Personal Reference
In force since .
A de-identification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- If you are the Research Data Centre, supply the data an entitled user requests anonymized and aggregated, and supply pseudonymized individual records only without visible pseudonyms, with a temporary working number, for processing under your control (SGB V Section 303e, paragraphs 3 and 4).
- If you use data made accessible by the Research Data Centre, use it only for the purposes for which it was made accessible and do not pass it to third parties unless the Research Data Centre approves (Section 303e, paragraph 5, sentence 1).
- Take care not to establish a reference to persons, care providers or payers when you process the data, and report a reference established by accident to the Research Data Centre without delay (Section 303e, paragraph 5, sentences 2 and 3).
- Do not process the data to establish a personal reference, to identify care providers or payers, or to gain knowledge of third parties' trade secrets (Section 303e, paragraph 5, sentence 4).
- If you are responsible for processing in the electronic patient record, pseudonymize and encrypt the data to be transmitted to the Research Data Centre, send only data that was reliably and automatically pseudonymized, and give it a working number (Section 363, paragraphs 2 and 3).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Passing the data on contrary to Section 303e(5) sentence 1 number 2, or processing data contrary to Section 303e(5) sentence 4, is punishable under Section 399(1) numbers 1 and 2 by imprisonment of up to one year or a fine, and under Section 399(2) by imprisonment of up to two years or a fine where the offender acts for payment or to enrich or harm another; Section 399(3) makes the offense prosecutable only on complaint.
What record it asks for
Logging duty
The provisions state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
The Research Data Centre must supply the data an entitled user requests anonymized and aggregated. It may provide pseudonymized individual records only without showing the pseudonyms, with a temporary working number, for processing under its own control. A user of data made accessible under paragraph 3 or 4 may use it only for the purposes for which it was made accessible and may not pass it to third parties unless the Research Data Centre approves.
The user must take care not to establish a reference to persons, care providers or payers when processing the data. A reference to persons, care providers or payers that is established by accident must be reported to the Research Data Centre without delay. Processing the data to establish a personal reference, to identify care providers or payers, or to gain knowledge of third parties' trade secrets is prohibited.
Data of the electronic patient record go to the Research Data Centre only if they were reliably and automatically pseudonymized. Those responsible for processing in the electronic patient record are responsible for pseudonymizing and encrypting the data to be transmitted and give it a working number. Section 303e paragraphs 3 to 6 apply by analogy to electronic patient record data held by the Research Data Centre.
Passing the data on contrary to paragraph 5 sentence 1 number 2, or processing data contrary to paragraph 5 sentence 4, is punishable by imprisonment of up to one year or a fine. The maximum rises to two years where the offender acts for payment, to enrich themselves or another, or to harm another.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .