GermanyHealth Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data
Gesundheitsdatennutzungsgesetz (GDNG), §§ 1, 6-9
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Retention, Disclosure, Prohibition
As of .
What it requires
- If you operate a health care facility that further processes health data it stores lawfully under General Data Protection Regulation (GDPR) Article 9(2)(h) or (i) for quality assurance, patient safety, research or statistics, pseudonymize the data, anonymize it as soon as the purpose allows, and delete it no later than 30 years after the further processing began (GDNG Section 6, paragraph 1).
- If several people work in the facility, create a rights and roles concept so that only authorized persons can further process the data and each further processing is logged (Section 6, paragraph 1).
- Do not pass the personal data to third parties unless the data subject has consented or a federal, state or EU law provides for it (Section 6, paragraph 3).
- Inform the public in clear and simple language of the purposes for which you further process data, and tell a data subject on request the nature, extent and purpose of the processing for research or statistics (Section 6, paragraph 4).
- If you use health data made available for scientific research, use it only for the purposes for which it was made accessible, do not pass it to third parties, and do not process it to establish a link to a person or to identify care providers or payers (Section 7, paragraphs 1 and 2).
- If a research project processes health data under this Act without the data subjects' consent, register the project in a primary register for clinical trials recognized by the World Health Organization before the processing starts where such a register allows it, and publish the results in anonymized form within 24 months of the project's end (Section 8).
If you get it wrong
Criminal exposureYes
Criminal exposure note
Using or passing on health data contrary to Section 7(1), or processing it contrary to Section 7(2), is punishable by imprisonment of up to one year or a fine under Section 9(1); acting for payment or to enrich oneself or harm another raises the maximum to three years under Section 9(2).
What this law does
The Act applies to the processing of health data for research, to improve health care and nursing, and for other purposes in the public interest. Where health data are processed for scientific research and the other purposes the Act names, it takes precedence over Books V and XI of the Social Code.
A data-processing health care facility may further process health data it stores lawfully under General Data Protection Regulation (GDPR) Article 9(2)(h) or (i) where necessary for quality assurance, patient safety, research or statistics, and must pseudonymize the data and anonymize it as soon as the purpose allows. Where several people work in the facility, it must create a rights and roles concept so that only authorized persons can further process the data and each further processing is logged.
Data further processed this way must be deleted no later than 30 years after the further processing began. Passing the personal data to third parties is prohibited unless the data subject has consented or another federal, state or EU law provides for it. The facility must inform the public in clear and simple language of the purposes for which it further processes data.
Users of health data made available for scientific research may use the data only for the purposes for which they were made accessible and may not pass it to third parties. The data may not be processed to establish a link to a person or to identify care providers or payers.
Where a project processes health data under the Act for research without the consent of the data subjects, those responsible must register it in a primary register for clinical trials recognized by the World Health Organization before the processing starts, where such a register allows the registration. Those responsible must publish the results in anonymized form within 24 months of the project's end and deposit them in the primary register where the project was registered.
When LexLint raises it
When your app profile says your app handles health records.