European UnionEuropean Health Data Space Regulation, Purposes and Prohibited Uses of Secondary Use of Electronic Health Data (Articles 53 and 54)
Regulation (EU) 2025/327, Arts. 53-54
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Licensing
As of .
What it requires
- This duty takes effect on , the date from which Chapter IV applies, except that Article 51(1), points (b), (f), (g), (m) and (p), which name categories of the electronic health data these Articles reach, apply from (Article 105).
- If you are a health data user, process electronic health data for secondary use only on the basis of and in accordance with the purposes contained in a data permit issued under Article 68, a health data request approved under Article 69 or, in situations referred to in Article 67(3), an access approval from the relevant authorised participant in HealthData@EU referred to in Article 75 (Article 54).
- Seek access only for a purpose listed in Article 53(1), because a health data access body grants access only where your processing is necessary for one of them: the public interest in the areas of public or occupational health; policymaking and regulatory activities to support public sector bodies or Union institutions, bodies, offices or agencies in the health or care sector; statistics related to health or care sectors; education or teaching activities in health or care sectors at vocational or higher education level; scientific research related to health or care sectors that contributes to public health or health technology assessments, or ensures high levels of quality and safety of healthcare, of medicinal products or of medical devices, including development and innovation activities for products or services and the training, testing and evaluation of algorithms, including in medical devices, in vitro diagnostic medical devices, AI systems and digital health applications; and improvement of the delivery of care, the optimisation of treatment and the provision of healthcare, based on the electronic health data of other natural persons (Articles 53(1) and 68(1), point (a)).
- Seek access for the purposes in Article 53(1), points (a), (b) and (c), only if you are a public sector body or a Union institution, body, office or agency exercising the tasks conferred on you by Union or national law, or process the data on behalf of one (Article 53(2)).
- Do not seek access to or process electronic health data obtained via a data permit or an approved health data request to take decisions detrimental to a natural person or a group of natural persons based on their electronic health data, where the decisions produce legal, social or economic effects or similarly significantly affect them (Article 54, point (a)).
- Do not seek access to or process such data to take decisions in relation to job offers, to offer less favourable terms in the provision of goods or services, including the exclusion of persons or groups from the benefit of an insurance or credit contract, the modification of their contributions and insurance premiums or the conditions of loans, or to take any other decisions that result in discriminating against them on the basis of the health data obtained (Article 54, point (b)).
- Do not seek access to or process such data to carry out advertising or marketing activities (Article 54, point (c)).
- Do not seek access to or process such data to develop products or services that may harm individuals, public health or society at large, such as illicit drugs, alcoholic beverages, tobacco and nicotine products, weaponry or products or services which are designed or modified in such a way that they create addiction, contravene public order or cause a risk for human health (Article 54, point (d)).
- Do not seek access to or process such data to carry out activities in conflict with ethical provisions laid down in national law (Article 54, point (e)).
If you get it wrong
Private right of actionYes
Penalty structure
Article 64(5), point (a), of Regulation (EU) 2025/327 subjects health data users processing electronic health data obtained via a data permit issued pursuant to Article 68 for the uses referred to in Article 54 to administrative fines imposed by the health data access bodies (Article 64(1)) of a maximum of EUR 20,000,000 or, for an undertaking, 4 percent of total worldwide annual turnover in the preceding financial year, whichever is higher. The fine is coded for Article 54's prohibited uses only; Article 64(4) sets a lower tier (EUR 10,000,000 or 2 percent) for other duties, and Article 99 leaves the penalties for infringements not subject to Articles 63 and 64 to the Member States.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The health data access bodies that Member States designate under Article 55, which monitor and supervise compliance by health data users and health data holders with the requirements of the Regulation (Article 57(1), point (a)(ii)) and take enforcement measures and impose administrative fines under Articles 63 and 64; where a finding of non-compliance concerns a possible breach of Regulation (EU) 2016/679, the health data access body informs the supervisory authorities under that Regulation (Article 63(2)).
What this law does
Article 53(1) provides that health data access bodies shall only grant access to electronic health data referred to in Article 51 for secondary use to a health data user where the processing by that health data user is necessary for one of six purposes: the public interest in the areas of public or occupational health, policymaking and regulatory activities to support public sector bodies or Union institutions, bodies, offices or agencies in the health or care sector, statistics related to health or care sectors, education or teaching activities in health or care sectors at vocational or higher education level, scientific research related to health or care sectors, and improvement of the delivery of care based on the electronic health data of other natural persons.
Article 53(2) reserves access for the purposes in Article 53(1), points (a), (b) and (c), to public sector bodies and Union institutions, bodies, offices and agencies exercising the tasks conferred on them by Union or national law, including where a third party processes the data on their behalf.
Article 54 provides that health data users shall only process electronic health data for secondary use on the basis of and in accordance with the purposes contained in a data permit issued pursuant to Article 68, health data requests approved pursuant to Article 69 or, in situations referred to in Article 67(3), an access approval from the relevant authorised participant in HealthData@EU referred to in Article 75.
Article 54, points (a) and (b), prohibit seeking access to and processing electronic health data obtained via a data permit or an approved health data request for taking decisions detrimental to a natural person or a group of natural persons based on their electronic health data, and for taking decisions in relation to job offers, less favourable terms in the provision of goods or services, including exclusion from an insurance or credit contract, or other decisions that discriminate against them on the basis of the health data obtained.
Article 54, points (c), (d) and (e), prohibit the same access and processing for carrying out advertising or marketing activities, for developing products or services that may harm individuals, public health or society at large, and for carrying out activities in conflict with ethical provisions laid down in national law.
Article 68(1), point (a), requires a health data access body to assess whether the purposes described in the health data access application correspond to one or more of the purposes listed in Article 53(1) before it grants access to electronic health data. Article 2(2), point (c), defines electronic health data as personal or non-personal electronic health data.
Article 2(2), point (a), defines personal electronic health data as data concerning health and genetic data, processed in an electronic form. Article 2(2), point (u), defines a health data user as a natural or legal person, including Union institutions, bodies, offices or agencies, which has been granted lawful access to electronic health data for secondary use pursuant to a data permit, a health data request approval or an access approval by an authorised participant in HealthData@EU.
Article 2(2), point (v), defines a data permit as an administrative decision issued to a health data user by a health data access body to process certain electronic health data specified in the data permit for specific secondary use purposes, based on conditions laid down in Chapter IV.
Article 51(1) lists the categories of electronic health data that health data holders make available for secondary use, among them, at points (b), (f), (g), (m) and (p), data on factors impacting on health, human genetic, epigenomic and genomic data, other human molecular data, data from clinical trials, clinical studies, clinical investigations and performance studies, and data from research cohorts, questionnaires and surveys related to health after the first publication of the related results.
Article 1(2), point (a), states that the Regulation specifies and complements the rights laid down in Regulation (EU) 2016/679 of natural persons in relation to the primary use and secondary use of their personal electronic health data.
Article 64(5), point (a), subjects health data users processing electronic health data obtained via a data permit issued pursuant to Article 68 for the uses referred to in Article 54 to administrative fines of a maximum of EUR 20 000 000 or, in the case of an undertaking, of a maximum of 4 % of its total worldwide annual turnover in the preceding financial year, whichever is higher.
Article 99 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64. Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation in accordance with Union and national law.
Article 105 applies Chapter IV, in which Articles 53 and 54 sit, from , and applies Article 51(1), points (b), (f), (g), (m) and (p), from .
When LexLint raises it
When your app profile says your app handles health records.