European UnionEuropean Health Data Space Regulation, Right to Opt Out of Secondary Use of Personal Electronic Health Data (Article 71)
Regulation (EU) 2025/327, Art. 71
A data subject rights rule binding public and private bodies.
- Private right of action
- Yes
- Obligation class
- Data subject rights
As of .
What it requires
- This duty takes effect on , the date from which Chapter IV applies, except that Article 51(1), points (b), (f), (g), (m) and (p), which name categories of the electronic health data that can be made available for secondary use, apply from (Article 105).
- Honor a natural person's right to opt out at any time, and without providing any reason, from the processing of personal electronic health data relating to them for secondary use under the Regulation, and keep the exercise of that right reversible (Article 71(1)).
- Once a natural person has exercised the right to opt out, and where personal electronic health data relating to them can be identified in a dataset, do not make those data available or otherwise process them pursuant to data permits issued under Article 68 or health data requests under Article 69 approved after the person exercised the right; this does not affect processing under data permits or health data requests issued or approved before (Article 71(3)).
- Where the purposes of your processing of personal electronic health data as a health data holder do not or no longer require the identification of a data subject by the controller, you are not obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the right to opt out (Article 71(8)).
Who enforces it
Enforcement body
The health data access bodies that Member States designate under Article 55, which monitor and supervise compliance by health data users and health data holders with the requirements of the Regulation (Article 57(1), point (a)(ii)); a complaint concerning the rights of natural persons pursuant to Article 71 is transmitted to the competent supervisory authority under Regulation (EU) 2016/679 (Article 81(4)).
What this law does
Article 1(2), point (a), states that the Regulation specifies and complements the rights laid down in Regulation (EU) 2016/679 of natural persons in relation to the primary use and secondary use of their personal electronic health data.
Article 71(1) gives natural persons the right to opt out at any time, and without providing any reason, from the processing of personal electronic health data relating to them for secondary use under the Regulation, and provides that the exercise of that right shall be reversible.
Article 71(2) requires Member States to provide an accessible and easily understandable opt-out mechanism by which natural persons may explicitly state that they do not wish to have their personal electronic health data processed for secondary use.
Article 71(3) provides that, once a natural person has exercised the right to opt out, and where personal electronic health data relating to that person can be identified in a dataset, the data shall not be made available or otherwise processed pursuant to data permits issued under Article 68 or health data requests under Article 69 approved after the person exercised the right, and that this does not affect processing under data permits or health data requests issued or approved before.
Article 71(4) lets a Member State provide in its national law for a mechanism to make data for which a right to opt out has been exercised available, where a public sector body, a Union institution, body, office or agency with a public health mandate, or another entity entrusted with public tasks in the area of public health applies for processing necessary for the purposes in Article 53(1), points (a), (b) and (c), or for scientific research for important reasons of public interest, the data cannot be obtained by alternative means in a timely and effective manner under equivalent conditions, and the health data applicant has provided the required justification.
Article 71(8) provides that, when the purposes of the processing of personal electronic health data by a health data holder do not or no longer require the identification of a data subject by the controller, the health data holder shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the right to opt out.
Article 105 applies Chapter IV, in which Article 71 sits, from , and applies Article 51(1), points (b), (f), (g), (m) and (p), from . Article 81(4) provides that a complaint concerning the rights of natural persons pursuant to Article 71 is transmitted to the competent supervisory authority under Regulation (EU) 2016/679.
Article 99 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64. Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation in accordance with Union and national law.
When LexLint raises it
When your app profile says your app handles health records.