The Finnish Act on Secondary Use of Health and Social Data Provides New Business Opportunities

Author: Juli Mansnérus

In principle, the General Data Protection Regulation prohibits the processing of special categories of personal data, such as health data. In the current data economy, this prohibition has created a conflict between individual rights, such as privacy, and the imperatives of economic growth. Ahead of Finland’s Presidency of the Council of the European Union starting from July 2019, the Finnish Innovation Fund Sitra recently published a policy brief on a fair data economy.  The brief lays out suggestions on how the aforementioned conflict could be resolved in a manner that provides value for users, startups, and established companies alike. In the spirit of the brief and building on the legal groundwork provided by the General Data Protection Regulation, the Finnish Government recently approved a new Act on the Secondary Use of Health and Social Data (the “Act”).

The purpose of the Act is to facilitate effective and safe access to the data collected, for example by the private sector, in the context of public healthcare and social welfare for e.g. research, development, and innovation purposes. At the same time, the Act aims to guarantee individuals’ expectations with respect to their rights and freedoms, such as privacy. Since more data will be available for medical research and innovation through the Act’s implementation, it is expected that the Act would ultimately enable closer cooperation between the public and private sectors and consequently improve the provision of services and treatment in healthcare and social welfare along with more effective medicines.

At the moment, public health and social data is spread around in different information systems managed by many different authorities, which makes data request processes slow and strenuous. The Act will facilitate smoother collection of data from these separate systems and allow for smoother and faster processing of access permits. In practice, data requests and granting of licenses for the secondary use of health and social data would be managed by a licensing authority. A successful data request will grant an access aggregate data that is not related to identifiable individuals. This is ensured by the licencing authority, who collects the data from different registers and aggregates it before providing the data to the requestor. Such aggregate data may be used for wide development and innovation purposes. In comparison, access to unaggregated data may be requested by the means of a secondary use licence, which may be granted for narrower purposes, such as scientific research.

In order to gain access to aggregate data for development and innovation purposes, it is required that the requestor can demonstrate that the purpose of the development and innovation actions is to advance public health or social welfare, develop public healthcare or social welfare services or systems, or to protect individuals’ health or wellbeing or their rights and freedoms related to health or wellbeing. In practice, the aforementioned requirements could be satisfied by attaching an adequate research or project plan to the data request. In comparison to the above requirements, granting of a secondary use licence is subject to stricter requirements. The licence applicant must for example demonstrate that it intends to process the data in alignment with applicable laws, such as the GDPR and the Finnish Data Protection Act. It is also required that access to the data is the most appropriate mean to achieve the purpose of the envisaged secondary use.

The Act on the Secondary Use of Health and Social Data is expected to enter into force on 1 May 2019, and the processing of data requests and licence applications is expected to start on 1 January 2020. The Act is an interesting attempt to balance individuals’ privacy with economic interests. However, the legislator’s decision to restrict access to aggregate data only to purposes which are related to healthcare or social welfare imposes limitations on the use of the data for the purposes of e.g. wider big data applications, which may leave some of the data’s potential value unused. Nevertheless, it will be interesting to see if and how the Act shapes the cooperation between the public and private sectors, the Finnish health technology sector, and the quality of healthcare and social welfare services.