Finland - Act on the Secondary Use of Health and Social Data
Finland has become the first European country to launch a prototype health data space (Health Data Space). The country passed an GDPR-compliant law in 2019 that allows the government to bundle citizens' health and welfare data in one agency (Findata). There were transitional measures in place since the law was introduced, but since May 1 2021, the new law has entered into force.
The purpose of the law is to facilitate effective and secure processing of and access to personal social and health data for the purpose of guiding and monitoring government processes and research, development and innovation in the health and social sectors. A second goal is to ensure the rights and freedoms of citizens in the processing of personal data.
What: law
Impact level: 1 - law
For who: policy makers, digital service providers and users, businesses, research organisation
Relevant for Flanders:
In our country, projects on health data spaces have also already been launched. Sciensano is participating in the Joint Action Towards the European Health Data Space (TEHDAS) project. In Flanders, Domus Medica, the Koning Boudewijnstichting, VITO (Flemish Institution for Technological Research), the Vlaams Patiëntenplatform vzw and Zorgnet Icuro are working on a system called We Are. However, there is no legislative initiative yet to regulate secondary sharing of health data.
The Finnish legislation is ahead of the European proposal, which will be presented this autumn. It is already interesting for our country to observe how Finland approaches this issue
Summary
The secondary use of health and welfare data means that user data created during activities in the health and social services sector will be used for purposes other than the primary reason for which they were originally stored. These data may then be used for scientific research, to gather information for the policy process through statistics, or to adjust the functioning of government.
Europe
The creation of a European Data Space is one of the Commission's priorities for the current legislature (2019-2025). It is part of two different plans of the European Commission, which on the one hand wishes to create a European Health Community, and on the other hand wishes to work on a European Data Strategy.
According to the Commission, the European Health Data Space:
- promotes the secure sharing of patient data and citizens' control over their health data
- supports research on treatments, medicines, medical resources and results
- encourages access to and use of health data for research, policy-making and regulatory purposes, with a trusted governance framework and in compliance with data protection rules
- supports digital health services
- clarifies the safety and liability of AI in health care settings
The European Commission is also working on a legislative proposal to regulate spaces for health data. This proposal is expected by the end of 2021.
Finland
Finland is therefore ahead of the European Commission and has recently put into operation a prototype health data space.
Why is Finland shifting gears so quickly?
Finland has a long tradition of collecting data in registries, but various causes such as privacy restrictions and technical requirements have made the use of the data challenging. By introducing legislation early, the country can already enjoy the benefits of this health and welfare data. Enabling secondary use of health data can benefit an entire ecosystem of organizations (e.g., start-ups, research institutions, the pharmaceutical industry). If Finland has to wait for the European regulation, it will lose valuable time while it already has the data at its disposal.
What does the law entail?
Through this law, the country intends to enable the efficient and secure processing of personal data collected during the provision of welfare and health services, as well as personal data collected for the purposes of steering, monitoring, research and the collection of statistics on the welfare and health sector.
The law will enable smoother and faster processing of data permits, easier comparison of data from different registries, easier and more efficient use of valuable welfare and health materials in research and development and knowledge management among service providers. The law will also improve data security.
Data authority
To streamline and secure the secondary use of welfare and health data, the law also provided for the creation of a new government agency, Findata. The government agency is part of the National Institute for Health and Welfare, but is separate from the other activities of the government department.
Findata
provides data collection and security on the one hand, and permitting and guidance services for organizations that wish to use the data on the other hand.
An organization wishing to use data must apply for a permit when:
- data from different data controllers are combined
- the registry data comes from private providers of welfare and health services
- the data is stored in government databases (Kanta services)
There are two different levels of data provided by the Findata system, and different ways to access it:
- Individual-level data: data that can be used for scientific research, statistics, education, guidance by authorities, monitoring, planning and prognoses. These data are available for a certain period of time in a remote access environment. The data are anonymized or pseudonymized. A plan for the use of the data is required for data access
- Data at the statistical level: data that can be used for the above purposes and, in addition, for development and innovation and knowledge management. This type of data is provided directly to customers.