Insights | November 19, 2019

Secondary use of health data – the new Finnish Act

While there may be a sentiment that GDPR, the EU General Data Protection Regulation 2016/679, has limited the possibilities for commercial and scientific use of personal data, there are also local trends pointing in the opposite direction. The GDPR allows for derogations in the legislation of Member States as regards the use of personal data e.g. for scientific purposes. Finland has exceptionally extensive and high-quality data resources in the health and social welfare sector, and the government has taken action to enact several local laws facilitating the use of such resources for research and development purposes, e.g. by introducing legislation on secondary use of health data and by preparing new genome legislation.

New Act on Secondary Use of Health Data

Primary use of health and social data refers to the purpose for which the data has originally been recorded. Secondary use means the use of this information for other, secondary purposes. The purpose of the new Finnish Act on Secondary Use of Health and Social Data 552/2019 (in Finnish: Laki sosiaali- ja terveystietojen toissijaisesta käytöstä) is to establish conditions for the effective and secure processing of, and access to, personal health and social data for certain secondary purposes, such as research and statistics, innovation and development, knowledge management, teaching and authority planning. Thus, the Secondary Act creates a clear legal basis for the use of such registered data for research and innovation related to, for example, the health and well-being of citizens, the prevention of disease and the development of new treatment methods. New legislation is also a welcome unification of the fragmented national rules regarding the use of healthcare and social welfare data. In addition, it takes into consideration current data protection requirements. Furthermore, data permits and services will now be provided by a single service operator, based on a “one-stop-shop” principle.

Increased data security and privacy for individuals

The Secondary Act brings the legislative area into compliance with the GDPR. It will significantly raise the level of data security and privacy for individuals, since it requires the social and health data to be processed in a closed, data-secure and access-monitored environment. A new Data Permit Authority, Findata, which will start its work in 2020 and which acts in connection with the National Institute for Health and Welfare and under the supervision of the Ministry of Social Affairs and Health, grants data permits based on applications relating to access to data of several authorities, Kanta services’ data (i.e. the nationwide digital services consisting of prescription and patient data repository and healthcare and social welfare care data archives), and private social and health service providers’ registered data for some of the secondary purposes, such as scientific research and statistics. The data may be given in an anonymized, pseudonymized or aggregated form, which is the case for innovation and development purposes going beyond traditional research activities. However, this requires that the innovation and development activities promote national health or social security, develop social and health services or service systems or protect the health or well-being of individuals, or protect their rights or freedoms.

Facilitated knowledge management through a clearer legal basis

Knowledge management by healthcare and social care service providers is one of the grounds for secondary use of data. The new legislation provides that the collation of data, which is required for knowledge management purposes, from the service provider’s registers is possible without authorization from the data permit authority. Thus, service providers can use their collected/registered data for monitoring and developing the functionality and efficiency of their services in the future. This enables the establishment of service systems and better functioning service entities, for instance for those who use a broad range of services.

New opportunities in healthcare and social welfare

Finland has exceptionally extensive and high-quality data resources in the health and social welfare sector. The centralized system for the administration of information will significantly facilitate access to data for data users due to reduced bureaucracy and combined data sources. From a business perspective, easier access to more extensive data provides an opportunity for new business models in addition to giving the research and innovation sector a further boost. From the individual’s perspective, this development allows for better healthcare and social welfare services as well as more effective medication and treatment.

Part of a major legal reform in the field of medical research

In addition to the Secondary Act, other legislation relating to the changes introduced by the GDPR into the field of medical research is also currently being drawn up by the Ministry of Social Affairs and Health. The draft new Genome Act, the purpose of which is to support responsible, equal and secure use of genomic data for the benefit of human health by e.g. establishing a Genome Center, has recently undergone a consultation process, and the Government Proposal will be submitted to the Parliament in the fall of 2019. Currently, the aim is for the Genome Act to enter into force on 1 January 2020.

Furthermore, the Biobank Act 688/2012, which entered into force on 1 September 2013, is being amended in order to further improve biobank-related research by automatically allowing the use of hospital-based biological samples collected during the treatment, unless the individual denies such use. In 2018, the Government Proposal underwent a consultation process, and a new consultation process will take place in fall 2019. Collectively, these laws provide an opportunity to shape the future of medical research as well as to further develop personalized medicine and improve public health, while at the same time adhering to privacy-related matters.

Conclusions

According to the Government Proposal, the objective of the Secondary Act is to facilitate the use of health data for development and innovation purposes that are not included in scientific research. However, since the proposal changed significantly during the course of its handling at parliamentary committees, the circumstances in which access can be obtained to health data for non-scientific research remain somewhat limited. This may limit the potential of the new legislation to meet its above referred objectives. However, there is clearly a growing interest on the Finnish market in making use of the new routes to access health and social care data and several pilot projects are being planned. It remains to be seen whether the legislation will result in better cooperation between the public sector and the private sphere, and what kind of an impact it will have on the services and technologies provided to individuals.