Patricia Cervera de la Cruz
Teodora Lalova-Spinks
Mahsa Shabani- 1Faculty of Law and Criminology, Ghent University, Ghent, Belgium
- 2Faculty of Medicine and Health Sciences, Ghent University, Ghent, Belgium
- 3Faculty of Law, University of Amsterdam, Amsterdam, Netherlands
Introduction: The European Health Data Space (EHDS), the European Union’s new regulatory framework for health data use and reuse, will have important implications for citizens across the Union. While the regulation aims to empower citizens in the primary use of their health data-such as by giving them access to their electronic health records-their role in the secondary use of health data remains less clearly defined.
Methods: To explore this, we interviewed health data experts across 23 European countries to understand their perspectives on citizen involvement in data reuse.
Results: Our findings reveal that while the provision for an opt-out mechanism provides individuals with control, its practical implementation requires careful design to ensure accessibility and operability. Experts also emphasized the importance of broader citizen engagement, both to raise awareness about the EHDS and to incorporate citizens’ perspectives into governance structures. Furthermore, clearly demonstrating the value of the EHDS was perceived to be crucial for fostering public trust and acceptance.
Discussion: The study provides valuable insights for Member States in developing strategies to engage citizens in the secondary use of health data under the EHDS framework. It highlights the importance of an easily accessible opt-out mechanism, reinforced by clear and effective communication to prevent misinformation, emphasize the tangible benefits of data sharing, and account for the influence of institutional trust and country-specific contexts in shaping public attitudes toward the EHDS.
1 Introduction
The European Health Data Space (EHDS) (1) is a new EU regulation which sets rules for the use and reuse of health data across all Member States (MS). A key aspect of this regulation is the secondary use of health data—its reuse for purposes beyond individual care—which is crucial for advancing research and innovation in healthcare (2, 3). Artificial intelligence (AI) tools designed to be used in healthcare settings, for instance, require vast amounts of diverse health data to be properly validated and ensure representativeness. Furthermore, having access to health datasets is also critical for evaluating the impact of health policies and improving the efficiency of clinical trials (4), among other things. By mandating that health data holders share data within secure processing environments (EHDS, Article 73) and through Health Data Access Bodies (HDAB), (EHDS, Article 55) the EHDS aims to facilitate these exchanges while ensuring security and oversight.
Much of the discussion on the regulation, especially regarding the primary use purposes, has claimed that the EHDS “will empower individuals to take control of their health data” (5). This claim seems to be supported by certain provisions for the primary use of health data in the regulation such as Article 3, which grants citizens access to their electronic health records or Article 7, which allows them to request the transfer of their health data across borders. In turn, in the secondary use of health data—which also involves the use of citizens’ data—it seems equally important to allow individuals to be engaged in decisions about how their data is used for secondary purposes.
A citizen-centered approach to health data governance has been encouraged to ensure that citizens feel valued and included in conversations and decision-making about the secondary use of their health data. (6) However, there remains ambiguity regarding the extent and manner of citizen involvement in control and oversight of health data reuse. While some communities have grown distrustful of researchers due to past data use without their knowledge and involvement (7–9) and expect to remain in control over their data (10, 11), other empirical evidence suggests that many citizens are not always necessarily interested in direct involvement or control—provided proper safety measures are in place (12, 13).
In the EHDS, with regards to the secondary use, citizens, at an individual-level, are primarily granted control over their health data through the right to opt-out. (EHDS, Article 71) This right gives individuals the choice to not have their health data processed for secondary use purposes, with the exception that this opt-out may be overridden on a MS level for purposes with strong links to the public interest (EHDS, Recital 54). The opt-out was initially not included in the EHDS proposal because of concerns about the costs of relying on consent, as described in the impact assessment report accompanying the proposal (14). This approach sparked intense criticism from stakeholders, who argued that it failed to respect individuals’ rights (15–19). Critics argued that the EHDS proposal’s interpretation of consent as being burdensome and costly overlooked the value of a consent model and did not adequately consider possible alternatives such as broad consent or dynamic consent (20), which have been widely discussed in the literature (20–22) and supported by empirical evidence (23–25). Moreover, some critics also argued that an opt-in approach might be necessary (26), especially for certain types of health data, such as genetic data or sexual and reproductive health data, which they interpret to be more sensitive and/or at greater risk of reidentification (27).
Following this intense debate (28), the final regulation introduced the right to opt-out under Article 71 and gives MS the option to introduce rules and specific additional safeguards (which may include an opt-in) to certain types of health data, such as genetic data (EHDS, Recital 18). However, beyond the opt-out, which offers individual control to citizens, many questions remain surrounding citizen engagement under the EHDS, such as how information should be communicated to citizens, how to operationalize the opt-out or how to engage citizens at a collective level through governance structures, such as HDABs.
We argue that with the implementation of the EHDS, there is a renewed opportunity to discuss the effective engagement of citizens in the secondary use of their health data. This study examines how health data experts perceive the role of citizens in light of the upcoming regulation—how they should be engaged and what mechanisms could empower them to exercise meaningful control over their data.
2 Materials and methods
2.1 Study design
2.1.1 Data collection
The study team developed a semi-structured interview guide (Supplementary Material 1). The interview guide was pilot-tested with one of the co-authors to assess content and understandability. Feedback from this pilot led to a shortening of the guide, improvements in the flow between sections, including the reordering of several questions and the reformulation of a few questions. The interviews were all conducted by PC, a female PhD candidate with training in qualitative research methods, with the presence of MS for some interviews. All interviews were performed between March 2024 and August 2024. All interviews were conducted in English. Interviews were audio and video recorded via Microsoft Teams and transcribed ad verbatim, with potentially identifying information eliminated to ensure confidentiality. The planned length of interview was one hour, with the average interview time being 50 min. Written informed consent was sought from all participants.
The study was approved by the Ethical Committee at the Faculty of Law and Criminology at Ghent University.
2.2 Research team
The research team consisted of three persons: PC, MS, and TLS. PC, MS and TLS designed the interview guide, which was informed by the authors’ prior studies (29, 30) and on the regulatory discussions taking place at the time PC and MS conducted the interviews. Transcripts were coded by at least two members of the research team, and discussed in periodic meetings with all three researchers.
2.3 Participants and recruitment
We conducted interviews with 27 experts involved in the secondary use of health data in 23 different European countries, covering all four regions of Europe as defined by EuroVoc (31), ensuring comprehensive continental coverage, as shown in Figures 1, 2. Most of the interviews were one-to-one. For one interview, three participants from the same institution requested to be interviewed together, which was accommodated. We relied on purposive and snowball sampling.
Figure 1. Overview of the interviewees by location and organization.
Figure 2. Map of participants’ geographical distribution.
2.4 Analysis
To analyze the data, we relied primarily on thematic analysis. We performed an inductive content analysis, where the content categories are derived from the data, rather than pre-determined (32, 33). Transcripts were coded into narrow content categories in NVivo 14 software by Lumivero. The initial coding categories informed the analysis, but for clarity and conciseness the subsections in the Results reflect higher-level themes that combine several of these categories rather than directly mirror the original coding framework. The first part of the results, which reveal health data experts’ expectations regarding the implementation of the EHDS, have been reported in a separate paper (34).
3 Results
The results of our study describe the views of health data experts regarding citizen engagement and empowerment under the EHDS. These issues were raised in the discussions about the opt-out mechanism, the obligations for citizen engagement under the regulation and the importance of demonstrating the value created by the EHDS for citizens.
3.1 Opt-out: empowering citizens, navigating implementation challenges, and ensuring effective communication
Many participants view the opt-out as a significant step in respecting citizens’ rights and empowering them. By providing an option to exercise control over their data, participants believe that the opt-out can help to foster a sense of agency among individuals.
“(…) [opt-out] is a safeguard for people to understand that they have rights and they can exercise it whenever they want” (P25).
However, participants also recognize that the opt-out represents a fundamental change from traditional practices, where consent has typically been sought from citizens. Conversely, in countries where certain types of health data have historically been collected without individuals’ explicit consent, participants noted that the opt-out introduces new rights for citizens.
Additionally, many welcomed the opt-out for its potential to improve the representativeness of health data, reducing selection biases, presuming a majority will not opt-out. However, concerns remained about a large number of opt-outs, for others.
“You want people not even to think about opting out because opting out is of course always a threat for research. And if the research is not based on a sample that is representative or even exhaustive for the whole population, you cannot do anything with your research results. So the opt-out at a massive scale is a big a threat for research” (P21).
Participants emphasized that the success of the opt-out system hinges on how it will be implemented. They stressed the importance of making it truly understandable and accessible, often drawing comparisons to the opt-out system for organ donation, which some found inadequate due to the difficulty in exercising the option.
“If you really believe in opt-out, you need to inform people and give them that right. There is no right to opt-out if you create a little software somewhere but you never tell people about it” (P8).
Participants also recognized that cultural sensitivities toward data protection and consent could significantly influence the opt-out’s acceptance. In some countries, historical distrust in institutions could lead to higher opt-out rates. Striking the right balance in communicating the opt-out was seen as a challenge. Some worried that excessive publicity could result in a surge of opt-outs. As one participant put it, the opt-out should be:
“(…) accessible, not too complicated, not too much in your face either” (P20).
Views were mixed on the level of granularity the opt-out should offer. Some questioned the feasibility of allowing citizens to opt-out at the level of specific research questions or themes, while others emphasized that a granular approach would be necessary to comply with the EHDS provision allowing individuals to request not to be informed of clinically significant findings. Participants also highlighted the technical challenges of implementing a national opt-out system, emphasizing the need for a centralized mechanism that ensures individuals only have to opt-out once, with this choice being reliably recorded and recognized across all national databases.
Reflecting on their own experiences, participants suggested ways to improve implementation. Some advocated for every citizen to receive a physical letter, while others favored digital solutions, such as integrating the opt-out into existing health information platforms. One participant noted that in their country, citizens can already opt-out of primary use via a digital platform, with an available alternative physical office for those unable or unwilling to opt-out online.
Many participants expressed concerns that misinformation campaigns could heavily influence citizens’ decisions to opt-out, pointing to cases where similar misinformation had already triggered mass opt-outs. This issue was especially concerning for participants in countries where an opt-out for the primary use of health data is already in place or will soon be introduced, as they feared that widespread opt-outs could disrupt healthcare delivery and limit the completeness of medical records. Additionally, participants warned that political debates surrounding the EHDS could further amplify misinformation, potentially turning the opt-out into a polarizing issue.
To address this, participants advocated for proactive dissemination of clear, reliable information and education to ensure citizens make informed decisions about the EHDS and the opt-out system, noting that those with poor digital health literacy or low institutional may be more likely to opt-out, potentially skewing data representativeness. One participant described efforts to publish trustworthy resources to counter misinformation about the EHDS:
“So for now, we’re just building the base and just talking about, just making sure all of that information is out there and not from articles that are like, oh my god, the EU is stealing my data” (P27).
Many also emphasized the importance of communicating that health data will largely be anonymized, arguing it could help build public trust. However, others argued that citizens’ concerns about the secondary use of health data extend beyond anonymization. Some participants pointed out that even when data is anonymized, its reuse of health data can still reveal information about specific groups, potentially affecting individuals indirectly. They cautioned that focusing solely on anonymization might not fully address public concerns:
“Uhm, like in more than just anonymizing because this idea, again, are really false idea, that this idea that once data has been anonymized, there’s no more risk to the individual. This is completely false and not the way in which people think about their data” (P1).
3.2 Engaging citizens: strategies and challenges
Participants stressed the need to tailor engagement strategies to different groups, particularly distinguishing between patients and the general public. They noted that individuals without significant health concerns—such as younger people—may be less inclined to share their health data, often viewing it through the lens of personal benefit rather than collective wellbeing.
Crucially, participants stressed that engagement efforts must be undertaken with respect to individuals and must be purpose-driven.
“(…) you absolutely have to emphasize is the kind of active engagement and it needs to be, not just tokenistic, it has to be really meaningful engagement with the entire system” (P13).
In this sense, some participants advocated for involving citizens not just as recipients of information but as active contributors to shaping the implementation of the EHDS. They suggested that engaging citizens in discussions about contentious issues—such as overriding the opt-out for public interest purposes—could help align policies with public values and build trust. However, others pointed out that, in their respective countries, there was little tradition of citizen involvement in policy implementation, making bottom-up engagement unlikely. Moreover, others also emphasized the need to respect individuals’ right not to be informed or engaged. They noted that while not every citizen needs to be actively engaged in the secondary use of health data, this passivity should not come at a cost and institutions should ensure that those who choose not to engage are still adequately protected.
“(…) sometimes in the Brussels bubble, people want to, sorry, they want to see the citizen as a sort of a super active and super participant. But people are busy with their lives, you know? They want us to make it simple for them. And also they want us to make it trustworthy enough they don’t have to worry about it” (P8).
Participants also expressed mixed views on citizen participation in the governance structures of the EHDS. Many were unsure how to ensure citizen involvement was meaningful and the extent to which efforts should be made to engage them. Some also voiced concerns about the involvement of patient representatives and organizations, arguing that these groups can sometimes be biased toward their specific diseases and interests:
“(…) but those groups are highly politicized as well. And so it’s going to depend a lot. If you’re talking to a patient organization focusing on rare diseases, you’re going to get completely different answers compared to the patient organization working on cancer” (P1).
Participants emphasized the vital role of patient representatives in promoting the EHDS and engaging the public. These representatives, having first-hand experiences with the benefits of secondary health data, were seen as powerful advocates. Their positive experiences—often tied to improved healthcare outcomes—position them as effective messengers for informing citizens and therefore reducing opt-outs.
Similarly, healthcare professionals were recognized as highly trusted stakeholders, making them essential for engaging citizens. Many participants suggested that securing the support of healthcare providers is critical for EHDS engagement efforts, as their general trustworthiness and direct patient interactions make them more effective in building trust than government or administrative bodies.
“(…) people generally have a good trust in the healthcare provider in the doctor, the nurse and so. But they don’t have such a good trust in the government and in the healthcare administrators” (P18).
One participant highlighted an example from their country where physicians actively campaigned against the introduction of an electronic health record system, leading to a higher-than-expected number of opt-outs. This experience underscored the importance of securing healthcare professionals’ support to prevent a loss of citizens’ trust.
3.3 Demonstrating the value of the EHDS to citizens
Participants highlighted the need to demonstrate the tangible benefits and societal value of the secondary use of health data. They stressed that citizens must see a meaningful return on the use of their data, seeing this as essential to fostering trust and reducing resistance.
“I think, especially in (country), where we make this cultural change from opt-in to opt-out, it is super important that we can also prove and show that the European health data space actually does something back for society because that’s the only way to get trust also from our citizens. So I think for (country) at least, it is a very important topic. I think we have to really look into how can we build an ecosystem, an EHDS ecosystem that actually encourages, but also proves the return to society especially when it comes to big companies, as I don’t know Big Pharma, for instance, using their data” (P7).
Another participant highlighted that the decision to opt-out is closely tied to the perception of value creation. They argued that without a clear and compelling explanation of how the EHDS benefits both individuals and society, encouraging participation will be challenging.
“So when we talk about the EHDS (…), without engaging citizens, without social innovation, without describing the value we are able to provide together for everybody, it won’t succeed” (P10).
Participants expressed concerns about a potential imbalance between public and private benefits under the EHDS. While some saw the EHDS as a platform for societal advancement, others worried private companies, such as pharmaceutical firms, would disproportionately benefit from data access. Moreover, many regretted that the regulation lacked specific requirements to guarantee open-source availability of research outcomes and questioned whether public value would be prioritized.
“And then the question is whether in general, you can demonstrate that the public value it creates is more than sort of the privately appropriated value that it creates. And we would hope that if we happen to end up being sort of the HDAB (…), that we are not only servicing super motivated rich private sector companies with health data, but that it’s actually something that helps healthcare research and that helps planning and where we can also be creative in, for instance, accessing privately held data from health care providers to get more patient-reported data into the system and evaluate on that basis” (P20).
Some viewed the secondary use of health data as a means to advance health research and drive innovation, with broad societal benefits such as improving public health. However, they acknowledged the challenge of fostering a sense of solidarity among citizens. They stressed the importance of communicating how collective contributions lead to meaningful long-term benefits, even if these benefits are not immediately visible to individuals.
“How can we make sure that people understand that even though it’s very insignificant, your little piece of information is important together with the rest of us and that will in the future give results for your, I don’t know, children, grandchildren because it takes that long time and that can be frustrating itself” (P6).
Others argued that beyond emphasizing societal-level benefits, such as improved research opportunities, it was necessary to address individual-level value– the “what’s in it for me”– to convince citizens of the EHDS’ value.
“Always the secondary use of the data the question is: why? Why should I consent? Because what is the benefit for me?” (P17).
To make the value of secondary use under the EHDS clear, participants suggested initiatives such as building dedicated websites showcasing data-driven outcomes, organizing national conferences, linking datasets to academic publications, press releases showcasing successful use cases, and engaging with civil society organizations. However, despite these efforts, many acknowledged that societal-level benefits might remain abstract compared to the tangible, individual benefits of primary health data use, such as accessing one’s own health record.
4 Discussion
Our study revealed different perspectives among experts on how citizens should be involved in the governance of secondary use. Some emphasized the importance of individual control mechanisms, such as the opt-out, while others argued for structured engagement mechanisms, such as representation and involvement in governance bodies. Additionally, participants underscored the need for clear communication and demonstrating value creation, ensuring that citizens not only understand how their data is used but also perceive tangible benefits from participation.
Citizens can exercise individual control over the secondary use of their health data through the opt-out mechanism in the regulation. While the adoption of this right has generally been welcomed, some MS—including Finland, Denmark (both of which voted against the regulation in the Council) (35) and Estonia—remain dissatisfied. Estonia, for example, in a statement made to the Permanent Representatives of the Committee/Council following the first reading of the legislative act on the 14th January 2025, expressed concerns the opt-out could compromise data quality and completeness, thereby weakening scientific research and innovation. They stated:
“We remain concerned that the obligation to Member States to provide the right to opt out from the secondary use of health data is not in line with the objectives of this Regulation and does not ensure the right balance between individual rights and common public interests. While citizens’ rights and fundamental freedoms need to be protected at any time, there are important safeguards foreseen in EHDS Regulation that can be put in place to ensure that data processing is lawful, secure and in compliance with the GDPR. The introduction of a general opt-out would not contribute to greater data security but entails a risk of eroding the quality and completeness of datasets that are necessary for high quality scientific research and breakthrough innovations” (36).
In addition, Finland and Denmark also highlighted in their statements in the Council that they expect the implementation of the opt-out to be technically complicated (36). This was also reflected as a concern in our study, as there was unclarity over how the opt-out could be implemented across all the health data holders in MS, given that citizens’ health data is distributed across multiple registries and healthcare institutions. It seems further guidance will be needed for MS to adhere to the requirement to provide an “easily understandable and accessible user-friendly mechanism to exercise that right to opt out” (EHDS, Recital 54). It is crucial to prevent the opt-out from becoming an “empty gesture,” as seen with the NHS COVID-19 contact tracing app, which misleadingly continued collecting and sharing data even after individuals opted out (37).
While not explicitly stipulated in the regulation, it seems logical that MS should strive for harmonization in both the formulation and mechanism of the opt-out process. Aligning these aspects as closely as possible would help ensure that citizens across the EU have equal access to this right, preventing disparities that could lead to unequal treatment. Decisions on how to inform citizens about their right to opt-out, how to formulate the opt-out question and how citizens will be able to exercise this right need to be made early on to ensure they meets the requirements under the regulation and fully uphold and respect citizens’ rights. This harmonization could be facilitated through the HDABs Community of Practice (38), which brings together competent authorities and affiliated entities from EU MS and EEA countries.
Beyond affording citizens’ individual control over their health data, the EHDS establishes specific obligations to engage with citizens in the governance of secondary health data use. This includes participation in key bodies such as HDABs, [EHDS, Article 55 (4)] the EHDS Board [EHDS, Article 94 (2)(c)] and the steering groups of HealthData@EU [EHDS, Article 95 (6)]. Additionally, the regulation mandates engagement with citizens for the purpose of supporting digital health literacy and the development of relevant competencies and skills [EHDS, Article 84 (1)]. Citizens could further contribute to other existing health data governance bodies that are likely to closely interact with the EHDS, such as data intermediaries, data cooperatives and data altruism organizations. Likewise, MS which choose—or are required by national law— (EHDS, Recital 37) to incorporate the expertise of ethics committees in their HDABs, may plausibly integrate inputs from citizens and patients, who are often members of these committees. Such kind of patient and public involvement would follow current trends to actively incorporate these voices into public institutions, such as the European Medicines Agency (EMA) (39).
Ensuring meaningful citizen participation, however, requires more than governance structures—it also depends on clear and effective communication. Citizens may not understand terms such as “secondary use,” and a lack of clear information—or worse, the spread of misinformation—could lead citizens to opt-out. Some have suggested using “positive communication” strategies to emphasize the benefits of secondary use (40), while others have stressed the role of mass media and the press in promoting success stories of research outcomes (41), especially given that health data sharing in media narratives is often associated with data breaches or misuse (42–45). As revealed by Understanding Patient Data, “the media typically only discusses the process of using health data when something goes wrong” (46).
However, effective communication requires a careful balance. As reflected in our study, there is a perceived risk that if citizens receive too much information—or if it is framed in a way that overwhelms them— it may generate anxiety, and potentially large-scale opt-outs. This highlights the need to design communication strategies that are informative yet not exaggerated, ensuring that citizens are well-equipped to make informed decisions about their health data without feeling overburdened. MS should build on existing research in the field of science communication to develop plain language communication strategies to inform citizens about the EHDS and the uses of health data (47). Careful consideration should be given to the differing levels of digital access and literacy among various groups of citizens to ensure that information effectively reaches everyone (48).
To address this challenge, some participants in our study suggested that healthcare professionals, such as physicians or nurses, could help communicate information about the use of health data in the EHDS to citizens, especially given that experts perceived them to be highly trusted by citizens. However, this approach requires careful consideration, as it risks damaging patient trust if individuals feel that their doctors’ duty of confidentiality is being compromised due to promoting secondary uses. In fact, the Standing Committee of European Doctors (CPME) called for stronger protections for medical confidentiality, which were finally incorporated into the regulation (EHDS, Recital 24). Additionally, healthcare professionals have raised concerns that the EHDS could increase their administrative burden (49), so suggestions for them to take on this communication role with patients may be unwelcome and fuel resistance to the regulation. This concern is not unfounded—in the UK, a plan to share medical data was rejected by healthcare practitioners, who opposed the expectation that they should communicate this information to patients, citing excessive workload pressures (50).
More broadly, HDABs should develop public websites to provide citizens with clear up-to-date information about data requests, data access permits, available research results and penalties to non-compliant data holders and data users, among other things (51).
While clear communication is essential to meaningfully engage with citizens, developing effective strategies for engagement also requires a deeper understanding of the actual concerns that individuals have about the secondary use of their health data. As our study reveals, experts often assume that citizens’ primary concerns revolve around reidentification, often dismissing these concerns by arguing that the risks for reidentification are low (52), despite the EHDS acknowledging its significance (EHDS, Recital 92) and ongoing debates about the ability to meet anonymization requirements for health data (53), especially genomic data, under the GDPR (54). However, empirical studies suggest that individuals may have reservations about how their health data is used, even when it is anonymized (55). Indeed, some scholars have argued that health data uses can reveal group-level information, which extend beyond individual-level re-identification concerns (56). As Metcalf and Sadowski highlight:
“Data can be harmful even when decoupled from personal identity, and the people and communities which share data about themselves should have a stake in shaping how they’re used even when their data are de-identified” (57).
This concern over group interests was illustrated in a recent controversy involving anonymized UK Biobank data, which was used by a pseudo-scientific group with racist intentions (58). In response, a statement by the European Society of Human Genetics emphasized the importance of ensuring “that access procedures are governed by robust and transparent processes, including about how decisions are made on whether or not the proposed research is in the public interest” (58). This case highlights that citizens’ concerns extend far beyond reidentification risks—misuse remains a serious issue even when citizens cannot be individually identified.
Furthermore, the extent of citizen engagement needed across countries will likely depend on the level of trust that citizens have in public institutions, which will likely be different across MS due to their unique historical and cultural context. Indeed, Peters et al. argue that government credibility is critical in communicating health information and individuals’ willingness to accept these messages (59). In some countries, public skepticism toward institutions or traditionally heightened sensitivities around data protection are likely to result in greater public scrutiny of the EHDS. For instance, since the regulation’s announcement, Dutch tabloid newspapers have described the regulation as being a “gift” to Big Tech (60), arguing that pharmaceutical companies and technology giants would be the primary beneficiaries (61). Furthermore, the Dutch civil society organization “Privacy First,” labels the EHDS as an “excessive power grab by Brussels” (62). In those countries, proactive citizen engagement is essential—not only to foster informed public discourse but also to counter misinformation that could unfairly shape public opinion about the EHDS.
That said, even in countries with traditionally high levels of institutional trust, public reactions to new regulations can be unpredictable. In Finland, for example, media coverage of the EHDS in 2024 led to a surge of GDPR requests to Findata, as citizens sought to object to the processing of their personal data, resulting in delays to their services (63). This suggests that even in trust-rich environments like Finland (64), citizens may still be reluctant to share their health data for secondary use and choose to opt-out.
Given these complexities, it is crucial for MS to ground their citizen engagement strategies on empirical evidence that captures real input from individuals, whether through direct studies or public deliberation models, such as citizen juries (11, 65, 66). This approach is essential, even when findings challenge experts’ preconceived notions about citizens’ preferences and attitudes toward health data use (51). As our study reveals, health data experts’ perspectives may not always align with the concerns of general citizens. Understanding these nuances will be essential to fostering trust, ensuring meaningful participation, and addressing citizens’ actual worries effectively.
Finally, beyond informing citizens and addressing their concerns, effective citizen engagement should also ensure that individuals are aware of the tangible benefits resulting from the EHDS and how these benefits are returned to society. The EHDS may be expected to bring value in many ways, such as through improved scientific research and innovation. However, as noted by Kilgus et al., “this downstream value creation remains insufficiently explored” (67), particularly in terms of how it may ultimately improve healthcare services.
One way in which citizens may see value in data-sharing is through financial returns to the public healthcare system. Our study and the wider literature suggest that commercial entities could be charged higher fees for data access, with the profits reinvested into healthcare systems. This model is already used in three U.S. states, where commercial entities pay more than academic and non-profit institutions for access to health data (68).
However, since the EHDS mandates that the fees be cost-covering (EHDS, Recital 70) and prohibits profit generation, it would not be possible to see a return in monetary profit through fees. Instead, HDABs could explore alternative mechanisms to ensure that citizens see a return in value. One approach could involve agreements with commercial entities to provide priority access to or discounted prices for any medical devices, treatments or therapies that significantly benefited from access to health data. In a draft white paper by the Council of Europe, the Steering Committee for Human Rights in the Fields of Biomedicine and Health emphasized the need for reciprocity for public investment, arguing that since innovative treatments and technologies rely on publicly provided data, pharmaceutical companies and manufacturers should adopt pricing strategies, such as discounts, to ensure equitable access (69). A precedent for this can be seen in the AI firm Sensyne Health’s royalty share agreement with Oxford University hospitals in a project on finding new drug targets for Asthma through genetic sequencing data (70, 71).
Several civil society organizations have put forward similar suggestions, advocating for conditionalities such as making research results public and requirements to accept accessible price caps for medicines resulting from the use of health data when EHDS-facilitated research leads to commercially developed medicines or treatments (72). The European Public Service Union (EPSU) echoed this call for benefit-sharing in its proposed amendments to the EHDS, stating that:
“The profits generated from the collection or use of health data should benefit Member States’ health systems. This requires transparent and robust regulations to ensure that profits from using data are shared fairly and that the general interest takes precedence over private profit” (73).
Such agreements could complement other initiatives such as discounted access to health data for researchers and students, as currently offered by Findata, Finland’s health data permit authority (74). This aligns with Article 62 of the EHDS, which allows MS to establish reduced fees for public entities, including public sector bodies with a legal mandate in the field of public health and university researchers [EHDS, Article 62 (1)].
5 Strengths and limitations
This interview study is strengthened by its large and geographically diverse participant pool. However, participants from Western Europe are overrepresented, making up twice the number of those from other regions. This imbalance is likely due to the sampling approach used but may also reflect the differing levels of interest and involvement in the EHDS across different countries and regions. Additionally, the evolving nature of the EHDS regulation at the time of the study presents both a strength and a challenge—it makes the study particularly timely and relevant, yet it also means that perspectives were shaped in a shifting policy landscape that continues to develop.
Another limitation is the absence of citizen representation, despite the study’s focus on citizen engagement. To fully understand public perspectives, this study should be followed up by empirical research that captures citizens’ views on their involvement in the secondary use of health data, building on the substantial body of existing empirical research in this area.
6 Conclusion
The EHDS will have significant implications for the use and re-use of EU citizens’ health data. Given this, it seems essential that citizens, at least those interested, have the opportunity to be meaningfully engaged in the secondary use of their health data. At the individual-level, it is critical that citizens are adequately informed about their right to opt-out, with access to clear, balanced information that presents all perspectives—not just the most extreme or skeptical viewpoints— and ensures that the opt-out process is respected and easily accessible. Furthermore, the collective views of citizens should be adequately represented in governance bodies, with efforts to incorporate real, empirical input to ensure that these bodies reflect and address the actual concerns and expectations of the public. Lastly, citizen engagement strategies should focus on clearly communicating the benefits of secondary use under the EHDS and helping citizens understand the value of the regulation. By fostering citizen engagement, MS can ensure that the EHDS not only protects individual rights but also strengthens public trust in the reuse of health data.
Data availability statement
The datasets generated and analysed during the current study are not publicly available due to the conditions of informed consent provided by the participants, which limit data access to the study authors. Requests to access the datasets should be directed to cGF0cmljaWEuY2VydmVyYWRlbGFjcnV6QHVnZW50LmJl.
Ethics statement
The study was approved by the Faculty of Law and Criminology Ethics Committee at Ghent University. The study was conducted in accordance with the local legislation and institutional requirements. The participants provided their written informed consent to participate in this study.
Author contributions
PC: Formal analysis, Writing – review & editing, Writing – original draft, Methodology, Conceptualization, Investigation. TL-S: Methodology, Investigation, Writing – review & editing, Formal analysis, Supervision. MS: Conceptualization, Investigation, Writing – review & editing, Methodology, Formal analysis, Supervision.
Funding
The author(s) declared that financial support was received for this work and/or its publication. This work was supported by the Special Research Fund (BOF) at Ghent University and by PROPHET (A Personalized Prevention Roadmap for the Future Healthcare) which is funded by the European Commission under the Horizon Europe Research and Innovation Programme (grant agreement 101057721).
Conflict of interest
The author(s) declared that this work was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.
Generative AI statement
The author(s) declared that generative AI was used in the creation of this manuscript. During the preparation of this work the author(s) used ChatGPT-4o in order to improve readability. After using this tool/service, the author(s) reviewed and edited the content as needed and take(s) full responsibility for the content of the published article.
Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.
Publisher’s note
All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.
Supplementary material
The Supplementary Material for this article can be found online at: https://www.frontiersin.org/articles/10.3389/fmed.2025.1699941/full#supplementary-material
References
1. EU. Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (Text with EEA relevance). (2025). Available online at: http://data.europa.eu/eli/reg/2025/327/oj/eng (accessed February 11, 2025)
2. Pastorino R, De Vito C, Migliara G, Glocker K, Binenbaum I, Ricciardi W, et al. Benefits and challenges of Big Data in healthcare: an overview of the European initiatives. Eur J Public Health. (2019) 29:23–7. doi: 10.1093/eurpub/ckz168
3. Bates D, Saria S, Ohno-Machado L, Shah A, Escobar G. Big data in health care: using analytics to identify and manage high-risk and high-cost patients. Health Aff. (2014) 33:1123–31. doi: 10.1377/hlthaff.2014.0041
4. Jensen P, Jensen L, Brunak S. Mining electronic health records: towards better research applications and clinical care. Nat Rev Genet. (2012) 13:395–405. doi: 10.1038/nrg3208
5. European Commission. European Health Data Space. (2025). Available online at: https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space_en (accessed January 22, 2025).
6. de Freitas C, Amorim M, Machado H, Leão Teles E, Baptista M, Renedo A, et al. Public and patient involvement in health data governance (DATAGov): protocol of a people-centred, mixed-methods study on data use and sharing for rare diseases care and research. BMJ Open. (2021) 11:e044289. doi: 10.1136/bmjopen-2020-044289
7. Taitingfong R, Bloss C, Triplett C, Cakici J, Garrison N, Cole S, et al. A systematic literature review of Native American and Pacific Islanders’ perspectives on health data privacy in the United States. J Am Med Inform Assoc. (2020) 27:1987–98. doi: 10.1093/jamia/ocaa235
8. Sterling R. Genetic research among the Havasupai–a cautionary tale. Virtual Mentor. (2011) 13:113–7. doi: 10.1001/virtualmentor.2011.13.2.hlaw1-1102
9. Baptiste D, Caviness-Ashe N, Josiah N, Commodore-Mensah Y, Arscott J, Wilson P, et al. Henrietta Lacks and America’s dark history of research involving African Americans. Nurs Open. (2022) 9:2236–8. doi: 10.1002/nop2.1257
10. Biasiotto R, Viberg Johansson J, Alemu M, Romano V, Bentzen H, Kaye J, et al. Public preferences for digital health data sharing: discrete choice experiment study in 12 European countries. J Med Internet Res. (2023) 25:e47066. doi: 10.2196/47066
11. Rivas Velarde M, Tsantoulis P, Burton-Jeangros C, Aceti M, Chappuis P, Hurst-Majno S. Citizens’ views on sharing their health data: the role of competence, reliability and pursuing the common good. BMC Med Ethics. (2021) 22:62. doi: 10.1186/s12910-021-00633-3
12. Taylor M, Taylor N. Health research access to personal confidential data in England and Wales: assessing any gap in public attitude between preferable and acceptable models of consent. Life Sci Soc Policy. (2014) 10:15. doi: 10.1186/s40504-014-0015-6
13. Muller S, van Thiel G, Vrana M, Mostert M, van Delden J. Patients’ and publics’ preferences for data-intensive health research governance: survey study. JMIR Hum Factors. (2022) 9:e36797. doi: 10.2196/36797
14. European Commission. Impact Assessment Report Accompanying the document Proposal for a Regulation of The European Parliament and of The Council on the European Health Data Space. Brussels: European Commission (2022).
15. Marelli L, Stevens M, Sharon T, Van Hoyweghen I, Boeckhout M, Colussi I, et al. The European health data space: too big to succeed? Health Policy. (2023) 135:104861. doi: 10.1016/j.healthpol.2023.104861
16. Shrishak K. Problems With the Secondary Use of Health Data in the European Health Data Space. Dublin: Irish Council for Civil Liberties (2023).
17. The Standing Committee of European Doctors [CPME]. Position on the European Health Data Space. Brussels: The Standing Committee of European Doctors (2022).
18. European Data Protection Board [EDPB], European Data Protection Supervisor [EDPS]. EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space. Brussels: European Data Protection Board (2022).
19. The Pharmaceutical Group of the European Union [PGEU]. PGEU Position Paper on the European Health Data Space. Brussels: The Pharmaceutical Group of the European Union (2022).
20. Staunton C, Shabani M, Mascalzoni D, Mežinska S, Slokenberga S. Ethical and social reflections on the proposed European health data space. Eur J Hum Genet. (2024) 32:498–505. doi: 10.1038/s41431-024-01543-9
21. Wiertz S, Boldt J. Evaluating models of consent in changing health research environments. Med Health Care Philos. (2022) 25:269–80. doi: 10.1007/s11019-022-10074-3
22. Zenker S, Strech D, Ihrig K, Jahns R, Müller G, Schickhardt C, et al. Data protection-compliant broad consent for secondary use of health care data and human biosamples for (bio)medical research: towards a new German national standard. J Biomed Inform. (2022) 131:104096. doi: 10.1016/j.jbi.2022.104096
23. Richter G, Borzikowsky C, Hoyer B, Laudes M, Krawczak M. Secondary research use of personal medical data: patient attitudes towards data donation. BMC Med Ethics. (2021) 22:164. doi: 10.1186/s12910-021-00728-x
24. Muller S, van Thiel G, Mostert M, van Delden J. Dynamic consent, communication and return of results in large-scale health data reuse: survey of public preferences. Digit Health. (2023) 9:20552076231190997. doi: 10.1177/20552076231190997
25. Spencer K, Sanders C, Whitley E, Lund D, Kaye J, Dixon W. Patient perspectives on sharing anonymized personal health data using a digital system for dynamic consent and research feedback: a qualitative study. J Med Internet Res. (2016) 18:e66. doi: 10.2196/jmir.5011
26. European Digital Rights [EDRI]. EDRi Position Paper - Make the European Health Data Space Serve Patients and Research. Brussels: European Digital Rights (2023).
27. The European Consumer Organisation [BEUC]. Consumer Attitudes to Health Data Sharing. Survey Results From Eight EU Countries. Brussels: The European Consumer Organisation (2023).
28. European Cancer Organisation. The European Health Data Space and the opt-in versus opt-out discussion: ECO Statement of VIew. Brussels: European Cancer Organisation (2023).
29. Cervera de la Cruz P, Shabani M. Conceptualizing fairness in the secondary use of health data for research: a scoping review. Account Res. (2023) 32:233–62. doi: 10.1080/08989621.2023.2271394
30. Cervera de la Cruz P, Shabani M. Fair enough?: Exploring the role of fairness in secondary uses of health data in the European Health Data Space. 1st ed. In: Slokenberga S, Cathaoir KÓ, Shabani M editors. The European Health Data Space: Examining A New Era in Data Protection. Milton Park: Routledge (2025). 26 p.
31. EuroVoc. (2024). Available online at: https://eur-lex.europa.eu/browse/eurovoc.html?params=72%2C7206 (accessed November 29, 2024)
32. Braun V, Clarke V. Successful Qualitative Research: A Practical Guide for Beginners. Thousand Oaks, CA: Sage (2013).
33. Vears D, Gillam L. Inductive content analysis: a guide for beginning qualitative researchers. Focus Health Prof Educ Multi-Prof J. (2022) 23:111–27. doi: 10.11157/fohpe.v23i1.544
34. Cervera de la Cruz P, Lalova-Spinks T, Shabani M. Implementation of the European health data space: a qualitative study on expectations of health data experts from 23 countries. Health Policy. (2025) 161:105428. doi: 10.1016/j.healthpol.2025.105428
35. Council of the European Union. Voting Result Regulation of the European Parliament and of the Council on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 Adoption of the Legislative act 4073rd Meeting of the COUNCIL OF THE EUROPEAN UNION (Economic and Financial Affairs) 21 January 2025. Brussels: Council of the European Union (2025).
36. Council of the European Union. Draft Regulation of the European Parliament and of the Council on the European Health Data Space and Amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (first reading) - Adoption of the Legislative act - Statements. Brussels: Council of the European Union (2025).
37. Kuntsman A, Miyake E. Paradoxes of Digital Disengagement: In Search of the Opt-Out Button. London: University of Westminster Press (2022).
38. European Commission. Health Data Access Bodies – Community of Practice. Brussels: European Commission (2024).
39. Haerry D, Brooke N, Dutarte M, Geissler J. The evolving practice of patient and public involvement in Europe and the United States. Regul Aff Watch. (2021) 3:8–13. doi: 10.54920/SCTO.2021.RAWatch.6.8
40. Eit Health E. Recommendations for Further Action when Implementing the European Health Data Space in Germany: Think Globally, Act Locally. 1. Auflage. Göttingen: Cuvillier Verlag (2024).
41. Dempster G, Sutherland G, Keogh L. Scientific research in news media: a case study of misrepresentation, sensationalism and harmful recommendations. J Sci Commun. (2022) 21:A06. doi: 10.22323/2.21010206
42. Alltucker K. UnitedHealth Data Hack Impacted 1 in 2 Americans; What You Can do to Protect Yourself. (2025). Available online at: https://www.usatoday.com/story/money/2025/01/29/unitedhealth-data-hack-impact/77979132007/ (accessed February 13, 2025)
43. Das S. Private UK Health Data Donated for Medical Research Shared with Insurance Companies. The Observer. (2023). Available online: https://www.theguardian.com/technology/2023/nov/12/private-uk-health-data-donated-medical-research-shared-insurance-companies (accessed November 13, 2023)
44. The Brussels Times with Belga. Around 50,000 Medical Documents Leaked From Belgium’s MediCheck. Brussels: The Brussels Times (2024).
45. Los datos sanitarios, el objetivo de los hackers. (2025). Available online at: https://www.rtve.es/noticias/20250207/datos-sanitarios-europeos-objetivo-hackers-amenazas-son-constantes/16440843.shtml (accessed February 13, 2025)
46. Understanding Patient Data. Analysis of UK Reporting on Health Data Stories (2019-2020). London: Understanding Patient Data (2021).
47. Paprica P, McGrail K, Schull M. Notches on the dial: a call to action to develop plain language communication with the public about users and uses of health data. Int J Popul Data Sci. (2019) 4:1106. doi: 10.23889/ijpds.v4i1.1106
48. Julesz M. A perspective on the European health data space. Inf Társad. (2023) 23:9. doi: 10.22503/inftars
49. Standing Committee of European Doctors [Cpme]. Position on the European Health Data Space. (2022). Available online at: https://www.cpme.eu/api/documents/adopted/2022/11/cpme.2022-065.FINAL.CPME.position.EHDS.pdf
50. Royal College of General Practitioners, British Medical Association. RE: General Practice Data for Planning and Research - Communications With the Public. London: Royal College of General Practitioners (2021).
51. Saelaert M, Mathieu L, Van Hoof W, Devleesschauwer B. Expanding citizen engagement in the secondary use of health data: an opportunity for national health data access bodies to realise the intentions of the European health data space. Arch Public Health. (2023) 81:168. doi: 10.1186/s13690-023-01182-4
52. Viberg Johansson J, Bentzen H, Mascalzoni D. What ethical approaches are used by scientists when sharing health data? An interview study. BMC Med Ethics. (2022) 23:41. doi: 10.1186/s12910-022-00779-8
53. Dogan F, El Mestari S, Botes M. Techniques to achieve anonymization of health data: when are they sufficient to be considered as legally complaint? In: Meo R, Silvestri F editors. Machine Learning and Principles and Practice of Knowledge Discovery in Databases. Cham: Springer Nature Switzerland (2025). p. 388–400.
54. Shabani M, Marelli L. Re-identifiability of genomic data and the GDPR: assessing the re-identifiability of genomic data in light of the EU General Data Protection Regulation. EMBO Rep. (2019) 20:e48316. doi: 10.15252/embr.201948316
55. The Patients Association. Centre for Social Ethics and Policy - University of Manchester, The Patients Association, The Data Trusts Initiative. General Practice Data Trust (GPDT) Pilot Study: Report on Patient Focus Groups. (2023). Available online at: https://www.patients-association.org.uk/blog/gpdt-pilot-study-report (accessed February 11, 2025)
56. Francis L, Francis J. Data re-use and the problem of group identity. Stud Law Polit Soc. (2017) 73:141–64. doi: 10.2139/ssrn.3371134
57. Metcalf K, Sadowski J. Asserting the public interest in health data: on the ethics of data governance for biobanks and insurers. Big Data Soc. (2024) 11:20539517241290215. doi: 10.1177/20539517241290215
58. Pegg D, Devlin H, Burgis T. Concerns Raised Over Access to UK Biobank Data After ‘Race Scientists’ Claims. London: The Guardian (2024).
59. Peters E, Klein W, Kaufman A, Meilleur L, Dixon A. More is not always better: intuitions about effective public policy can lead to unintended consequences. Soc Issues Policy Rev. (2013) 7:114–48. doi: 10.1111/j.1751-2409.2012.01045.x
60. Schipper I, Leth D. Big-tech krijgt Een Groot Cadeau Met Dank aan de EU-Wet Voor gezondheidszorg [Big Tech Gets a Big Gift Thanks to EU Health Care Law]. (2024). Dutch. Available online at: https://www.trouw.nl/opinie/big-tech-krijgt-een-groot-cadeau-met-dank-aan-de-eu-wet-voor-gezondheidszorg∼b080bcd3/ (accessed December 20, 2024)
61. Leth D, Schipper I. Opinie: Datahonger Wint Het van Medisch Beroepsgeheim in Europese wet Voor Gezondheidsdata. de Volkskrant [Opinion: Data hunger trumps Medical Confidentiality in European Health Data Law. de Volkskrant]. (2024). Dutch. Available online at: https://www.volkskrant.nl/columns-opinie/opinie-datahonger-wint-het-van-medisch-beroepsgeheim-in-europese-wet-voor-gezondheidsdata$∼$b9f2d4ea/ (accessed December 20, 2024)
63. Findata. Delays in Findata’s Services Due to a High Number of Citizens’ GDPR Requests - Findata. Findata Social and Health Data Permit Authority. Finland: Findata (2024).
64. Organization for Economic Cooperation and Development [OECD]. OECD Survey on Drivers of Trust in Public Institutions 2024 Results - Country Notes: Finland. Paris: OECD (2024).
65. Tully M, Hassan L, Oswald M, Ainsworth J. Commercial use of health data-A public trial by citizens’ jury. Learn Health Syst. (2019) 3:e10200. doi: 10.1002/lrh2.10200
66. Ford E, Oswald M, Hassan L, Bozentko K, Nenadic G, Cassell J. Should free-text data in electronic medical records be shared for research? A citizens’ jury study in the UK. J Med Ethics. (2020) 46:367–77. doi: 10.1136/medethics-2019-105472
67. Kilgus T, Patecka A, Schurig T, Kari A, Gubser R, Gersch M, et al. Creating value from the secondary use of health data: international examples, best practices, and opportunities to scale. Commun Assoc Inf Syst. (2024) 55:507–34. doi: 10.17705/1CAIS.05520
68. Doshi J, Hendrick F, Graff J, Stuart B. Data, data everywhere, but access remains a big issue for researchers: a review of access policies for publicly-funded patient-level health care data in the United States. EGEMS. (2016) 4:1204. doi: 10.13063/2327-9214.1204
69. Council of Europe. Draft White Paper On Equitable And Timely Access To Appropriate Innovative Treatments And Technologies In Healthcare. Steering Committee For Human Rights In The Fields Of Biomedicine And Health (CDBIO). Strasbourg: Council of Europe (2024).
70. Taylor P. Sensyne, Oxford University Deploy AI to Find Asthma Targets. London: pharmaphorum (2021).
71. Gross N, Geiger S. Choreographing for public value in digital health? Big Data Soc. (2023) 10:20539517231220622. doi: 10.1177/20539517231220622
72. eurordis. Joint Statement on the European Health Data Space Draft Proposal - A call for society-centred digitalisation of healthcare. Brussels: EURORDIS-Rare Diseases Europe (2023).
73. European Public Service Union [EPSU]. EPSU Amendments to the European Health Data Space (EHDS) Proposal. Brussels: EPSU (2023).
Keywords: citizen engagement, citizen rights, European Health Data Space (EDHS), health data, implementation, secondary use
Citation: Cervera de la Cruz P, Lalova-Spinks T and Shabani M (2026) The European Health Data Space: an opportunity to strengthen citizen rights and engage citizens in health data governance. Front. Med. 12:1699941. doi: 10.3389/fmed.2025.1699941
Received: 05 September 2025; Revised: 12 December 2025; Accepted: 30 December 2025;
Published: 20 January 2026.
Edited by:
Maria Hägglund, Uppsala University, SwedenCopyright © 2026 Cervera de la Cruz, Lalova-Spinks and Shabani. This is an open-access article distributed under the terms of the Creative Commons Attribution License (CC BY). The use, distribution or reproduction in other forums is permitted, provided the original author(s) and the copyright owner(s) are credited and that the original publication in this journal is cited, in accordance with accepted academic practice. No use, distribution or reproduction is permitted which does not comply with these terms.
*Correspondence: Mahsa Shabani, bS5zaGFiYW5pQHV2YS5ubA==