Report on the IMKR Lecture “Does Consent Under the GDPR Hinder the Digitalization of the Healthcare Sector?” by Attorney Dr. Hoffmann
On December 1, 2021, attorney Dr. Anna-Lena Hoffmann of Evolution Rechtsanwälte in Düsseldorf spoke on the question of whether consent under the GDPR hinders the digitalization of the healthcare sector. After opening remarks by Prof. Rösler, Dr. Hoffmann emphasized that private-sector providers, in particular, are driving technological progress in the healthcare sector. As examples, Dr. Hoffmann cited Apple Health, an app for collecting and processing health data, and TeleClinic, a provider of digital medical care. However, digitalization is also on the rise in the public healthcare system: the electronic health record was introduced in 2004, and the electronic patient record in 2015. Since 2020, the Digital Healthcare Act has also allowed for the prescription of apps (digital health applications, DiGA), for example, for the treatment or prevention of mental health conditions. The COVID-19 pandemic has given the public health sector an additional boost. As a result, the electronic patient record has been further developed, e-prescriptions have been introduced, and the issuance of electronic certificates of incapacity for work has been made possible.
Dr. Hoffmann then addressed the structure of the healthcare sector in Germany and the European Union. The EU has only limited competences in health matters (Art. 168, 114 TFEU). It is assigned only a complementary, supportive, and coordinating role. The design of national healthcare systems is the responsibility of the member states. European data protection regulations concerning the healthcare sector therefore contain numerous opening and specification clauses (e.g., Art. 9(2)(h), (i), (j), (4) of the GDPR). In the German healthcare system, the legislative competence of the federal states in many matters, such as hospital planning or disaster control, leads to further fragmentation.
Dr. Hoffmann then explained the concept of consent under data protection law in the healthcare sector. The GDPR’s requirements for valid consent are high (see Art. 4(11), Art. 6(1)(a), Art. 7(1), (2), (3), and Art. 9(2)(a) of the GDPR). Among other things, consent must be freely given, unambiguous, and informed (Art. 4(11) GDPR) and must be easily accessible and understandable (Art. 7(2) GDPR). However, it is not clearly regulated whether failure to meet even a single criterion for consent renders the consent invalid.
Against this backdrop, Dr. Hoffmann concluded that consent under data protection law could pose an obstacle to the digitalization of the healthcare sector. This applies less to physicians, who can generally rely on other legal bases, and more to private-sector providers of digital health services, who depend on the consent of their users. However, the requirement for consent under data protection law is not the only obstacle to further digitalization of the healthcare sector. The legal fragmentation of European healthcare systems resulting from the EU’s limited competence in health matters – and the accompanying multitude of different regulatory requirements – makes it particularly difficult for startups to implement cross-border business models. For German companies, this applies even within Germany itself due to the legislative powers of the federal states.
Following the presentation, the participants discussed, among other things, the extent to which the European Court of Justice (ECJ) will rule on data protection issues in the healthcare sector. Dr. Hoffmann expects the ECJ to comment on the scope of the data protection “opening clauses,” but to exercise restraint on issues that go beyond that. In light of the coalition agreement between the “traffic light” parties and against the backdrop of experiences during the pandemic, Dr. Hoffmann believes the digital healthcare market could see a surge in growth. For example, the coalition agreement calls for the expansion of telemedicine. An opt-out model is to replace the previous opt-in model for electronic patient records, and the decentralized research data infrastructure is to be improved.
Further reading (in German): Anna-Lena Hoffmann, Die datenschutzrechtliche Einwilligung im Gesundheitsbereich unter der DSGVO, 2021
