In today’s debates about artificial intelligence (AI) and data, the typical starting point is what might go wrong or where safeguards may fall short. A new study for the European Parliament’s Committee on Public Health (SANT), The Use of Data in Public Health, takes a more constructive approach, examining how AI can support public health systems and patients. Discussed by the SANT Committee on 15 October, it offers a solid starting point for ongoing discussions about AI and personal health data. The report recognises data protection as a Charter and shows that it cannot be an end in itself, let alone a brake on the technologies and objectives societies can use to provide better healthcare.
The report’s examples of how AI supports public health objectives are concrete. AI-assisted image analysis supports work such as cancer screening and cardiovascular classification. Predictive tools can estimate the risk of diabetes or heart disease and anticipate demand for further care needs, including intensive care. Furthermore, language models can support better record-keeping, and AI can help detect disease outbreaks. Of course, all of this depends on access to good-quality health data. And in the context of AI development and deployment, how personal data can be used is a pressing issue.
The report identifies the European Health Data Space (EHDS) Regulation as the first sector-specific data space law and the leading framework for the secondary use of health data, including for AI. Article 53 covers the training, testing, and evaluation of algorithms in medical devices and AI systems. The Commission’s Data Union Strategy calls the EHDS a key bridge between health data ecosystems and AI development.
The EHDS is not designed to create loopholes around data protection or as a concession to commercial demands. It is a purpose-built set of protections for health data, designed to support public health delivery across the EU. Access runs through national health data access bodies and data permits. Data is supplied anonymised by default, pseudonymised only where the purpose cannot otherwise be achieved, and processed in secure environments from which personal data cannot be downloaded. Re-identification is prohibited, patients may opt out, and results must be published.
The EHDS represents an important paradigm for EU digital governance going forward. It shows that the collective public interest can be an essential consideration in legislation, where data protection must support the broader objective and not create unnecessary obstacles. In this regard, it must be reiterated that the GDPR is not only an instrument for data protection but one that equally supports the free movement of personal data and is not an absolute right.
The study presented to the SANT Committee shows where the GDPR may create friction for realising the aims of the EHDS. This is most obvious with the notion of scientific research, the gateway to the EHDS’s secondary-use purposes. The report describes the GDPR’s rules as vague and open-ended, notes fragmentation and divergence in approaches across Member States, and finds that using scientific research as a legal basis is difficult where commercial and public interests intertwine. In AI, the line between research and product development is fluid, and commercial involvement is normal in pharmaceuticals and medical technology. The EHDS itself, in its recitals, treats privately funded research and the training of healthcare algorithms as scientific research. The EDPB’s recently issued guidance on scientific research demonstrates how there may be resistance to commercial involvement in scientific research.
A further friction is likely to come with anonymisation, another area where the EDPB has issued guidance while the GDPR is being debated. A context-sensitive approach to anonymisation is the correct way to go, allowing for a risk-based approach based on the specific circumstances of a situation. The EDPB has already stated in its Opinion 28/2024 that one cannot assume AI models trained on personal data are anonymous. This will undermine the EHDS’s anonymised-by-default design because data that is realistically anonymous for a researcher may still be treated by some national authorities as personal data subject to the GDPR.
In support of anonymisation, it is necessary to recognise that public health providers do make efforts at data minimisation, and this is where another friction with GDPR may emerge. The report observes that it is often not possible to know in advance which data an AI system will need. A rule that expects developers to know the answer before they begin sits awkwardly with how learning systems are built and utilised. Add the administrative weight of data-sharing agreements, which the report says should be reduced for health data holders such as clinicians, and the practical result will be hesitation where sharing should be routine.
None of this is an argument against safeguards. Public health professionals and life sciences companies have undertaken research and development for a long time and understand it is necessary to pursue processes based on trust. The EDHS approach shows that safeguards need to be calibrated to realistic risks and give full weight to the public value at stake, rather than viewing every use of data negatively. During the debate in the SANT Committee, a number of MEPs flagged the negatives as a primary concern, but hopefully they will see that the EHDS can address the potential risks identified.
Essentially, the EHDS treats health data as a critical public good necessary for life-saving cross-border care and ongoing medical innovation for better care systems, while embedding technical and legal safeguards through regulation by design. The legislation seeks to ensure anonymisation by default is the norm, along with secure virtual processing environments, to protect personal data.
In relation to public health matters, the issue of sensitive data creates further friction when seeking to pursue improvements in healthcare systems and personal healthcare plans, areas where AI has a large role to play. Under a strict GDPR approach, where special categories of data are subject to increased protection, along with a reliance on explicit patient consent and rigid data-minimisation principles, this exacerbates the “data poverty” that plagues marginalised communities in healthcare delivery. This means AI models are trained on less heterogeneous, majority-dominated datasets, and therefore do not deliver outcomes designed for minority communities. A GDPR first approach would only reinforce algorithmic bias and yield clinical tools that are inherently less accurate or effective for ethnic, socio-economic, or gender minorities.
The EHDS seeks to address this through a secure public-interest framework that allows sensitive personal data to be used for equitable AI development. As data will go through national Health Data Access Bodies within secure environments, the EHDS moves away from the strict restrictions the GDPR has created regarding the use of sensitive data. Safeguards and fundamental rights remain in place, but in a way that enables the safe, large-scale aggregation of diverse clinical, genomic, and social determinants of health that are required to train bias-free AI models. Any argument that attempts to deny or restrict the use of sensitive data through the EHDS needs to explain how a data-restrictive approach to health supports minority communities.
The Charter of Fundamental Rights requires a high level of human health protection across all Union policies, as it requires the protection of personal data. Neither right is more important than the other and must be approached as mutually supportive in application. The GDPR’s own recitals state that data protection is not an absolute right and must be balanced against other interests. Ensuring a high level of health protection must be an important interest to pursue. A framework that treats restrictions on data use, even sensitive data, as the default position requiring clear public benefits to be justified as the exception has the logic backwards.
The EHDS can be a scalable blueprint for shifting the EU’s current approach to personal data protection to better support data use to achieve the EU’s many objectives. The starting point should not be all the risks AI presents to personal data, but how responsible AI use can deliver tangible health gains for all in society. With proportionate safeguards, the EHDS can turn trusted data use into better care and make the protection of personal data a key support instrument for public-health innovation, not a barrier to it.
10 November, 2026
Square de Meeûs 18
1050 Brussels | Belgium
info@privacynext.eu
Copyrights © 2026 PrivacyNext.eu | Privacy Policy | Cookie Policy Webdesign & Development by ALYS
