Determining public interest in the secondary use of health data

Key messages

• Access to health data for secondary uses that serve the public interest supports better health outcomes and health system performance. When combined with responsible and trustworthy AI technologies, such access can further enhance the ability to generate insights, improve decision-making, and advance innovation in healthcare.

• Facilitating such access and re-use, while protecting privacy and confidentiality, requires careful assessment by review bodies operating within robust governance frameworks. Determining the public interest served by such access and secondary use is central in this assessment.

• Lack of clear definitions and differences in how review bodies assess the existence of a public interest hinders seamless access and re-use, both within countries and internationally.

• By contrast, clear and transparent criteria for data access decisions help streamline applications to review bodies, support consistent decision-making, and strengthen public trust in the secondary use of health data.

• Five broad categories of criteria are relevant for assessing the existence of a public interest in the secondary use of health data: population health and planning; research and innovation; ethical and risk considerations; health equity; and public communication and transparency.

• Policymakers can support review boards and applicants by streamlining data access approval processes that enable informed, efficient and consistent decisions rooted in the public interest and conducive to public trust.

Cross-border access to health data: how divergent review practices affect research and innovation

The secondary use of health data refers to using data originally collected in the context of patient care for other purposes, such as research, innovation and health system management. Health data must therefore be broadly understood here as including clinical data (diagnoses, diseases, interventions, medications, test results and imaging) but also potentially other sensitive data such as mental health, family history, behavioural patterns, lifestyle, social and economic factors. Also of potential value are healthcare administrative data including operational data, insurance, and financial transactional data. Secondary use of these data is increasingly recognised as essential for improving population health outcomes, advancing scientific discovery, supporting personalised medicine, and strengthening evidence-based policymaking.

The secondary use of such data enables the generation of analytics from large-scale datasets such as electronic health records and clinical registries, sometimes combined with additional data sources, such as social welfare or environmental data. It supports the development of artificial intelligence (AI) tools for health services.

Inasmuch as the data in question can relate to identifiable individuals, its secondary use must comply with applicable privacy and data protection laws. In this context, the consent of individuals is commonly relied upon as the primary legal basis to enable such use. Yet, obtaining consent is sometimes impossible, impracticable or incompatible with achieving the intended public interest objectives for re-using the data. In such cases, health professionals responsible for the proposed data use, such as clinical researchers, may rely on an alternative: organisational review boards or national committees (review bodies) will approve this use after assessing whether a legitimate public interest justifies the re-use of these data, subject to adequate privacy and security safeguards (OECD, 2016[1]) (OECD, 2025[2]). Such approvals for secondary use, including the assessment of the existence of a public interest, may not always be required, however—for example where individuals are no longer identifiable under applicable legal and technical standards for anonymisation (OECD, 2016[1]).

Dual approval structures are not uncommon, reflecting the intention of the lawmaker to draw on complementary expertise in such assessments. Under the EU’s European Health Data Space (EHDS, 2025[3]), for example, each Member State must designate “one or more” Health Data Access Bodies (HDABs) to process and decide on applications for access. In France, an application must be evaluated by both a dedicated ethics and scientific committee and the data protection authority (CNIL). Similar arrangements exist in other jurisdictions, such as in Canada and Japan (OECD, 2025[2]).

Because data are often siloed across multiple organisations and because research, innovation and digital health infrastructures increasingly operate across borders, however, regulatory fragmentation and differences in how review bodies determine acceptable uses of health data are found to hinder seamless access, both within countries and internationally (OECD, 2025[4]). A main cause of regulatory fragmentation consists in varying interpretations of public interest. The excessive duration of cumulated procedures is often cited as another significant impediment to efficient co-operation, particularly in jurisdictions where approval requires the involvement of several review bodies.

Aware of these challenges, countries are taking steps to streamline administrative approval processes and reduce delays and regulatory fragmentation in health data access. To support this trend, recent OECD work advocates for greater alignment of decision-making criteria and increased transparency for applicants and the public, and proposes a set of criteria to guide these efforts (OECD, 2025[2]).

This policy brief follows up on this recommendation by presenting a detailed set of criteria chosen to assess the public interest in the reuse of health data, alongside examples of their practical implementation in some jurisdictions. It is intended to help decision-makers, data users and the public evaluate applications for the secondary use of health data in a consistent, informed and efficient manner.

The criteria to determine whether public interest exists when assessing requests to access or share health data draw on common elements identified in existing national guidelines, including in the UK (NHS England, 2023 (updated 2025)[5]), Australia (Australian Government, National Health and Medical, 2014 (updated 2024)[6]), and France (French Health Data Hub, 2019[7]). The criteria also draw on existing OECD work (OECD, 2025[2]) and discussion of practical use cases with national experts.

Comparative analysis highlights five main criteria that review bodies typically examine to evaluate the public interest basis of a proposed data use and the proportionality of the requested access. Access requests are not limited to public-sector stakeholders as private-sector organisations may also serve public‑interest objectives if they present clear evidence of public value. When private entities are involved, approvals may also be conditioned on additional safeguards, including measures to ensure scientific independence, transparency, accountability, and fair use, in order to uphold trust, prevent misuse, and maintain confidence that the public interest is genuinely served.

Population health and system-planning

Public interest is commonly grounded in a demonstrable contribution to public health outcomes or health system functioning. Review bodies typically assess whether the proposed secondary use:

• supports disease identification, prevention or treatment, including improved understanding of risk factors, disease trajectories and treatment effectiveness

• informs public health policy making such as legislation, guidelines, or strategic priorities

• contributes to epidemiological monitoring, surveillance, trend analysis or early warning capabilities

• improves health service quality, safety, efficiency, access or workforce planning and resource allocation

• provides population-level benefits, not only individual or organisational advantages

• delivers a benefit whose magnitude is plausible and meaningful, including consideration of the expected loss if the project is not approved

• explicitly considers whether the underlying data possess sufficient quality, completeness, representativeness and interoperability to meaningfully support the intended public health objectives.

Research and innovation

When secondary use is proposed for research or innovation, review bodies often assess public interest through considerations of credibility, methodological quality and public benefit. In doing so, they examine whether:

• the project demonstrates scientific merit and is likely to yield valid and meaningful findings, including through cross‑border data analytics in medical technologies that enable researchers and clinicians to better understand and predict patterns and responses

• the data used are fit-for-purpose in terms of quality, completeness, format, and representation, such that valid conclusions can reasonably be expected and be effective across different demographics, populations, and regions

• the researchers or research organisations have appropriate credentials, institutional standing and governance arrangements

• the project includes credible plans for dissemination, such as peer‑reviewed publication, reporting, or other mechanisms for sharing knowledge and advancing scientific or clinical practice

• where commercial entities and interests are involved, appropriate safeguards ensure that public benefit is protected and not outweighed by private interests

• the size and characteristics of the population that stands to benefit, whether local, national, or cross‑border, are sufficiently meaningful to justify the proposed secondary use

• the analytical tools, infrastructure and computational resources available are appropriate and sufficient to support the proposed analysis.

Ethical and risk-proportionality assessment

Ethical review bodies evaluate whether anticipated benefits to health systems, science or society outweigh risks to individuals. A public‑interest justification therefore often requires a benefit–risk proportionality assessment. Review bodies consider whether:

• the proposed purpose and data use align with reasonable public expectations

• the data requested are necessary and proportionate to the stated public benefit objective, taking into account data sensitivity

• the technical and governance guardrails are appropriate to the level of the sensitivity and identifiability of the data

• appropriate measures are in place to inform individuals or the concerned public, including clear, complete and accessible communication about the intended use of their data

• an opt-out mechanism is available to individuals who do not wish their personal health data to be used for secondary purposes

• there are sufficient security measures in place to minimise the risks of data misuse, including cybersecurity measures, Trusted Execution Environments (TEEs), Trusted Research Environments (TREs), and privacy-enhancing technologies (PETs).

Health equity

Public interest also encompasses equity considerations. Review bodies therefore assess whether the proposed use:

• promotes equitable access to health services, knowledge or outcomes

• addresses neglected diseases or under-researched conditions

• meets the needs of marginalised or disadvantaged groups, including individuals facing disproportionate health burdens

• recognises that public interest may not be uniform within a jurisdiction, and includes specific consideration of other groups with distinct governance frameworks, rights, and interests.

Public communication and acceptability

Public acceptability and trust are often integral to acting in the public interest. Review bodies may examine whether:

• the proposed purpose and data use align with reasonable public expectations

• the data requested are necessary and proportionate to the stated public‑benefit objective, taking into account data sensitivity

• appropriate measures are in place to inform individuals or the concerned public, including clear, complete and accessible communication about the intended use of their data.

Use cases applying criteria for public interest assessment

Approval of a private health data warehouse for research purposes

In its deliberation, the French Data Protection Authority (the Commission Nationale de l’Informatique et des Libertés, CNIL) (CNIL, 2018[8]) authorised IQVIA Opérations France to create and operate a large health data warehouse based on pharmacy dispensing data. The warehouse is designed for research, study, and evaluation purposes in the field of health.

In its deliberations, the Commission concluded that the requested data access and processing met the public interest threshold, based on a number of considerations outlined below. While a recent enforcement decision (CNIL, 2026[9]) identified shortcomings in transparency and security safeguards linked to the LRX scheme, it did not alter the assessment that the LRX data warehouse served a public interest sufficient to justify authorisation.

Researcher credibility

The CNIL first noted that public interest is not the exclusive domain of public actors. As a private-sector organisation, IQVIA was therefore eligible to be assessed on equal terms.

The CNIL also emphasised that each individual study accessing the warehouse must independently demonstrate a public interest purpose. To support this, IQVIA committed to a governance framework composed of an operational data governance committee and a strategic committee. Each proposed study would be reviewed using a predefined analysis covering:

• the purpose of the study

• the context of the request

• the identity of the applicant

• the granularity of the data requested

• the intended recipients of the results.

Legitimate public interest and data use

The CNIL considered that the stated purposes of the project would contribute to the public interest. More specifically, IQVIA stated that the data warehouse would:

• improve the understanding of the appropriate use of medicines

• help identify drug interactions

• contribute to better patient care

• improve treatment adherence and compliance

• provide insights to both public authorities and private sector actors

• enable rapid analysis of real-world dispensing data.

Transparency and knowledge sharing

The CNIL acknowledged IQVIA’s commitment to transparency through the publication of an annual summary of the types of analyses performed and an annual report on how the data warehouse was used. Moreover, IQVIA noted that it will rely on partner pharmacies to inform customers that their data are being processed, enabling the exercise of rights of access, rectification and objection. However, CNIL noted that the methods used to notify patients, doctors and the public are not clear, complete, and transparent and requested strengthened procedures for issuing and handling notices.

Data necessity

The CNIL reviewed the categories of data to be collected and found them adequate, relevant, and not excessive relative to the intended purposes. The CNIL also agreed that a ten-year retention period was necessary, noting that long-term analyses are often essential for understanding drug consumption patterns.

Security and confidentiality

The CNIL examined IQVIA’s planned security and confidentiality measures and found them to be in accordance with the current state-of-the-art technology. IQVIA demonstrated, among other measures, that it relies on an HDS-certified hosting environment, encrypted data transfers, role-based access controls, regular review of access authorisations, and authentication policies aligned with CNIL recommendations. The CNIL also noted that the planned pseudonymisation procedures appropriately reduce the risk of re-identification of individuals to what was strictly necessary in this context.

However, the CNIL requested enhancements to the data protection impact assessment by developing detailed and plausible risk scenarios and recommended automated log analysis to detect abnormal behaviour.

Prohibited uses

Finally, the CNIL noted that data from the data warehouse cannot be used for the promotion of health products to healthcare professionals or healthcare establishments or for making insurance-related decisions such as excluding individuals from coverage or to modify insurance premiums.

Assessment of scientific independence in an industry-funded pharmaco-epidemiological study

The Supreme Administrative Court of Finland (Supreme Administrative Court of Finland, 2013[10]) ruled on a pharmaco‑epidemiological study funded by a pharmaceutical company. The Court found that while the study met the expected qualitative requirements for a research plan and the researchers demonstrated adequate scientific qualifications, it could not be established with sufficient certainty that the study’s primary objectives were scientific. The Court concluded that industry funding is permissible, but it raises the threshold for demonstrating scientific independence.

Points supporting scientific purpose

• The study was presented as a pharmaco-epidemiological register-based analysis.

• The research plan met formal quality standards, and the researchers possessed appropriate scientific credentials.

• Industry funding alone does not automatically preclude a study from being considered scientific.

• The study design resembled previously published, peer-reviewed register studies.

• The project had received positive assessments from relevant review bodies.

Why the request was rejected

• Insufficient assurance of scientific autonomy

  The funding company retained the right to comment on reports and publications and was not clearly excluded from influencing their content. For the Court, scientific autonomy requires not only commitments but demonstrable structural independence.

• Concerns over publication freedom

  It was unclear whether all results—including unfavourable ones—would be published freely and without delay. The company’s role in preparing publications introduced uncertainty. The Court emphasised that scientific freedom includes independence from prior influence, not merely the right to publish final results.

• Lack of clear research hypotheses

  The study did not articulate precise research questions, creating doubt as to whether the primary aim was to generate new scientific knowledge rather than descriptive data beneficial to the funder. The Court noted a real risk that the research would support marketing or sales‑related objectives rather than scientific inquiry.

What can policymakers do?

• Strengthen co-ordination between review bodies to prevent fragmentation

  Co-ordination is essential when applications for secondary use of health data must be assessed by several review bodies. The roles of such bodies should be articulated, and key definitions and criteria used to assess public interest should be aligned. This is particularly important where health data requests may be reviewed by multiple stakeholders, including health data access bodies, research ethics committees, data protection authorities, and custodians of health datasets. Fragmented decision-making can result in inconsistent interpretations of privacy risks, patient safeguards, and public benefit. For instance, the UK National Health System (NHS) has recently begun exploring ways to streamline collaboration among review bodies to enhance consistency and efficiency (NHS, 2025[11])

• Communicate clear public-interest criteria and provide practical guidance to applicants

  When applicants understand the grounds on which their request will be evaluated, the process becomes more efficient, predictable, and transparent, helping to streamline the approval process for access to health data. Providing clear guidance, standardised methodologies, compliance frameworks, and examples of projects that have delivered measurable public health, healthcare quality, or medical research benefits can help applicants prepare high-quality submissions that meet public-interest requirements. Such support is itself in the public interest, as it increases the likelihood that beneficial studies can proceed and generate valuable insights for health systems and society. For example, the Reference Methodology, adopted by the French DPA (CNIL, 2026[12]), establishes a standardised regulatory framework governing the processing of personal data for research, studies and evaluations in the field of health that do not qualify as “research involving the human person”. In practice this methodology is particularly relevant for applicants seeking access to health data by providing predefined compliance criteria.

• Ensure timely decision‑making by review bodies

  Efficient review of projects can help avoid unnecessary delays. Prolonged decision times risk exhausting the time allocated to researchers by constraints of the terms of research grants, diminishing societal benefits and slowing innovation. Timely deliberations are therefore an integral part of upholding the public interest. This is especially important for health-related projects where delays may postpone medical discoveries, the evaluation of public-health interventions, healthcare system improvements, or the development of AI tools and treatments that could benefit patients.

• Offer clear roadmaps and well‑designed application templates

  Entities holding health data often operate under different internal processes and governance arrangements. A clear roadmap helps applicants navigate these differences, promoting consistency and transparency. For example, the Health Data Lab (Forschungsdatenzentrum) in Germany provides a structured application portal (FDZ Gesundheit, 2026[13]). Equally important are well‑designed application forms that allow researchers to provide necessary information efficiently. The UK’s “Five Safes” Data Access Request form provides an example (UK Health Data Research Alliance and HDR UK, 2022[14]).

• Support and continuously evaluate innovative, trusted mechanisms for data sharing

  Policymakers may encourage and assess initiatives that create secure and trustworthy environments for sharing health data. The OECD has shown that digital solutions such as Privacy Enhancing Technologies (PETs) allow information to be collected, processed, analysed, and shared while protecting data confidentiality and privacy (OECD, 2023[15]) (OECD, 2021[16]). Overall, the objective should not be to promote any single technical solution, but to identify mechanisms that improve access to health insights while ensuring robust safeguards and maintaining public confidence in the responsible use of health data. Examples of such approaches include sphin‑X, an emerging initiative aimed at developing a secure, federated data space for health information exchange (Sphin-X, 2026[17]); the Yale Open Data Access Project (YODA) which enables independent, controlled access to clinical trial data (YODA, 2026[18]); and Vivli, a global nonprofit platform that aggregates anonymised clinical trial data from multiple sponsors to advance research and collaboration (Vivli, 2026[19]). Similarly, South Korea is piloting a “medical data space” that enables hospitals to conduct joint research without transferring raw data, keeping information securely within each institution while sharing only analysis results. This federated approach, supported by government funding and secure cloud environments, aims to accelerate multi‑institutional research and medical AI development while minimising privacy risk (Ji-hye, 2026[20]). Finally, the United States’ Observational Health Data Sciences and Informatics initiative (OHDSI, 2026[21]) also illustrates this approach, using common data models and open tools to integrate diverse datasets and enable secure, privacy‑preserving collaboration globally. It proved particularly valuable during COVID‑19 by supporting vaccine safety monitoring and informing public health responses.

Further information

OECD (2016), Recommendation of the Council on Health Data Governance, OECD Publishing, Paris, https://legalinstruments.oecd.org/public/doc/348/348.en.pdf

OECD (2025), “Facilitating the secondary use of health data for public interest purposes across borders”, OECD Publishing, Paris, https://doi.org/10.1787/d7b90d15-en.

References

[6] Australian Government, National Health and Medical (2014 (updated 2024)), Guidelines approved under Section 95A of the Privacy Act 1988, https://www.nhmrc.gov.au/about-us/publications/guidelines-approved-under-section-95a-privacy-act-1988.

[9] CNIL (2026), Délibération SAN-2026-008 du 26 mai 2026, https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054136834.

[12] CNIL (2026), Méthodologie de référence MR-003 - Recherches dans le domaine de la santé sans recueil du consentement, https://www.cnil.fr/fr/declaration/methodologie-de-reference-04-recherches-nimpliquant-pas-la-personne-humaine-etudes-et-evaluations-dans-le-domaine-de-la-sante.

[8] CNIL (2018), Deliberation No. 2018-289 (IQVIA LRX Database), https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000037462044/.

[3] EHDS (2025), Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202500327.

[13] FDZ Gesundheit (2026), , https://www.forschungsdatenzentrum-gesundheit.de/infoportal/antragsportal.

[7] French Health Data Hub (2019), Principes d’appréciation de l’intérêt public, 11 févr. 2019 ; Éléments de réflexion pour la définition, https://www.health-data-hub.fr/sites/default/files/2020-12/Finalit%C3%A9_Int%C3%A9r%C3%AAt_public.pdf.

[20] Ji-hye, S. (2026), “Korea to Build ’Data Space’ for Secure Medical Data Sharing”, Seoul Economic Daily, https://en.sedaily.com/news/2026/03/27/korea-to-build-data-space-for-secure-medical-data-sharing.

[11] NHS (2025), National engagement on data: Cohort 1 report, https://transform.england.nhs.uk/key-tools-and-info/data-saves-lives/national-public-engagement-on-the-use-of-health-data/national-engagement-on-data-cohort-1-report/.

[5] NHS England (2023 (updated 2025)), National public engagement on the use of health and care data, https://transform.england.nhs.uk/key-tools-and-info/data-saves-lives/national-public-engagement-on-the-use-of-health-data/.

[2] OECD (2025), Facilitating the secondary use of health data for public interest purposes across borders, https://www.oecd.org/en/publications/facilitating-the-secondary-use-of-health-data-for-public-interest-purposes-across-borders_d7b90d15-en.html.

[4] OECD (2025), We have a lot of valuable health data. Why is it so hard to use?, https://www.oecd.org/en/blogs/2025/09/we-have-a-lot-of-valuable-health-data-why-is-it-so-hard-to-use.html#:~:text=New%20OECD%20analysis%20identifies%20three,cross%2Dborder%20research%20and%20innovation.

[15] OECD (2023), Emerging Privacy Enhancing Technologies.

[16] OECD (2021), Supporting Health Innovation with Fair Information Practice Principles, https://www.oecd.org/content/dam/oecd/en/topics/policy-sub-issues/digital-health-systems/oecd-israel-health-data-governance-workshop-report.pdf.

[1] OECD (2016), Recommendation of the Council on Health Data Governance, https://legalinstruments.oecd.org/public/doc/348/348.en.pdf.

[21] OHDSI (2026), OHDSI, https://www.ohdsi.org/.

[17] Sphin-X (2026), , https://sphin-x.de/en/about-sphin-x/.

[10] Supreme Administrative Court of Finland (2013), Decision KHO:2013:181, https://www.finlex.fi/en/case-law/supreme-administrative-court/precedents/2013/181?language=fin&highlightId=142734&highlightParams=%7B%22type%22%3A%22BASIC%22%2C%22search%22%3A%22KHO%3A2013%3A181%22%7D.

[14] UK Health Data Research Alliance and HDR UK (2022), Five Safe Data Access Request application form.

[19] Vivli (2026), Vivilr - Center for Global Clinical Research Data, https://vivli.org/.

[18] YODA (2026), The YODA project - Forging a unified scientific community, https://yoda.yale.edu/.

Contact

Clarisse Girot, Limor Shmerling Magazanik and Christina Michelakaki | [e-mail]