The goal of the Secondary Use Act is not only to facilitate research but also to safeguard individual privacy, rights, and freedoms.
This text was originally published in Finnish in Helsingin Sanomat on August 10, 2024 (hs.fi)
The editorial of Helsingin Sanomat (August 4) addressed the use of health data in research. The topic is important and timely, as the legislation on this subject is currently being revised. However, the article contains some inaccuracies.
According to HS, researchers are not allowed to have access to the data they themselves have collected. A researcher can collect data, for example, in a medical trial or by conducting interviews. In such cases, consent for participation in the research is required. The researcher is the data controller of the collected data and manages it.
In contrast, the use of patient records stored in social and health services for research purposes requires permission from an authority. These records were originally collected for treatment purposes, and consent for research use has not been obtained. Such use of health data is regulated by the Secondary Use Act, which mandates the processing of data in a secure environment.
The objective of the Secondary Use Act is not only to facilitate research but also to protect individual privacy, rights, and freedoms. Since citizens are not aware that their health data collected in social and health services might be used for research, it is particularly justified to require a high level of data security.
The idea behind protecting sensitive health data is not so much that a person could be identified from a single measurement result. Rather, when data from multiple registries is combined, a person could be identifiable, even if names, social security numbers, and other direct identifiers have been removed.
According to the Secondary Use Act, Finnish health data cannot be transferred abroad or outside secure environments. However, foreign researchers can apply for access to the data. Even now, there are ongoing studies in Finnish environments where analyses are conducted from abroad.
Ultimately, it is about finding a balance between protecting citizens’ privacy and enabling the free use of health data for research. Open and fact-based discussion is needed to establish commonly accepted rules.
Johanna Seppänen
Director, Social and Health Data Permit Authority, Findata