Introduction
Besides the brief and unsuccessful project to create a European Health Community (white pool) alongside the Economic Community of Coal and Steel (black pool),Footnote 1 the member states have sought to limit the Union’s intervention in matters relating to the social dimension of the internal market, such as public healthFootnote 2 and employment policy, in order to preserve national prerogatives.Footnote 3 This resistance has been translated into precise compromises in the drafting of the rules of primary law. Suffice it to recall that, until the Maastricht Treaty, the protection of public health was conceived almost exclusively as an exception which could be invoked by the member states to justify the introduction or maintenance of prohibitions or restrictions on the freedoms of the internal market.Footnote 4 Subsequently, the fact that health has been given an autonomous relevance in the European legal order has not led to a transfer of the matter to the supranational level.Footnote 5 Thus, despite some significant changes introduced by the Treaties of AmsterdamFootnote 6 and Lisbon,Footnote 7 health protection has remained a predominantly national competence, in relation to which the Union can play an almost exclusively supportive role, adopting coordinating measures or acts with a merely exhortative effect.Footnote 8
However, the formal limitations set forth by the constitutional framework briefly summarised here have not prevented the Union from intervening in this area, which continues to advance despite the reluctance of the member states to cede part of their sovereignty to the supranational level.Footnote 9 Over time, the European legislator has employed a range of instruments to exert (sometimes unduly) substantial influence over national competences in the field of public health. This has been done, for instance, through the use of the horizontal social clause,Footnote 10 the inclusion of access to quality healthcare in the European Pillar of Social Rights,Footnote 11 the economic coordination of health policies in the context of the European SemesterFootnote 12 and, most notably, through the approximation of national laws, regulations and administrative provisions affecting the protection of human health.Footnote 13
This gradual expansion of Union action in the field of public health raises a constitutional question that lies at the heart of the EU legal order: whether and to what extent the Union may pursue deep integration in an area of complementary competence by relying on a legal basis designed for other objectives, most notably the internal market. The issue is not merely one of policy effectiveness, but of constitutional legality. It concerns the integrity of the principle of conferral and the democratic legitimacy of EU action in sensitive fields closely linked to national welfare systems. The European Health Data Space Regulation (the Regulation)Footnote 14 brings this tension into particularly sharp focus, as it combines far-reaching policy ambitions with legal bases whose scope has progressively expanded through legislative practice and case law.
Notwithstanding the constitutional concerns raised by this form of integration (indirect legislation),Footnote 15 the European Court of Justice has, with rare exceptions,Footnote 16 legitimised the European legislator’s tendency to pursue ‘non-market values in internal market legislation’.Footnote 17 This has been achieved through the adoption of a general ‘competence-enhancing’, rather than ‘competence-restricting’, approach.Footnote 18 Among the most well-known examples are Directive 2003/33 on advertising and sponsorship for tobacco productsFootnote 19 and Directive 2001/37 on the manufacture, presentation and sale of such products,Footnote 20 which was subsequently repealed by Directive 2014/40.Footnote 21
The resulting erosion of the boundaries of the division of competences between the Union and its member states has also been shaped by periods of crisis.Footnote 22 Public health incidents and emergencies in Europe have indeed raised the awareness of the necessity for effective supranational coordination to address cross-border risks, which in turn has led to the formulation of specific legislative responses.Footnote 23 The Covid-19 pandemic was not an exception to this trend, acting as a catalyst for changesFootnote 24 in both primary and secondary legislation. On the one hand, proposals have been made to amend the Treaties to grant the Union shared competence in the public health sector.Footnote 25 On the other, in 2020, the Commission presented a package of initiatives to create a European Health UnionFootnote 26 – developed in the context of, and partly in response to, the Covid-19 pandemic, which provided political momentum for deeper integration in the field of public health – including the Regulation.
Once fully enacted,Footnote 27 the Regulation will promote the use and sharing of electronic health data, thereby optimising the delivery of care and strengthening health governance (primary use), while simultaneously fostering scientific research and innovation (secondary use), in a manner that is consistent with the values and rights inherent in European constitutionalism. Most notably, the provisions of the Regulation relating to the primary use of data are designed to afford persons control over their data and to guarantee secure and timely access to health data for both patients and healthcare providers.Footnote 28 This is intended to support the development of personalised medicine, the reduction of medical errors and improvements in the efficiency of healthcare delivery. With regard to secondary use, the Regulation includes specific provisions that implement the exception foreseen in Article 9(2) of Regulation 2016/679 (the General Data Protection Regulation)Footnote 29 for the use of data concerning health,Footnote 30 thus recognising that the sharing and re-use of health data also benefit individuals not directly involved in data collection. This includes those whose secondary use activities (e.g. scientific research and innovation) are likely to generate additional economic and social advantages, such as reducing the cost of health services and improving the effectiveness and quality of care, as well as the prevention and management of health emergencies.
In this way, the Regulation is intended to contribute to the achievement of two of the Union’s strategic objectives: the creation of the Digital Single MarketFootnote 31 and the establishment of the European Health Union.Footnote 32 On the one hand, it is hoped that the digitalisation of the health sector resulting from the application of the Regulation will increase the efficiency and resilience of health systems and provide a key boost to European economic and industrial growth in this sector, which can increase the potential of the internal market,Footnote 33 especially in its internal market 2.0 version.Footnote 34 On the other hand, it is claimed that the enhanced accessibility of health data across the Union for both primary and secondary use will allow the implementation of the right to health,Footnote 35 understood as a subjective right to ‘access modern and comprehensive healthcare’.Footnote 36 Moreover, as a pivotal component of the European Health Union,Footnote 37 the Regulation will provide crucial support to the Commission’s internal service Health Emergency Response Authority,Footnote 38 the European Medicine Agency and the European Centre for Disease Prevention and Control. It is also said to foster the attainment of the objectives set forth by the Pharmaceutical Strategy for EuropeFootnote 39 and the Union Mission on CancerFootnote 40 in the Beating Cancer Plan.Footnote 41
Against this backdrop, the article argues that the Regulation provides a compelling case study to reassess the EU’s modus operandi in the healthcare sector and to interrogate the constitutional sustainability of integration driven by expansive interpretations of Treaty legal bases. To this end, the Regulation will be critically examined by first contextualising it within the European integration process, focusing on the EU legislator’s decision to use a ‘strong’ legal basis,Footnote 42 namely Articles 16(2) and 114 TFEU. While existing scholarship has long acknowledged the use of Article 114 TFEU as a vehicle for stretching constitutional limits in the healthcare sector (and beyond),Footnote 43 the Regulation demonstrates that Article 16(2) TFEU similarly functions as a key for EU intervention in areas of complementary competence. As occurred with the internal market legal basis – whose broad judicial interpretationFootnote 44 has endowed the Union with a de facto Kompetenz-KompetenzFootnote 45 extending into areas formally reserved to the member statesFootnote 46 – a parallel dynamic is emerging with respect to Article 16(2) TFEU. The open-ended wording of this provision has facilitated an expansive reading that effectively extends the Union’s regulatory reach to virtually all policy areas involving data processing,Footnote 47 particularly given the growing centrality of data across multiple domains. Through such case law, the European Court of Justice has provided a form of judicial legitimisation to what might otherwise be perceived as constitutional overstretch.
The analysis will then turn to the problematic aspects of the Regulation when assessed against existing EU constitutional constraints, emphasising that the absence of contestation by member states – either politically within the Council or judicially under Article 263 TFEU – amounts to a tacit endorsement of these tendencies. Such ‘non-contestation’, when combined with the Court’s accommodating jurisprudence, risks normalising ‘competence creep’Footnote 48 beyond emergency contexts and thereby blurring the constitutional boundaries that define the EU as a Union grounded in the rule of law.Footnote 49 These considerations will inform a discussion of possible future developments of the European integration process in the public health sector, serving as the foundation to argue in favour of reinforcing the EU’s competence or, at the very least, enhancing the democratic legitimacy of its decision-making. Finally, the key findings will be summarised.
Deepening integration in public health protection through indirect legislation
As will be demonstrated in the following pages, the Regulation aligns with the typical trajectories of the European integration process in public health, representing an example of indirect legislation. Focusing on the legal basis of the Regulation – which, it should be recalled, has to be chosen by referring to ‘objective factors’ (e.g. the aim of the act)Footnote 50 – it will be emphasised that the explicit goals pursued by this legal instrument (the protection/free movement of personal data and the well-functioning of the internal market) are neither the only nor the main ones. However, although the Regulation is primarily concerned with the protection of human health, the limited competences of the Union in the public health sector have prompted the European legislator to achieve deeper integration by grounding the Regulation on a ‘strong’ legal basis (Articles 16(2) and 114 TFEU), in line with the traditional approach of neo-functionalist theory.Footnote 51
The explicit (and implicit) objectives of the Regulation
As touched upon in the introduction, the creation of the European Health Data Space aims to ensure access to and exchange of electronic health data at the national and cross-border levels for primary (e.g. healthcare) and secondary (e.g. scientific research) purposes, in compliance with the General Data Protection Regulation when it comes to personal electronic health data.Footnote 52 In addition, the objective of the Regulation is to establish common rules for the realisation of a single market for electronic health records and wellness applications.Footnote 53 In light of these goals, which are explicitly mentioned in Article 1 of the Regulation, it is not surprising – at least at first glance – that the constitutional basis chosen is Article 16(2) TFEU on the protection of individuals with regard to the processing and free movement of personal data, and Article 114 TFEU on the establishment and functioning of the internal market.
Concerning Article 16(2) TFEU, the European Court of Justice has clarified that this provision constitutes an appropriate legal basis ‘where the protection of personal data is one of the essential aims or components’ of European legislation.Footnote 54 With the Regulation, this objective is pursued through the introduction of rules that specify and complement the rights conferred on individuals by the General Data Protection Regulation (e.g. the right of access, the right to data portability and the right to opt-out),Footnote 55 thus enhancing their control over the primary and secondary use of personal electronic health data. Article 16(2) TFEU also justifies the adoption of the provisions of the Regulation aimed at ensuring the free flow of personal health data within the EU. An illustrative example is the set of rules allowing individuals to transmit their electronic health data, or a copy thereof, to health professionals established in a member state other than their own, using the European electronic health record exchange format in the context of the platform for the primary use (MyHealth@EU).Footnote 56
With regard to Article 114 TFEU, its use as a legal basis for the Regulation is justified by the need to strengthen the freedoms of the internal market and, in particular, the free movement of electronic health records and electronic non-personal health data contained therein. For instance, the introduction of a system of mandatory self-certification for those who bring electronic health records into the internal marketFootnote 57 should prevent national initiatives from causing market fragmentation, which would generate costs for companies required to comply with different certification schemes. The link with the internal market is less obvious in relation to the free movement of patients across the Union.Footnote 58 As noted in the legal literature, it is difficult to imagine that allowing patients to carry their health data with them or enabling healthcare professionals to access and share patients’ personal data in electronic format through the MyHealth@EU can actually increase the mobility of patients,Footnote 59 who have long shown a low propensity to move from one country to another to receive healthcare.Footnote 60 Conversely, the main positive effects of harmonising the rules on the primary use are more likely to be seen – like any piece of internal market law with a regulatory function – in domestic contexts, rather than in situations with cross-border elements.Footnote 61
Apart from the latter considerations, the present analysis does not call into question that the Regulation is designed to safeguard individuals with regard to the processing of their data and the proper functioning of the internal market.Footnote 62 Nevertheless, in line with a well-established modus operandi at the EU level,Footnote 63 it seems equally evident that the underlying intention of the European legislator is to protect and improve human health.Footnote 64 As the Commission itself pointed out in the explanatory memorandum to the proposal for the Regulation, the aim of this Regulation is to ensure a high level of human health protection while guaranteeing the proper functioning of the internal market for digital health products, including through the more effective use of electronic health data. It goes without saying that the protection of human health is far from being a secondary goal of the Regulation. On the contrary, a number of factors suggest that the primary objectives of the Regulation are the implementation of the right to health and, more broadly, the creation of a European Health Union, as opposed to those connected to the establishment of the Digital Single Market.
First, the provisions of the Regulation on the primary use of electronic health data are intended to improve the quality of care provided to natural persons and ensure continuity of care when they move from one state to another, thereby promoting – at least potentially – the free movement of patients within the Union.Footnote 65 A similar objective of continuity of care and access to healthcare is also pursued through the norms on electronic health record systems.Footnote 66 The introduction of interoperability requirements and mandatory self-certification of such systems is expected to facilitate the exchange of health data and increase the effectiveness of national healthcare systems.
Second, the Regulation’s rules on the secondary use promote the increased availability of electronic health data for reasons of general interest (e.g. scientific research), thus contributing to an improvement in the health status of both individuals and the public as a whole. Most tellingly, the use and sharing of health data enables researchers and innovators to make advances in the diagnosis of diseases and to promote the development of innovative health treatments. In addition, prompt access to relevant electronic health data enables regulators and policymakers to take appropriate action and devise preparedness and response plans for health crises and emergencies. Ultimately, the increased accessibility of health data, including real-world data, should assist the Health Emergency Response Authority, the European Medicine Agency and the European Centre for Disease Prevention and Control in fulfilling their roles in the effective management of public health emergencies (e.g. in the context of the Rapid Alert and Response System), and should also support the pursuit of the objectives of the Pharmaceutical Strategy for Europe and the Union’s mission to combat cancer as set out in the Beating Cancer Plan.Footnote 67
Having said that, it seems reasonable to argue that Article 168 TFEU should have been included as a legal basis for the Regulation, alongside Articles 16(2) and 114 TFEU.Footnote 68 This, however, did not occur, since reliance on Article 168 TFEU would have jeopardised the achievement of the Regulation’s explicit objectives. Directive 2011/24 offers an instructive precedent: the combination of Article 168 TFEU with Article 114 TFEU has significantly curtailed its effectiveness, as evidenced by the subsequent need – at least in relation to digital matters – for more ambitious legislation through the Regulation. For the provisions of Directive 2011/24 pursuing non-economic objectives (and which were therefore grounded in Article 168 TFEU), the legislator refrained from harmonisation and confined itself to fostering cooperation between healthcare providers, patients, and national regulatory authorities via non-binding instruments (e.g. guidelines and recommendations) on issues such as the exchange of information via the eHealth networkFootnote 69 and the assessment of health technologies.Footnote 70 In short, the inclusion of Article 168 TFEU transformed what might have been a harmonisation instrument into a framework for voluntary coordination.
By contrast, the choice of a ‘strong’ legal basis for the Regulation enables a medium-to-high intensity intervention, moving beyond soft instruments or enhanced cooperation mechanisms towards binding, harmonised rules governing the access to and use of electronic health data (for primary and secondary purposes) at both EU and national levels. The Commission itself acknowledged this rationale in the preparatory documents, stating – in a manner that could be interpreted as an admission of encroachment or at least misuse of the legal bases – that recourse to Article 168 TFEU would have provided for ‘a more limited scope for Union intervention, which would [have] not allow[ed] to tackle the problems that have been identified in the problem definition, such as supporting control of patients over their health data by improving interoperability, allowing the digital health products and services to circulate freely within the EU and re-using health data’.Footnote 71
The use of a ‘strong’ legal basis for deeper integration
The Commission’s statement makes it clear that the choice of the legal basis for the Regulation is essentially the result of a strategic decision driven by the necessity for deeper integration. Paradoxically, the constraints imposed by Article 168 TFEU on EU action in this area would not have enabled the guarantee of ‘a high level of human health protection’.Footnote 72 Consequently, the European legislator, creating a real constitutional-legislative short-circuit, preferred to opt for a ‘strong’ legal basis that would justify a more incisive intervention at the supranational level. As is well known, the Union enjoys shared competence in the field of the internal market, which enables it to harmonise the laws and regulations established by the member states. Moreover, although the protection and free movement of personal data are not explicitly mentioned in the list provided by Article 4(2) TFEU, the legal literature is unanimous in considering that the EU is endowed with shared competence.Footnote 73 Some even argue that the EU has – not by nature, but by exerciseFootnote 74 – an exclusive competence in this domain, as the protection of personal data is almost exhaustively regulated by the General Data Protection Regulation.Footnote 75
Thus, following a typical approach of the neo-functionalist theory, the European legislator leveraged the close interaction between the Digital Single Market and the protection/free movement of personal data to advance deeper integration in the public health sector. In particular, the use of a ‘strong’ legal basis for the Regulation was crucial in this respect, as it enabled the attainment of objectives that would have been out of reach under a ‘weaker’ basis. A useful comparison can be drawn with Directive 2011/24. As noted above, the voluntary character of some of its provisionsFootnote 76 limited patients’ ability to exercise effective control over their electronic health data, both within their own member state and across borders, and curtailed efforts to promote the secondary use of such data (e.g. for healthcare and scientific research). Achieving these results would have required harmonisation,Footnote 77 but this was rendered impossible by the decision to ground Directive 2011/24 not only on Article 114 TFEU but also on Article 168 TFEU.
During the legislative process for Directive 2011/24, the member states, represented in the Council, exerted significant pressure for the Commission’s proposal to be amended to include, in addition to Article 114 TFEU, Article 168 TFEU.Footnote 78 On account of the Court of Justice’s expansive interpretation of the concept of the internal market,Footnote 79 the Council acknowledged the relevance of Article 114 TFEU as the legal basis for the rules of the Directive pertaining to the internal market (e.g. rules on the reimbursement of costs of healthcare received abroad).Footnote 80 However, in order to enhance the social dimension of the act, the Council identified Article 168 TFEU as a constitutional basis for rules aimed at pursuing non-economic objectives with considerable implications for the provision of health services and, in general, for national health policies (e.g. rules on the safety and quality of treatment and the creation of European reference networks).Footnote 81 The choice of legal basis for Directive 2011/24 was, therefore, a compromise between the pursuit of the cross-cutting objective set out in Article 9 TFEU and respect for the member states’ regulatory autonomy under Article 168(7) TFEU, in order to avoid any harmonisation and undesirable mercantilist drifts.Footnote 82
With the Regulation, observations such as those just mentioned on the mitigation of the mercantilist dimension and the safeguarding of the regulatory autonomy of the member states in compliance with the EU constitutional framework appear to have been overshadowed by motivations related to the need for deeper integration. In other words, to achieve the explicit (but more importantly the implicit) objectives of the Regulation, the European legislator opted to make use of its competences in a creative or unorthodox manner, rather than adhering strictly to the principle of conferral. This ultimately resulted in the decision, as previously noted, not to include Article 168 TFEU among the provisions of primary law that constitute the Regulation’s legal basis. Had a different choice been made, it would have confined the Union’s intervention to the sole promotion of ‘cooperation’ between the member states, without the possibility of proceeding with any harmonisation. In the field of public health, the Union has indeed been granted a complementary competence.Footnote 83
Consequently, legally binding acts adopted in this area cannot lead to the harmonisation of member states’ laws and regulations.Footnote 84 Rather, the action of the Union should be limited to supporting, coordinating and complementing national policies.Footnote 85 This could be achieved, for instance, by enhancing the complementarity of member states’ health services in cross-border areas through the development of guidelines and indicators and the exchange of best practices.Footnote 86 The prohibition of harmonisation does not apply solely with regard to measures establishing quality standards applicable to organs, substances of human origin, blood and blood products,Footnote 87 medicinal products and medical devices,Footnote 88 as well as measures taken in the veterinary and phytosanitary fields.Footnote 89 On the contrary, it is important to reiterate that the definition of health policy, the organisation and provision of health services and medical care, and the donation and medical use of organs and blood are national prerogatives under Article 168(7) TFEU. These prerogatives are also recognised by Article 35 of the Charter of Fundamental Rights of the European Union (Charter), which makes the exercise of the right of every individual to have access to preventive healthcare and to obtain medical treatment subject to compliance with the ‘conditions established by national laws and practices’.
In light of these constitutional constraints, the European legislator decided to ground the Regulation on a ‘strong’ legal basis, relying on its role in facilitating the establishment of the Digital Single Market – where not only can digital health products circulate freely in compliance with the rules on the protection of personal data, but also health data can be used and shared for treatment or other purposes of general interest – simultaneously ensuring compliance with the European data protection rules. The Regulation’s contribution to the implementation of the right to health in the perspective of creating a European Health UnionFootnote 90 has instead been downgraded to a mere ‘secondary effect of the main aims’Footnote 91 of this Regulation. While a decisive EU intervention to achieve ambitious outcomes (e.g. the creation of a Digital Single Market) may appear to be the only possible solution to deliver ‘effective policy outcomes’,Footnote 92 the following section will outline that it also raises concerns about the legitimacy of the Regulation in relation to the existing EU constitutional framework.
The Regulation and the EU constitutional framework: a tension between member states’ prerogatives and the need for harmonisation
The contextualisation of the Regulation within the wider European integration process allows us to conclude that this Regulation is an additional example of indirect legislation proposed by the Commission to achieve deeper integration in public health through the medium not only of the internal market but also of the protection and free movement of personal data. Compared to the past, it can be observed that Article 114 TFEU is no longer the sole (or main) legal basis that can give rise to the phenomenon of ‘competence creep’, since Article 16(2) TFEU, as interpreted by the European Court of Justice, also holds significance, particularly considering the ongoing digitalisation of the healthcare sector which requires an increasing use of data. Consequently, this primary law provision has the potential to expand the so-called ‘web of competences’,Footnote 93 thus enabling the EU to intervene in the health sector regardless of the existing constitutional limits. As mentioned at the end of the previous section, this legislative decision presents a number of problematic aspects, especially in relation to the current EU constitutional framework. Under the latter, the Union is obliged to respect the autonomy of the member states in organising and financing their healthcare services and is prohibited from harmonising national laws and regulations.
The autonomy of member states in defining their healthcare policies
Notwithstanding the wording of Article 168 TFEU, so far the national reservation contained in its seventh paragraph appears to be nothing more than a mere safeguard clause. Without a blocking minority in the Council,Footnote 94 it seems unlikely that this provision will impede the Union’s action. On the contrary, its presence in the Treaties appears to have the sole effectFootnote 95 of prohibiting the EU from interfering with the member states’ decisions regarding the organisational model of their national health systems, which reflect the core constitutional structure of each member state.Footnote 96 Moreover, Article 168(7) TFEU has the additional effect of requiring the European legislator to include relevant general formulas on respect for national prerogatives in secondary legislation. These formulas are scattered throughout the text of the Regulation, where it is reiterated on several occasions that this Regulation does not in any way affect the prerogatives of the member states in the definition of their healthcare policies, including decisions on the services they provide and reimburse.Footnote 97
Despite the formal acknowledgment of the national prerogatives, the Regulation impinges on them by specifying, for example, that the different reimbursement schemes of the member states must not represent an obstacle to the free movement of digital health services, such as telemedicine and online pharmaceutical services.Footnote 98 Similarly, in order to enhance the interoperability and security of digital health products, member states are permitted to maintain and define specific rules for the procurement, reimbursement, financing or use of electronic health record systems at the national level in the context of the organisation, delivery and financing of healthcare services. It is, however, also stipulated that these national provisions must not hinder the free movement of electronic health record systems within the Union.Footnote 99
The national autonomy is further constrained when considering the use by the Union of financial leverage as a means of inducing member states to pursue more decisive structural changes,Footnote 100 including those pertaining to health policies. In order to benefit from the funds of the Recovery and Resilience Facility,Footnote 101 the national plans of each member state must already provide for reform and investment programmes in strategic sectors,Footnote 102 such as the digital transition and health.Footnote 103 In addition, it should be noted that the EU’s supervisory powers over the management of the funds, formally conferred to ensure the appropriate final destination of economic measures, will, in practice, affect sectors that fall within the sovereignty of the member states.Footnote 104
The drive towards digitalisation entails the implementation of digital tools (e.g. electronic health records and information and communications technology infrastructures) at the national level, with the aim of improving the sustainability and quality of healthcare services and reinforcing the public health component and primary and intermediate (non-hospital) care. Such changes, although partly the result of negotiations, ultimately impact the national prerogative to determine autonomously the organisational and financial models in the health sector. This could contribute to exacerbating inequalities in the provision of healthcare services both between member states and within the same State, with obvious repercussions in terms of unequal treatment of patients. For example, in systems such as the Italian one, where healthcare is regionalised, the reforms needed to fulfil the commitments made to the EU involve significant innovations for certain regions (e.g. Calabria and Campania), whereas for others (e.g. Emilia-Romagna) they follow trajectories of greater continuity.Footnote 105
The prohibition of harmonisation in the field of public health
From the foregoing analysis, it cannot reasonably be argued that the Regulation directly restricts the autonomy of member states, which remain free – at least formally – to refrain from undertaking a digitalisation process for their healthcare systems.Footnote 106 Nevertheless, concerns persist about the compatibility of the Regulation with the EU constitutional framework. This is due to the fact that the Union does not have a general legislative competence for harmonisation in this area. Pursuant to Article 2(5) TFEU, measures intended to protect and improve human health cannot result in the harmonisation of the laws and regulations of the member states. Despite this prohibition, the Regulation introduces comprehensive harmonisation of the sector, which is substantially justified by the need to reach ambitious objectives that cannot be achieved by existing legislative instruments, given the cautious approach adopted by the European legislator to avoid encroaching on national prerogatives.
Most notably, I am referring to the mere coordination measures of Directive 2011/24 in regulating the digital aspects of health (e.g. Article 5 on the right to have remote access to medical records and Article 14 on eHealth), characterised by elements of voluntariness and non-bindingness, and to some provisions of the General Data Protection Regulation (e.g. Article 23 on the restrictions to data subjects’ rights and Article 9 on the treatment of health data) that have proven to be inadequate to attain objectives such as ensuring greater control by patients over their health data and the free flow of such data within the Union. The ineffectiveness of the EU action under these regimes has led to an urgent need for harmonisation of the rules concerning the primary and secondary use of electronic health data, not only in cross-border situations, but also in purely domestic ones.
With regard to the primary use of health data, member states are required to either introduce or amend existing national rules. This may entail a shift from an opt-in system for the consultation of electronic health data to one based on an opt-out mechanism.Footnote 107 Furthermore, in order to guarantee the effective exercise of individuals’ rights with respect to the primary use of data, it falls upon the member states to set up data access services for both patients and professionals.Footnote 108 Once more, with the Regulation, the exchange of electronic health data, in particular those listed in Article 14 of the Regulation (e.g. patient summaries, electronic prescriptions and medical imaging and medical test results),Footnote 109 is no longer allowed according to national technical specifications. Instead, it will have to comply with the European electronic health record exchange format.Footnote 110 The purpose of this obligation is, inter alia, to ensure that citizens receive a copy of their electronic health dataFootnote 111 and require the holder to transmit their data to a recipient when these persons are located in different member states and the health data concerned fall within the priority categories referred to in Article 14 of the Regulation.Footnote 112
As a consequence of these legislative innovations introduced by the Regulation, it should therefore be possible to overcome the obstacles to the effective exercise of the rights of natural persons to access and transfer their data, resulting from: (i) the different ways in which member states have implemented the rights granted by the General Data Protection Regulation to data subjects (e.g. the right of access and the right to portability); and (ii) the delays in the implementation of the MyHealth@EU at the national level and the low uptake by member states of the rules and specifications of the European electronic health record exchange format. On the one hand, indeed, the General Data Protection Regulation – despite being a regulation – grants member states a wide margin of manoeuvre when implementing the rights of data subjects.Footnote 113 On the other hand, Directive 2011/24 only requires the Commission and the member states to cooperate in developing non-binding legal measures to promote greater interoperability between formats and standards used for the provision of healthcare using information and communications technology and to facilitate patients’ access to eHealth applications, should the member states decide to introduce them.Footnote 114
Moving on to the secondary use of health data, the Regulation imposes an obligation upon data holders (e.g. hospitals and healthcare professionals)Footnote 115 to make available certain categories of electronic health data (e.g. data derived from electronic health records and health data generated through medical devices and digital health applications)Footnote 116 for specified purposes.Footnote 117 This obligation entails that the member states must designate bodies responsible for granting access to data,Footnote 118 which are tasked, among other duties, with assessing and deciding on data access applications and requests.Footnote 119 Consequently, in order to access health data in electronic format, it will be necessary to follow the harmonised procedures defined by the Regulation.Footnote 120 In establishing these procedures, the exceptions set out in Article 9(2)(g)-(j) of the General Data Protection Regulation have been operationalised, thereby obliging member states to review their approaches to the use of health data. The aim is to overcome the situation of fragmentation caused by the excessive use of some provisions of the General Data Protection Regulation at the national level, which has made access to health data difficult – if not impossible – thus limiting the ability of ‘researchers, innovators, policy makers and regulators to carry out their tasks or to carry out research or innovation’.Footnote 121
In addition to the provisions of the Regulation mentioned above, the impact of the EU intervention at the national level can also be seen in the provisions concerning compulsory participation in the MyHealth@EU and HealthData@EU infrastructures. Both are designed to facilitate communication between the national contact points and the central platforms for digital health and the secondary use of electronic health data, respectively. More precisely, through MyHealth@EU, the Commission shall provide health data exchange services referred to in Article 14 of the Regulation on the basis of the European electronic health record exchange format.Footnote 122 In contrast to Directive 2011/24, the participation of the member states in this infrastructure is no longer optional but mandatory. Therefore, all member states are obliged to join MyHealth@EU, ensuring that healthcare providers are connected to their contact points and are able to carry out a two-way exchange of electronic health data and that pharmacies can dispense electronic prescriptions issued by other member states. On the other hand, the HealthData@EU enables the Commission to offer additional services beyond those related to the exchange of information between data access bodies and authorised participants for cross-border access requests. These include the maintenance of accessible data catalogues, the establishment of a secure environment for the transmission and analysis of data from different national infrastructures, and the linking of the Regulation to other common European data spaces (e.g. environmental, social and agricultural).Footnote 123
The preceding analysis reveals a clear shift in the approach adopted by the European legislator in regulating digital health. Initially, with Directive 2011/24 and the General Data Protection Regulation, a conscious decision was made to avoid complete harmonisation of matters that carry strong national interests.Footnote 124 Specifically, Directive 2011/24 aims to promote cooperation between healthcare providers, users and regulatory authorities in the different member states. Rather than employing harmonisation measures, this objective is pursued through the adoption of non-binding legal acts (e.g. guidelines and recommendations) relating to: (i) the recognition of requirements issued in the other member states;Footnote 125 (ii) the establishment of European reference networks between healthcare providers and centres of excellence;Footnote 126 (iii) the sharing of information through the eHealth network;Footnote 127 and (iv) the assessment of health technologies.Footnote 128 Likewise, certain provisions of the General Data Protection Regulation grant member states a considerable level of discretion regarding both the rights of data subjects and the processing of their data, particularly for scientific research purposes.Footnote 129
Subsequently, with the Regulation, the European legislator appears to have become less reticent to harmonise this sector. Indeed, this Regulation represents a medium-high intensity level of intervention aimed at achieving the ambitious objectives that the existing legal framework on digital health could not accomplish. Among the policy options developed during the impact assessment,Footnote 130 the Commission – fallowing a common pattern for the European integration process – chose to deviate from the legislative model previously considered, based on voluntary instruments or enhanced cooperation mechanisms in favour of an alternative one. The latter involves the introduction of harmonised rules governing access to electronic health data and their use (primary and secondary) at both the European and national levels. Moreover, in contrast to the previous approach, the use of a directive – whether ‘real’ or, as in the case of the General Data Protection Regulation, ‘disguised’Footnote 131 – has been set aside in favour of the regulation.Footnote 132 Since neither Article 114 TFEU nor Article 16(2) TFEU requires the adoption of a specific type of act in these fields,Footnote 133 the Commission was able to propose a Regulation for the European Health Data Space. While this decision allows for a reduction of the margin of the member states’ discretion and thus avoids the creation of fragmented regulatory systems,Footnote 134 it also contributes to a tightening of the corset around national competences.
Playing by the rules: future perspectives for the advancement of integration process in public health
The Regulation does not directly violate the EU’s system of competences as set out in the Treaties, nor does it entirely deprive member states of their autonomy in organising and financing healthcare services. Nonetheless, when coupled with the use of financial leverage, it indirectly and substantially constrains national discretion, effectively compelling member states to reconsider the choices already made in this sector.Footnote 135 The Regulation, indeed, presupposes a level of organisation and digitalisation of national health systems that is far from being complete, especially in some member states. Moreover, digitalisation has become a condition for obtaining NextGenerationEU funding, thereby making it inevitable for member states to go digital. Once this transition is underway, the harmonised rules to be followed are those laid down by the Union. The resulting centralisation, while advantageous in terms of ensuring an effective policy response, is nevertheless a cause for concern.
As argued throughout this article, the adoption of indirect legislation, such as the Regulation, constitutes a threat to the very existence of the EU as a Union based on the rule of law operating within the limits set by the Treaties. By narrowing the scope of national autonomy through the interplay of harmonisation and financial conditionality, the Regulation contributes to competence creep and sits uneasily with the explicit prohibition of harmonisation in Article 2(5) TFEU. In addition, this approach risks compromising the legitimacy of EU action, not only because ‘under-explained centralization aggravates mistrust’,Footnote 136 but also because it does not allow for the involvement of institutional actors whose primary objective is to protect human health.Footnote 137 However, unlike in the past,Footnote 138 these critical issues did not prompt the member states to question the Regulation’s conformity with the EU constitutional framework, either during the public consultation phase preceding the Commission’s proposalFootnote 139 or through the submission of opinions by national parliaments.Footnote 140
This attitude of refraining from asserting national prerogatives and endorsing – at least for the time beingFootnote 141 – the strategic objectives pursued by the Union, together with the instruments chosen to achieve them, points to the existence of a tacit general consensus at the national level on the direction of the European integration process in the field of public health. This consensus transcends strict constitutional limitations and it is further legitimised by the Court of Justice’s consistent endorsement of an expansive interpretation of Articles 114 and 16(2) TFEU. It also supports the arguments of those scholars who consider Treaty revision unnecessary for enhancing Union competence in this sector. On their account, the existing constitutional framework, if interpreted flexibly (or rather, creatively), already provides the Union with the necessary powers to protect human health. From this perspective, Treaty reform is redundant, since the current allocation of competences allows the Union to adapt to challenges either through a systematic reading of primary law or by adjusting secondary legislation.Footnote 142 This approach is often commended for its pragmatic advantages, as it avoids the political hurdles and risks of deadlock that almost inevitably accompany Treaty change.
Yet, despite its appeal, this line of reasoning has significant drawbacks. Reliance on indirect legislation for deeper integration in public health risks rendering ‘competence creep’ structural and systematic not only in emergency contexts but also, as we have seen with the Regulation, in ordinary times. Conversely, a Treaty reform that codifies the broader powers that the EU already de facto exercises in the health sector would have several advantages. First, it would ensure greater democratic legitimacy for Union action by preventing the EU from assuming the role of the national legislators or limiting their autonomy, without the consent of member states to this transfer of competences.Footnote 143 Second, it would increase transparency, accountability and intelligibility for European citizens,Footnote 144 by preventing the adoption of acts designed to safeguard human health ‘under a false label, as if they are all about promoting trade, making more of it and removing obstacles in a concrete, narrow, sense’.Footnote 145 Third, knowing that the Union can intervene decisively in a specific area would encourage stakeholders and national parliaments to play a more proactive role in shaping the decision-making process at both the European and national levels.Footnote 146
Furthermore, the attribution of enhanced competence to the Union in this area would allow the European legislator to adopt acts primarily aimed at protecting human health on the legal basis of Article 168 TFEU, while allowing the member states to effectively monitor compliance with the principle of subsidiarity.Footnote 147 This control is largely impossible when a measure is adopted on the legal basis of Article 114 TFEU. In such cases, indeed, even if the member states could more effectively ensure that the health objectives are met, the EU would still be in a better position to achieve both goals, as the necessary level of harmonisation can only realistically be reached at the supranational level.Footnote 148 Additionally, using Article 168 TFEU as a legal basis for acts pursuing objectives related to the protection of human health could help to avoid a market-oriented approach, or in the case of the Regulation, even a data protection-oriented approach, not only in the drafting of the legislative text but also in its subsequent interpretation by the Court of Justice. The adoption of these approaches by the legislator and the Court of Justice may result in the emergence of economic or data protection bias, which could potentially lead to the neglect of health-related rights and values.
For all these reasons, it seems necessary to strengthen the Union’s competence, or at the very least the democratic legitimacy of its decisions, in the field of public health. To this end, two possible scenarios can be identified. The first one implies the constitutionalisation of enhanced competence in public health, which could take place through a shift from complementary competence to a shared one or, more realistically, through an extension of the scope of Article 168(4) TFEU. In the absence of a willingness to reinforce the Union’s competence in this area, the second scenario should be considered. This would involve the implementation of institutional reforms designed to guarantee the democratic legitimacy of the EU action by increasing the involvement of national parliaments and representatives in the decision-making process.
The two-scenario approach developed builds on, and seeks to advance, the broader academic debate about the Union’s role in public health. Scholars have long highlighted the tension between the EU’s growing activism in this domain and the lack of an explicit constitutional mandate.Footnote 149 What this article adds is a more explicit engagement with the minority strand of scholarship advocating a targeted amendment of Article 168 TFEU – an option that is politically less likely – while at the same time advancing more realistic institutional reforms.Footnote 150
This approach is crucial, as constitutional change would secure the proper allocation of competences and enhance the legitimacy of EU action by grounding it firmly in the Treaties, whereas institutional reform offers a more attainable way of strengthening legitimacy through greater transparency and democratic participation. Rather than dismissing Treaty change as unrealistic, this article argues that it should serve as a catalyst for renewed debate about feasible solutions, ranging from more ambitious options (such as amending Article 168 TFEU) to more limited but pragmatic alternatives (such as revising Protocol No. 2). Moreover, unlike most of the existing literature, which tends to present constitutional reform primarily as a tool to improve the Union’s capacity to manage health crises,Footnote 151 the proposals advanced here aim to address structural and ongoing challenges, most notably the digitalisation of healthcare. In this sense, the article calls for a long-term recalibration of the Union’s role in health policy, moving beyond emergency-driven adjustments towards a more stable and forward-looking constitutional and institutional settlement.
First scenario: enhanced competence for the EU
Among the proposals for a Treaty change in the health sector, one of the most widely endorsed by legal scholars is the granting of shared competence to the EU to establish a European Health Union for the benefit of its citizens.Footnote 152 This amendment would entail the transition from a complementary competence to a shared one, which would require: (i) removing the reference to ‘protection and improvement of human health’ from Article 6(1)(a), TFEU; and, if necessary, (ii) revising Article 4(2)(k) TFEU so that instead of ‘common safety concerns in public health measures’, it mentions the creation of a European Health UnionFootnote 153 or the protection and improvement of human health. These proposed changes would also affect Article 168 TFEU, which should be amended accordingly. One potential rewording of this article could be as follows:
-
(1) The Union shall establish a European Health Union which, based on cooperation and solidarity between the Member States, improves the protection of the health of European citizens, beyond crisis management and enhances the resilience of European health systems, strengthening the capacity of the EU and its Member States to prevent and respond to pandemics.
-
(2) The European Parliament and the Council, acting in accordance with the ordinary legislative procedure and after consulting the Economic and Social Committee and the Committee of the Regions, shall adopt the measures for the approximation of the provisions laid down by law, regulation or administrative action in Member States which pursue the objectives sought within the European Health Union.
-
(3) The Commission shall, in its proposals referred to in paragraph 2, adopt an integrated and coherent approach to balance and optimise human health, animal welfare and the environment.
-
(4) The Union shall encourage cooperation between the Member States in the areas referred to in this Article and, if necessary, lend support to their action. It shall in particular encourage cooperation between the Member States to improve their capacity to prevent, prepare for and respond to cross-border health threats …
-
(5) [current para. 3].
-
(6) The Council, on a proposal from the Commission and after consultation of the European Parliament, may also adopt recommendations for the purposes set out in this Article.
-
(7) Union action shall respect the responsibilities of the Member States for the definition of their health policy and for the organisation and delivery of health services and medical care. The responsibilities of the Member States shall include the management of health services and medical care and the allocation of the resources assigned to them.Footnote 154
The conferral of a shared competence in public health upon the EU would satisfy the requests made by European citizens at the end of the Conference on the Future of Europe.Footnote 155 These requests were in favour of amending the Treaties to include the protection and improvement of health as a shared competence of the Union, thus overcoming the reservation set by Article 168(7) TFEU. Thus far, the demands of European citizens have only been taken seriously by the European Parliament, which has initiated the procedure for the revision of the Treaties under Article 48 TEUFootnote 156 and, subsequently, formulated an ambitious proposal for its amendment.Footnote 157 Among other things, the proposal envisages that the Union has shared competence in the field of public health and the protection and promotion of human health, especially in the case of cross-border health threats.Footnote 158 Conversely, the position of the Commission, the Council and the European Council appears to be more cautious, as they do not consider amending the Treaties as a priority, because many of the citizens’ requests can be met by acting within the existing competences provided by the Treaties.Footnote 159
Given the stance taken by the institutions representing the member states and the fact that the amendments proposed by the European citizens and the Parliament require the activation of the ordinary revision procedure, which is far from obvious,Footnote 160 it seems unlikely that the member states will be able to reach a unanimous decision regarding the transfer of the entire matter of health protection to the supranational level. Such a change would, indeed, end up conferring exclusive competence on the Union, which is exclusive not ‘by nature’, but rather ‘by exercise’ given the activism shown by the European legislator in this field and the subsequent application of the pre-emption principle in matters of shared competence. Therefore, while a compromise on the amendment of Article 4(2)(k) TFEU is very unrealistic, it appears more likely that the member states will be able to find a common ground on maintaining public health among the complementary competences, by making targeted changes to Article 168 TFEU and, in particular, its fourth paragraph.Footnote 161
Taking into account the issues discussed in the present analysis, one possible amendment to this provision could be to expand the list of measures provided for by Article 168(4) TFEU to also include those ‘that establish high quality and security standards for the collection, sharing and storage of (electronic) health data for the primary and secondary use in accordance with the measures adopted under Article 16(2) TFEU’.Footnote 162 The fact that the measures listed in Article 168(4) TFEU address only ‘common public health safety concerns’ should not be seen as limiting the potential of the proposed revision. This is because the concept of ‘common security concerns’ could also encompass issues related to the collection, access and sharing of (electronic) health data for the primary and secondary use. Indeed, the establishment of common quality and safety parameters for the collection, access and sharing of (electronic) data for the primary or secondary use is crucial to ensure safe and high-quality care for patients, support research advancement and respond effectively to pandemics. Without these parameters, national health systems may become less efficient, thereby increasing the risk to patients’ health and reducing the overall quality of care in ordinary and emergency situations. Furthermore, the absence of harmonised rules may hinder the ability of both member states and the Union to prevent (e.g. through the monitoring and surveillance of diseases, epidemiological analysis to identify the spread of diseases and the creation of predictive models to foresee the spread of diseases and determine the areas most at risk) and respond to health emergencies (e.g. through the coordination of responses, including the distribution of medical resources, contact tracing and management of invasive care, as well as international collaboration).
Ultimately, should the member states reach an agreement to amend the Article 168(4) TFEU, they will not be entirely deprived of their competence in the public health domain. However, the Union will have the possibility to intervene extensively in this sector, particularly in light of the growing digitalisation of healthcare. Through this amendment, indeed, the European legislator will be empowered to legitimately adopt harmonisation measures (subject to the subsidiarity control) aimed at promoting the interoperability and reuse of the electronic health data, thereby accelerating the transfer of health data for the benefit of patients and the population as a whole.
Second scenario: greater democratic legitimacy
Given the unlikelihood of securing unanimous agreement on a complete or even partial revision of Article 168 TFEU in the near future – particularly in the current geopolitical context – greater potential lies in institutional reforms aimed at enhancing the democratic legitimacy of decisions taken by the European legislator. Put differently, if it proves impossible to resolve the constitutional problem at its roots, it becomes all the more necessary to reinforce the legitimacy of EU action that stems from a problematic stretching of constitutional limits. One promising avenue in this regard would be to strengthen the ex ante supervisory role of national parliaments through amendments to Protocol No. 2. Despite frequent criticism of its limited effectiveness,Footnote 163 the so-called ‘Early Warning System’ retains considerable potential as a tool for ensuring democratic accountability, provided that specific, well-designed reforms are implemented.Footnote 164
First, the deadline for submitting opinions on subsidiarity could be extended, giving parliaments adequate time to conduct a thorough assessment of whether a proposal risks infringing this principleFootnote 165 and, where relevant, to consult regional parliaments with legislative powers under Article 6 of Protocol No. 2. Second, the scope of parliamentary scrutiny could be broadened to cover not only subsidiarity but also proportionality and national identity, thereby rendering objections more politically salient at the domestic level. Third, national parliaments that have submitted reasoned opinions to the European institutions, as well as committees consulted at the initial stage of the legislative procedure, could be granted the possibility to object to the adoption of a measure within a limited timeframe. Such objections would then have to be duly taken into account by member states when considering whether to bring an action for annulment under Article 263 TFEU.Footnote 166
Admittedly, reforms of this kind would not, in themselves, resolve the specific constitutional problem identified above. As noted, they would not put an end to competence creep, but they could at least mitigate its legitimacy deficit by equipping national parliaments with stronger tools of political contestation and scrutiny. In this sense, amending Protocol No. 2 should not be viewed as a structural remedy to the circumvention of constitutional limits, but rather as a partial means of compensating for it. Moreover, compared with the far more ambitious – but politically unlikely – scenario of conferring all or part of the health competence upon the Union through Treaty change, an agreement among member states on carefully targeted institutional adjustments appears considerably more plausible. Although revising Protocol No. 2 would formally require a Treaty change,Footnote 167 such a modification – unlike an overhaul of Article 168 TFEU, which would affect the core allocation of competences – would focus on procedural safeguards. It would therefore strengthen subsidiarity and democratic oversight without altering the substantive balance between the Union and the member states.
In the same vein, further reforms could help ensure that health-related decisions are taken by institutional actors with a deeper understanding of the substantive issues and fundamental rights associated with health protection, as well as the distinctive characteristics and complexities of this sector.Footnote 168 Serious consideration should therefore be given to the establishment of a dedicated health configuration in both the Council and the Parliament, endowed with the power to amend and vote on legislative proposals.Footnote 169 In this respect, the recent decision of the Parliament to formalise the separation of the Parliament’s Committee on the Environment, Public Health and Food Safety and to grant the current subcommittee on public health the status of a standing committee is to be welcomed.Footnote 170 Such institutional adjustments do not require a change to the Treaty, but rather a decision to be taken, on the one hand, by the European Council, acting by a qualified majorityFootnote 171 and, on the other, by the Conference of Presidents.Footnote 172
Concluding remarks
The present analysis on the Regulation has shown it to be perfectly aligned with the typical trajectories of the EU integration process, being a further example of indirect legislation through which the Union is pursuing a deeper integration in public health. The necessity for centralisation in order to achieve strategic objectives, such as the establishment of a Digital Single Market and a European Health Union, has resulted in the EU legislator (once again) stretching the constitutional limits set by the Treaties in this field, using the shared competence of the protection and free movement of personal data, as well as that of the internal market. As has been argued, while this type of legislative decision is understandable from a regulatory effectiveness standpoint, it is highly problematic from a strictly legal perspective in terms of the conformity of the EU action with the constitutional framework and of its democratic legitimacy. In light of these criticalities, two possible scenarios for advancing the integration process ‘by the rules’ in the field of public health have been identified.
The first one implies a Treaty revision, leading either to a shift from complementary to a shared competence or, more realistically, to an extension of the scope of Article 168(4) TFEU. The second scenario entails the implementation of institutional reforms aimed at enhancing the democratic legitimacy of the EU decisions. Should neither of the above two scenarios materialise, the European integration process in this field will not come to a standstill, particularly if the member states continue not to oppose it. Conversely, the phenomenon of ‘competence creep’ will cease to be regarded as an inherent ‘problem’ to be solved, and instead will become a modus operandi of the Union, which is by no means confined to the health sector, but increasingly extends to a range of other strategic areas, including industry, civil protection, and security.Footnote 173 Even the principle of conferral will eventually lose its role as the ‘foundational principle’ of the European legal order, so that the Union’s action will no longer be constrained by constitutional limits, but rather be guided by the political will to achieve specific objectives.
In this context, faced with the choice of making digitalisation (not only in the health sector) one of the main priorities of the Union and, by choice or by reflex, of the member states, one might ask whether it still makes sense to ensure that the division of competences is respected. From a practical perspective, the answer can only be negative. Assuming a level of harmonisation that is difficult for individual member states to achieve, digitalisation makes it challenging to preserve national specificities, which should reflect different socio-political balances. However, from a legal point of view, as I have tried to argue in this article, the answer is and must be affirmative, unless there is unanimous agreement to change the principles governing the existence and exercise of the Union’s competences.
Acknowledgements
The author is grateful to Professor Giacomo Di Federico, Tamara Hervey and Santa Slokenberga for their invaluable feedback on earlier drafts of this article, as well as to the anonymous reviewers for their attentive reading and constructive comments. My gratitude goes also to Dr Giulia Bosi for generously taking the time to read my draft, and to all participants at the 54th UACES Annual Conference in Trento for their insightful discussions. All errors are mine alone. This article forms part of the research carried out under the Jean Monnet Module ‘the protection of Health in Europe: Actors and Legal instruments – HEAL’ (ERASMUS-JMO-2023-HEI-TCH-RSCH).
Open access
