Article 43, Penalties by health data access bodies, Articles of the European Health Data Space (EHDS), (Proposal_3.5.2022)
1. Health data access bodies shall monitor and supervise compliance by data users and data holders with the requirements laid down in this Chapter.
2. When requesting from data users and data holders the information that is necessary to verify compliance with this Chapter, the health data access bodies shall be proportionate to the performance of the compliance verification task.
3. Where health data access bodies find that a data user or data holder does not comply with the requirements of this Chapter, they shall immediately notify the data user or data holder of those findings and shall give it the opportunity to state its views within 2 months.
4. Health data access bodies shall have the power to revoke the data permit issued pursuant to Article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3, immediately or within a reasonable time limit, and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. In this regard, the health data access bodies shall be able, where appropriate, to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years.
5. Where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data, or do not respect the deadlines set out in Article 41, the health data access body shall have the power to fine the data holder with fines for each day of delay, which shall be transparent and proportionate.
The amount of the fines shall be established by the health data access body. In case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body, that body can exclude the data holder from participation in the EHDS for a period of up to 5 years. Where a data holder has been excluded from the participation in the EHDS pursuant to this Article, following manifest intention of obstructing the secondary use of electronic health data, it shall not have the right to provide access to health data in accordance with Article 49.
6. The health data access body shall communicate the measures imposed pursuant to paragraph 4 and the reasons on which they are based to the data user or holder concerned, without delay, and shall lay down a reasonable period for the data user or holder to comply with those measures.
7. Any penalties and measures imposed pursuant to paragraph 4 shall be made available to other health data access bodies.
8. The Commission may, by means of implementing act, set out the architecture of an IT tool aimed to support and make transparent to other health data access bodies the activities referred to in this Article, especially penalties and exclusions. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).
9. Any natural or legal person affected by a decision of a health data access body shall have the right to an effective judicial remedy against such decision.
10.The Commission may issues guidelines on penalties to be applied by the health data access bodies.