CoChat
Sign Up
Cited by 137Digitalization, Law, and RegulationThoreau and American LiteratureCOVID-19 Digital Contact Tracing

Fit for purpose? The GDPR and the governance of European digital health

Open access
Marelli, Luca, Lievevrouw, Elisa, Van Hoyweghen, Ine·2020·Policy Studies
DOI 10.1080/01442872.2020.1724929
Open this paper in CoChat — free accountOpen PDF

Abstract

The introduction of the General Data Protection Regulation (GDPR) in 2018 served as the cornerstone of the new data governance regime of the European Union. Informed by principles and values such as privacy, accountability, transparency, and fairness, the GDPR is premised on the objective to balance the protection of individual privacy and the promotion of a thriving European data economy. Still, shortcomings of this regulatory effort have been noted by recent ethical, socio-political, legal, and policy scholarship. Focusing on the deployment of digital health technologies and big data practices within the European digital health ecosystem, this article draws upon these bodies of literature to chart the main lines of tension emerging between the current GDPR-based data governance regime and the broader societal shifts coming along with the expansion of digital health. Central aspects of the GDPR–i.e. key underlying data protection principles and regulatory categories, the reliance on the “notice-and-consent” model, the (narrow) remit of the Regulation vis-à-vis possible harms and discriminations–are misaligned with the surge in digital health. This throws into doubt whether the Regulation is fully fit for the purpose of governing current developments in this field, while also calling for swift and adequate policy responses.

AI snapshot

Written from the paper’s full text.

TL;DR

The article reviews legal, socio-political, ethical, and policy literature to argue that the GDPR’s data governance regime is misaligned with the expansion of digital health and big data practices. It identifies four broad areas of tension and questions whether the GDPR is fully fit for purpose, calling for swift policy responses.

Key findings

  • The GDPR’s traditional data protection principles—especially purpose limitation, data minimization, storage limitation, and transparency—are in tension with digital health practices such as machine learning, repeated/combinatorial data use, and opaque corporate platforms.
  • Key regulatory categories are blurred in digital health: “quasi-health data” and re-identification risks undermine the distinctions between sensitive/non-sensitive and identifiable/anonymous data.
  • The “notice-and-consent” model is ineffective in digital health contexts due to vague or inaccessible notices, constrained choices, passive acquiescence, and the more than 350,000 “health and fitness” apps available in Google, Apple, and Windows app stores.
  • The GDPR has a narrow scope vis-à-vis harms and discrimination from algorithmic social sorting, including group-level harms and difficulties tracing causality, leaving data subjects without adequate legal remedies.

Methods

  • Conceptual and literature-based review drawing on data protection, legal, sociological, ethical, and policy scholarship.
  • The analysis groups GDPR shortcomings into four broad areas, summarized in Table 1: data protection principles, regulatory categories, informational self-determination/notice-and-consent, and the narrow scope of the Regulation.
  • No empirical sample, dataset, or primary data collection is reported; the main analysis is a synthesis of existing literature applied to European digital health.

Limitations

  • The paper does not include a dedicated limitations section.
  • Evident from the text: it is a literature-based conceptual review, so its claims rest on synthesis of prior scholarship rather than new empirical evidence.
  • Evident from the text: the analysis is focused on the European digital health ecosystem and the GDPR, and it notes that national implementation differences will be key, limiting generalizability.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1080/01442872.2020.1724929

Cites

75 of 75 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 68 cited sources checked · 0 supported · 0 flagged

  • Interpretationcitation

    New technological affordances and the corporate business models of DH platforms defy a number of key principles that have long governed data protection law.

    “New technological affordances (such as machine learning and deep learning) (Kuner et al. 2018;Pierce 2018) and the corporate business models of DH platforms (Srnicek 2016;Van Dijck and Poell 2016 van Dijck, Poell, and de Waal 2018), have been shown to defy a number of key principles that have long since governed data protection law.”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites Kuner et al. 2018

      Not checked in the free run.

    • cites Pierce 2018

      Not checked in the free run.

    • cites Srnicek 2016

      Not checked in the free run.

  • Interpretationreasoning

    The principles of purpose limitation, data minimization, and storage limitation appear to be in tension with DH, notably with big data analytics and AI.

    “Two principles,”
    • Also stated in: § Digital health generates frictions with data protection principles · hedged
      “Yet, while representing the main traditional pillars of past and present data protection governance regimes, these principles appear to be in tension with DH, notably with respect to the rise of big data analytics and AI.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Pierce 2018

      Not checked in the free run.

    • cites Kuner et al. 2017

      Not checked in the free run.

  • Premisecitation

    Opacity in DH corporate platforms may refer to proprietary regimes and corporate secrecy under which they operate.

    “First, opacity may refer to the proprietary regimes and corporate secrecy under which corporate platforms in DH operate (see, e.g.Kuner et al. 2017;Pasquale 2015;Powles and Hodson 2017).”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites Kuner et al. 2017

      Not checked in the free run.

    • cites Pasquale 2015

      Not checked in the free run.

    • cites Powles and Hodson 2017

      Not checked in the free run.

  • Interpretationnone given

    The principle of transparency is greatly challenged by DH platforms and technologies navigating big data environments.

    “Aside from purpose limitation, data minimization, and storage limitation, a fourth key principle greatly challenged by DH platforms and technologies navigating big data environments is transparency.”
    Quote in the paperSubstantial claim
  • Interpretationreasoning

    Key underlying data protection principles of the GDPR are misaligned with the surge in digital health.

    “Central aspects of the GDPR-i.e. key underlying data protection principles and regulatory categories, the reliance on the”
    • Also stated in: § The GDPR: misalignments and tensions with current developments in digital health · plain
      “(i) the limited scope of traditional data protection principles in accounting for shifts in modes of data processing enabled by new technological affordances and business models in the DH domain;”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. 24
  • May combine two claims. 22
  • The quote only partly states this claim. 1

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The GDPR is premised on the objective to balance a high level of protection for the fundamental right to data protection and strong consumer rights against the need to create a fair and functioning digital market with growth and innovation.

    “the GDPR is premised on the objective to balance the protection of individual privacy and the promotion of a thriving European data economy.”
    • Also stated in: § Introduction · plain
      “the GDPR is premised on the objective to reconcile two competing requirements, that is, to provide the right balance between a high level of protection for the fundamental right to data protection as well as strong consumer rights in the digital age, on the one side, and the need to create a fair and functioning digital market, with a real chance for growth and innovation, on the other side.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Albrecht 2016a

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    Machine learning algorithms 'learn and develop' and are not necessarily directed by their programmers, making it difficult to foresee in advance the purpose of processing personal data.

    “inasmuch as machine learning algorithms”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Kuner et al. 2017

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    Risk scores generated by predictive models can refine personalized medical diagnoses or be deployed for hospital administrative purposes, such as evaluation of physician performance and pay.

    “Within the context of healthcare, the risk scores generated by these models can, in turn, refine personalized medical diagnoses, or they can be deployed for hospital administrative purposes, such as for the evaluation of physician performance and pay (Hogle 2016).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Hogle 2016

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation

    DHTs render the traditional boundaries between healthcare and other societal domains increasingly unstable and porous, which questions still prevalent legal classifications of different types of data within 'siloed' regulatory categories.

    “This way, DHTs render the traditional boundaries between healthcare and other societal domains increasingly instable and porous (Hogle 2016), and this in turn questions still prevalent legal classifications of different types of data (e.g.sensitive, health-related, and anonymous) within”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationcitation

    De-identified data, notably genomic data, present in most contexts residual risk of re-identification, rendering the regulatory machinery around identifiable/anonymous demarcation increasingly burdensome and ineffective for protection.

    “Consequently, owing also to constant technological advancements, de-identified data -notably genomic data -can be said to present in most contexts residual risk of re-identification, rendering the regulatory machinery revolving around the identifiable/anonymous demarcation increasingly burdensome and ineffective for the protection of data subjects (Quinn and Quinn 2018;Shabani and Marelli 2019).”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Quinn and Quinn 2018

      Not checked in the free run.

    • cites Shabani and Marelli 2019

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Harms deriving from discriminations based on algorithmic classifications and social sorting can include unfair and unequal treatment, whereby individuals are treated differently from other individuals similar to them in all relevant aspects.

    “More broadly, harms deriving from these kinds of discriminations based on algorithmic classifications and social sorting, which may even occur on the basis of biased data or wrongful inferences (Ferryman and Pitcan 2018), can include unfair and unequal treatment, whereby, on the basis of perhaps innocuous attributes, individuals are”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites Mittelstadt 2017

      Not checked in the free run.

    • cites Eubanks 2018

      Not checked in the free run.

    • cites Hogle 2016

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationreasoning

    The rapid expansion of large corporate actors into the health sector holds the potential to fundamentally reconfigure the health ecosystem and its underlying infrastructures, fostering privatization dynamics that may overhaul the public nature of most European healthcare systems.

    “In turn, the rapid expansion of large corporate actors into the health sector holds the potential to fundamentally reconfigure the health ecosystem and its underlying infrastructures, fostering privatization dynamics that are possibly bound to overhaul the public nature of most European healthcare systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    These practices and their consequences are often not accounted for nor tackled in legal regimes governing DHTs.

    “Still, these practices and their consequences are often not accounted for nor tackled in legal regimes governing DHTs.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The re-purposing of data from the biomedical domain to commercial, financial, or other social domains greatly increases the potential for violating 'contextual integrity' and may entail significant harms for data subjects.

    “This greatly increases the potential for violating”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites Nissenbaum 2004

      Not checked in the free run.

    • cites Lupton 2018

      Not checked in the free run.

    • cites Pasquale 2015

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Information (notice) is prodromal to the exercise of self-determination (consent), which is both an expression of choice and an instrument to negotiate the economic value of personal information.

    “Information (notice), in this respect, is prodromal to the exercise of self-determination (consent), which in turn should not only be regarded as the expression of choice with respect to the diffusion of personal information, but also as an instrument to negotiate the latter's economic value as the data subject engages in digital transactions (Mantelero 2014, 649).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Mantelero 2014

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    New technological affordances (e.g. machine learning) involve repeated and combinatorial use of data.

    “repeated and combinatorial use of data”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    New technological affordances (e.g. machine learning) make it impossible to identify purposes at time of data collection.

    “impossibility to identify purposes at time of data collection”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation

    The GDPR maintains a narrow focus on the individual, overlooking that privacy invasive practices need not target individuals as such; clustering and classification into algorithmically constructed groups can drive harmful decisions for group members.

    “As observed above, the GDPR maintains a narrow focus on the individual, which -howeveroverlooks the fact that privacy invasive practices need not target individuals as such; rather, the mere clustering and classification of individuals into algorithmically constructed groups according to their behaviour, preferences, and other characteristics is sufficient to drive decisions that may potentially”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Gutwirth and Hildebrandt 2008

      Not checked in the free run.

    • cites Mittelstadt 2017

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    New technological affordances (e.g. machine learning) involve opacity of algorithms.

    “opacity of algorithms”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    Predictive modelling and risk scores, social sorting, involve algorithmic discriminations and privacy harms.

    “Algorithmic discriminations and privacy harms”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given

    Unintelligibility and/or vagueness of privacy notices involve a "transparency paradox".

    ““transparency paradox””
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation

    Notices are often vague or inaccessible, often taking the form of contracts in poorly intelligible legalistic language.

    “For one thing, notices are often vague (ibid.)or inaccessible, not seldom taking the form of contracts drafted in poorly intelligible legalistic language (Hayden 2012).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Hayden 2012

      Not checked in the free run.

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given

    "Lifestylization of healthcare" and use of health data outside healthcare institutions involve context transgression.

    “context transgression”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Unintelligibility and/or vagueness of privacy notices challenge the informational self-determination approach, specifically the notice-and-consent model.

    “| § Unintelligibility and/or vagueness of privacy notices: | Informational self-determination |”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    "Lifestylization of healthcare" and use of health data outside healthcare institutions involve "regular" data types conveying sensitive information.

    ““regular” data types convey sensitive information”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    New actors, corporate digital platforms, involve opacity of corporate business models.

    “opacity of corporate business models”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    The notice-and-consent approach is rooted in a liberal paradigm that conceives privacy as an individual right to control use of one's data and frames individuals mostly as consumers.

    “This approach -rooted in a distinctively liberal paradigm that conceives of the idea of privacy as an individual right to control the use of one's own data (Schwartz 1999;quoted in Cate 2010) and that frames individuals mostly in terms of consumers (cf.Albrecht 2016a) -revolves around the idea that individuals should be endowed with adequate means to exercise their autonomy and individual choice”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites Schwartz 1999

      Not checked in the free run.

    • cites Cate 2010

      Not checked in the free run.

    • cites Albrecht 2016a

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation

    Family members and next of kin could be equally harmed by misuse or unwanted uses of data, while being deprived of means to prevent processing or counter effects.

    “The latter could be equally harmed by misuse or unwanted uses of data, for instance related to access to consumer genomics database such as GEDMatch (Erlich et al. 2018), while at the same time being deprived of the means to prevent the processing operations leading to unwanted uses or misuse, or counter the effects deriving from them (Dove 2018b).”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Erlich et al. 2018

      Not checked in the free run.

    • cites Dove 2018b

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    Novel data processing activities perform new forms of social sorting and social classifications, to the potential detriment of relevant parts of the population.

    “In turn, novel data processing activities perform new forms of social sorting and social classifications, to the potential detriment of relevant parts of the population.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation

    Patterns and correlations used to group individuals are often functionally equivalent to personal identifiers and sometimes to sensitive protected attributes, but it remains questionable whether they are afforded comparable status under the GDPR.

    “Additionally, while patterns and correlations used to group individuals are often-times de facto functionally equivalent to personal identifiers (e.g.name, address), and sometimes even to sensitive protected attributes (e.g.ethnicity), it remains questionable whether they are afforded comparable status under the GDPR (Mittelstadt 2017, 479), also owing to misalignments between anti-discrimination”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Mittelstadt 2017

      Not checked in the free run.

    • cites Drechsler and Benito Sánchez 2018

      Not checked in the free run.

  • May combine two claims.

    Interpretationcitation

    A final set of limitations of the current data protection regime concerns the narrow scope of the GDPR with respect to possible individual and societal harms, such as algorithmic discrimination and social sorting, caused by DHTs, which results in a lopsided balance of power between data controllers and data subjects.

    “A final, related set of limitations of the current data protection regime concerns the narrow scope provided by the GDPR with respect to the possible individual and societal harms, such as those deriving from practices of algorithmic discrimination and social sorting, caused by the deployment of DHTs -which, as McMahon, Buyx, and Prainsack (2019) argue, results in a significantly lopsided balance”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites McMahon, Buyx, and Prainsack 2019

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    The challenges could prompt national and/or sectoral regulations aimed at tailoring the GDPR to specific processing activities towards regarding any data as potentially identifiable, health-related, and sensitive, thus de facto eliminating any pre-defined distinction based on the nature of the data alone.

    “This could prompt national and/or sectoral regulations aimed at tailoring the GDPR to specific processing activities (see conclusions) towards regarding any data as potentially identifiable, healthrelated, and sensitive (McMahon, Buyx, and Prain-sack 2019; Prainsack and Buyx 2017), thus de facto eliminating any pre-defined distinction based on the nature of the data alone.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites McMahon, Buyx, and Prainsack 2019

      Not checked in the free run.

    • cites Prainsack and Buyx 2017

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    All these issues are for the most part forgone by the GDPR, owing perhaps also to disruptions that more radical departures from previous legislation could have caused in day-to-day legal practice.

    “All these issues are for the most part forgone by the GDPR -owing perhaps also to the disruptions that more radical departures from the previous legislation could have caused in day-to-day legal practice.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given

    New types of actors, large consumer technology corporations, make their appearance within health research and care, rendering it prone to dynamics of digital capitalism.

    “New types of actors, in the guise of large consumer technology corporations, make their appearance within the domain of health research and care, rendering the latter prone to the dynamics that characterize emerging forms of digital capitalism.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    "Lifestylization of healthcare" and use of health data outside healthcare institutions challenge the key categorial distinction between sensitive and non-sensitive data.

    “| § “Lifestylization of healthcare” and use of health data outside | Key categorial distinctions: |”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    "Opt-in vs. opt-out" choice in DH platforms involves highly constrained choices, passive acquiescence when consenting.

    “highly constrained choices, passive acquiescence when consenting”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    "Opt-in vs. opt-out" choice in DH platforms involves propensity for easily waiving privacy rights.

    “propensity for easily waiving privacy rights”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    New technological affordances (e.g. predictive and inferential analytics) involve "regular" data types conveying sensitive information.

    “| § New technological affordances (e.g. predictive and inferential analytics): | |”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    Unintelligibility and/or vagueness of privacy notices involve lack of transparency.

    “lack of transparency”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given

    New actors, corporate digital platforms, involve re-purposing of datasets and context transgression.

    “re-purposing of datasets and context transgression”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    Open access genomic databases involve de-anonymization of datasets.

    “| § Open access genomic databases | |”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims. The quote only partly states this claim.

    Interpretationreasoning

    Predictive modelling and risk scores, social sorting, challenge the (narrow) scope of the regulation, specifically its narrow legal remit.

    “| | § Narrow legal remit |”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    Predictive modelling and risk scores, social sorting, challenge the (narrow) scope of the regulation, specifically its focus on the individual data subject.

    “| § Predictive modelling and risk scores, social sorting: | (Narrow) scope of the |”
    Quote in the paperNot a substantial claim
38 of 38

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • According to GDPR, the service provider must also provide the customer with all the data in a format that is readable on the computer.

    “Further, the service provider must also provide the customer with all the data in a format that is readable on the computer.”

    From A survey on the adoption of blockchain in IoT: challenges and solutions (2021) · cites this paper as [181]

  • According to GDPR, the service provider must generate a report at the request of the user on how the user's data is being processed and used.

    “The service provider must generate a report at the request of the user on how the user's data is being processed and used.”

    From A survey on the adoption of blockchain in IoT: challenges and solutions (2021) · cites this paper as [181]

  • According to GDPR, a service provider must incorporate facilities of the user's consent and the withdrawal of that consents in their system.

    “According to the regulations, a service provider must incorporate facilities of the user's consent and the withdrawal of that consents in their system.”

    From A survey on the adoption of blockchain in IoT: challenges and solutions (2021) · cites this paper as [181]

  • GDPR health regulations outlined privacy laws across Europe to protect user's control and confidentiality on his or her health data.

    “GDPR health regulations [181] outlined privacy laws across Europe to protect user's control and confidentiality on his or her health data.”

    From A survey on the adoption of blockchain in IoT: challenges and solutions (2021) · cites this paper as [181]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Hogle citation points outside the listed page range

    Minor

    The paper cites page 423 of Hogle (2016), but its reference entry lists the article as spanning pages 372-393.

  • Hildebrandt citation points outside the listed page range

    Minor

    The paper cites page 212 of Hildebrandt (2015), but its reference entry lists pages 157-159.

2 of 2

Cites

Flagged first, then by citations

3 of the 78 references couldn’t be matched to a known paper.

Research works printed but not linked: 20

  1. Andrejevic M., 2014, International Journal of Communication, 8, 1673
  2. Cate F., 2010, California Law Review, 98, 1765
  3. Drechsler L., 2018, European Journal of Law and Technology, 9
  4. Lupton D., 2018, Digital Health: Critical and Cross-Disciplinary Perspectives (Critical Approaches to Health)
  5. Mayer-Schönberger V., 2016, The Columbia Science & Technology Law Review, 17, 315
  6. McMahon A., 2019, Medical law Review, 1
  7. Mulder T., 2019, European Journal of Law and Technology, 10
  8. Nissenbaum H., 2004, Washington Law Review, 79, 119
  9. Official Journal of the European Communities. 2000.Charter of Fundamental Rights of the European Union (2000/C 365/01). Last accessed January 10 2020. https://www.europarl.europa.eu/charter/pdf/text_en.pdf.
  10. Official Journal of the European Union. 2016.Regulation (EU) 2016/679 of The European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation). Last accessed January 10 2020. https://eur-lex.europa.eu/eli/reg/2016/679/oj.
  11. Official Journal of the European Union. 2017a.Regulation (EU) 2017/745 of the European Parliament and the Council of 5 April 2017 on Medical Devices, Amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and Repealing Council Directives 90/385/EEC and 93/42/EEC. Last accessed January 10 2020. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32017R0745.
  12. Official Journal of the European Union. 2017b.Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in Vitro Diagnostic Medical Devices and Repealing Directive 98/79/EC and Commission Decision 2010/227/EU. Last accessed January 10 2020. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32017R0746.
  13. Prainsack B., 2017, Medicine and Law, 36, 87
  14. Sloan R. H., 2014, The Journal of High Technology Law, 14, 370
  15. Srnicek N., 2016, Platform Capitalism
  16. Vayena E., 2018, Swiss Medical Weekly, 148, w14571
  17. Wachter S., 2019, Columbia Business Law Review, 2019, 494
  18. WHO, 2019, WHO Guideline: Recommendations on Digital Interventions for Health System Strenghtening
  19. WHO Director-General, 2017, mHealth: Use of Appropriate Digital Technologies for Public Health
  20. Zarsky T., 2017, Seton Hall Law Review, 47, 995

Cited by

Sorted by citations

Related

Authors
Marelli, L., Lievevrouw, E., & Van Hoyweghen, I.
Affiliations
  • University of Milan (IT)
  • KU Leuven (BE)
  • Life Sciences & Society Lab, Centre for Sociological Research (CeSO), KU Leuven, Leuven, Belgium
Corresponding author
Marelli, Luca
ORCID
Venue
Policy Studies
Publisher
Informa UK Limited
Published
2020-02-10
Volume
41
Issue
5
Pages
447-467
ISSN
  • 0144-2872 (ISSN-L)
  • 1470-1006
DOI
10.1080/01442872.2020.1724929
OpenAlex
W3006483158
Cited by
137
References
78
Citations by year
2026: 11 · 2025: 13 · 2024: 18 · 2023: 56 · 2022: 12 · 2021: 17 · 2020: 10
FWCI
155.55
Type
journal article
Language
en
Open access
Licence
other-oa
Locations
  • Policy Studies (publishedVersion)
  • Lirias (KU Leuven) (submittedVersion, other-oa)
  • RePEc: Research Papers in Economics (submittedVersion)
Funders
  • Fonds Wetenschappelijk Onderzoek (11C8520N, 3H140131)
  • H2020 Marie Skłodowska-Curie Actions (753531)
Topics
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Physical Sciences › Computer Science › Information Systems › Thoreau and American Literature
  • Physical Sciences › Computer Science › Information Systems › COVID-19 Digital Contact Tracing
Keywords
General Data Protection Regulation, data governance, digital health, big data, data protection principles, privacy, data economy, regulatory fit, discrimination, European Union regulation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review