Cited by 137Digitalization, Law, and RegulationThoreau and American LiteratureCOVID-19 Digital Contact Tracing

The DOI matches its Crossref record; 75 of the 78 references it cites were found in a registry or an index; none of the 68 sources its claims cite is checked for support yet.

Fit for purpose? The GDPR and the governance of European digital health

Open access
Marelli, Luca, Lievevrouw, Elisa, Van Hoyweghen, Ine·2020·Policy Studies

Abstract

The introduction of the General Data Protection Regulation (GDPR) in 2018 served as the cornerstone of the new data governance regime of the European Union. Informed by principles and values such as privacy, accountability, transparency, and fairness, the GDPR is premised on the objective to balance the protection of individual privacy and the promotion of a thriving European data economy. Still, shortcomings of this regulatory effort have been noted by recent ethical, socio-political, legal, and policy scholarship. Focusing on the deployment of digital health technologies and big data practices within the European digital health ecosystem, this article draws upon these bodies of literature to chart the main lines of tension emerging between the current GDPR-based data governance regime and the broader societal shifts coming along with the expansion of digital health. Central aspects of the GDPR–i.e. key underlying data protection principles and regulatory categories, the reliance on the “notice-and-consent” model, the (narrow) remit of the Regulation vis-à-vis possible harms and discriminations–are misaligned with the surge in digital health. This throws into doubt whether the Regulation is fully fit for the purpose of governing current developments in this field, while also calling for swift and adequate policy responses.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

The article reviews legal, socio-political, ethical, and policy literature to argue that the GDPR’s data governance regime is misaligned with the expansion of digital health and big data practices. It identifies four broad areas of tension and questions whether the GDPR is fully fit for purpose, calling for swift policy responses.

Key findings

  • The GDPR’s traditional data protection principles—especially purpose limitation, data minimization, storage limitation, and transparency—are in tension with digital health practices such as machine learning, repeated/combinatorial data use, and opaque corporate platforms.
  • Key regulatory categories are blurred in digital health: “quasi-health data” and re-identification risks undermine the distinctions between sensitive/non-sensitive and identifiable/anonymous data.
  • The “notice-and-consent” model is ineffective in digital health contexts due to vague or inaccessible notices, constrained choices, passive acquiescence, and the more than 350,000 “health and fitness” apps available in Google, Apple, and Windows app stores.
  • The GDPR has a narrow scope vis-à-vis harms and discrimination from algorithmic social sorting, including group-level harms and difficulties tracing causality, leaving data subjects without adequate legal remedies.

Methods

  • Conceptual and literature-based review drawing on data protection, legal, sociological, ethical, and policy scholarship.
  • The analysis groups GDPR shortcomings into four broad areas, summarized in Table 1: data protection principles, regulatory categories, informational self-determination/notice-and-consent, and the narrow scope of the Regulation.
  • No empirical sample, dataset, or primary data collection is reported; the main analysis is a synthesis of existing literature applied to European digital health.

Limitations

  • The paper does not include a dedicated limitations section.
  • Evident from the text: it is a literature-based conceptual review, so its claims rest on synthesis of prior scholarship rather than new empirical evidence.
  • Evident from the text: the analysis is focused on the European digital health ecosystem and the GDPR, and it notes that national implementation differences will be key, limiting generalizability.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1080/01442872.2020.1724929

Cites

75 of 75 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

49 Own interpretation · 37 Not checked yet

Verify all 68 references — free account

Show all 48 claims

  • Probably not a substantial claim. 24
  • It may state two separate claims as one. 22
  • The quote only partly states this claim. 1
38 of 38

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

2 of 2

Citations

Cites

Show all 78 references

Research works printed but not linked: 20

  1. Andrejevic M., 2014, International Journal of Communication, 8, 1673
  2. Cate F., 2010, California Law Review, 98, 1765
  3. Drechsler L., 2018, European Journal of Law and Technology, 9
  4. Lupton D., 2018, Digital Health: Critical and Cross-Disciplinary Perspectives (Critical Approaches to Health)
  5. Mayer-Schönberger V., 2016, The Columbia Science & Technology Law Review, 17, 315
  6. McMahon A., 2019, Medical law Review, 1
  7. Mulder T., 2019, European Journal of Law and Technology, 10
  8. Nissenbaum H., 2004, Washington Law Review, 79, 119
  9. Official Journal of the European Communities. 2000.Charter of Fundamental Rights of the European Union (2000/C 365/01). Last accessed January 10 2020. https://www.europarl.europa.eu/charter/pdf/text_en.pdf.
  10. Official Journal of the European Union. 2016.Regulation (EU) 2016/679 of The European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation). Last accessed January 10 2020. https://eur-lex.europa.eu/eli/reg/2016/679/oj.
  11. Official Journal of the European Union. 2017a.Regulation (EU) 2017/745 of the European Parliament and the Council of 5 April 2017 on Medical Devices, Amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and Repealing Council Directives 90/385/EEC and 93/42/EEC. Last accessed January 10 2020. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32017R0745.
  12. Official Journal of the European Union. 2017b.Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in Vitro Diagnostic Medical Devices and Repealing Directive 98/79/EC and Commission Decision 2010/227/EU. Last accessed January 10 2020. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32017R0746.
  13. Prainsack B., 2017, Medicine and Law, 36, 87
  14. Sloan R. H., 2014, The Journal of High Technology Law, 14, 370
  15. Srnicek N., 2016, Platform Capitalism
  16. Vayena E., 2018, Swiss Medical Weekly, 148, w14571
  17. Wachter S., 2019, Columbia Business Law Review, 2019, 494
  18. WHO, 2019, WHO Guideline: Recommendations on Digital Interventions for Health System Strenghtening
  19. WHO Director-General, 2017, mHealth: Use of Appropriate Digital Technologies for Public Health
  20. Zarsky T., 2017, Seton Hall Law Review, 47, 995

Cited by

Sorted by citations

Items 101–137 of 137

Metadata

Authors
Marelli, L., Lievevrouw, E., & Van Hoyweghen, I.
Affiliations
  • University of Milan (IT)
  • KU Leuven (BE)
  • Life Sciences & Society Lab, Centre for Sociological Research (CeSO), KU Leuven, Leuven, Belgium
Corresponding author
Marelli, Luca
Venue
Policy Studies
Published
2020-02-10
Volume
41
Issue
5
Pages
447-467
ISSN
  • 0144-2872 (ISSN-L)
  • 1470-1006
OpenAlex
W3006483158
Cited by
137
References
78
Citations by year
2026: 11 · 2025: 13 · 2024: 18 · 2023: 56 · 2022: 12 · 2021: 17 · 2020: 10
FWCI
155.55
Type
journal article
Language
en
Open access
Licence
other-oa
Locations
  • Policy Studies (publishedVersion)
  • Lirias (KU Leuven) (submittedVersion, other-oa)
  • RePEc: Research Papers in Economics (submittedVersion)
Funders
  • Fonds Wetenschappelijk Onderzoek (11C8520N, 3H140131)
  • H2020 Marie Skłodowska-Curie Actions (753531)
Topics
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Health Sciences › Health Professions › Health Information Management › Thoreau and American Literature
  • Physical Sciences › Computer Science › Information Systems › COVID-19 Digital Contact Tracing
Keywords
General Data Protection Regulation, data governance, digital health, big data, data protection principles, privacy, data economy, regulatory fit, discrimination, European Union regulation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review