The analysis of large medical datasets has the potential to significantly advance medical research and create new diagnostic and treatment options. Under current law, however, data protection requirements often make it difficult to make patient data available and use it for scientific research purposes. Health data is subject to the strict - and in some cases unclear - requirements of the GDPR and supplementary national regulations. Obtaining patient consent for data processing for scientific research purposes is often difficult, as it requires a specific, narrowly defined purpose to be established in advance. However, the research purposes are often not yet foreseeable at the time consent is obtained. Obtaining “broad” consent is only possible under the guidelines of the Medical Informatics Initiative and requires the use of an extremely lengthy - and therefore not patient-friendly - consent form.

While some legal bases do permit data processing without consent for research purposes, this requires a careful balancing of the interests of data subjects against the interests of processing, which inevitably entails a high degree of legal uncertainty. Data-driven research therefore requires legal bases that are formulated with sufficient clarity. A legal basis for anonymization is also recommended. Under no circumstances should the new Health Data Use Act (GDNG), with its provisions on the use of research data, fall short of the current possibilities for data use for research purposes. However, this is a concern in light of the provisions set forth in the draft bill of the GDNG (GDNG-RefE) published on August 4, 2023. The comment first outlined the legal basis for data-driven research under current law before comparing it to the provisions of Article 1, Section 4 of the GDNG-RefE. Finally, the need for amendments to the GDNG-RefE was summarized.