German Data Protection Commissioner Urges Clearer Information and Granular Controls for Electronic P

Key Takeaways

• Germany's Federal Data Protection Commissioner (BfDI) has issued recommendations urging the Federal Government to improve public information and give insured persons finely differentiated control over who can view their electronic patient record (ePA) data.
• From the end of October 2026, pseudonymized medication list data can be extracted from the ePA for research unless the insured person objects.
• Compliance teams at health-sector organizations and research partners should treat this as a signal of regulatory expectations for consent, transparency, and secondary use of health data.

Deep Dive

Germany's Federal Data Protection Commissioner (BfDI) has issued recommendations urging the Federal Government to improve public information and give insured persons finely differentiated control over who can view their electronic patient record (ePA) data. From the end of October 2026, pseudonymized medication list data can be extracted from the ePA for research unless the insured person objects. Compliance teams at health-sector organizations and research partners should treat this as a signal of regulatory expectations for consent, transparency, and secondary use of health data.

The recommendations rest on a representative BfDI Data Barometer survey of 1,500 people with statutory health insurance. Nine out of ten respondents want to keep their ePA, and 55 percent of those who object cite data protection and security concerns. 83 percent want finely differentiated control over who can view which data, and more than two-thirds would share data with doctors and researchers. The BfDI concludes that granular access controls and broad data use are compatible. More than four out of ten respondents do not know the ePA's central features, even though 95 percent know its name. According to gematik, 5.85 million insured persons actively use the ePA, measured by registered health IDs.

The BfDI makes three main recommendations to the Federal Government:
- Close knowledge gaps quickly through active public information.
- Make self-determined control of data releases user-friendly.
- Create clear legal framework conditions for automated evaluations of health data.

The last point suggests current rules on automated analysis, including AI-driven analytics, are seen as insufficiently clear. Legislative or regulatory follow-up is possible, but no timeline has been set.

Recommended actions for compliance professionals:
- Map any planned use of ePA-derived or similar health data, including research partnerships and analytics.
- Confirm that opt-out and objection mechanisms are technically enforced and auditable.
- Reassess pseudonymization controls and re-identification risk, since pseudonymized data remains personal data under GDPR.
- Review data protection impact assessments for secondary use and automated evaluation.
- Update patient-facing notices to be plain-language and accurate about features and choices.
- Monitor for legislative proposals on automated health data analysis.

Risk implications: the main exposure is reputational and regulatory. Weak transparency or poor objection handling could erode public trust, increase objection rates, and attract supervisory attention. The 55 percent of objectors citing security concerns underscores that security incidents would have an outsized impact. Since the paper is advisory, near-term enforcement risk is low. Even so, it signals the standards the BfDI is likely to apply in future guidance and supervision.

Source: Federal Commissioner for Data Protection and Freedom of Information