Anonymization, accountability, and access: legal dimensions of health data sharing in federated networks. Perspectives from empirical study

This paper explores the perspectives of stakeholders involved in federated networks for health data sharing, focusing on the legal and practical dimensions of data protection and governance under GDPR and EHDS in the development of such infrastructures. Using a qualitative approach centered on perspectives of 19 experts with experience in projects building federated networks, it investigates the perceived challenges in fulfilling specific obligations under the GDPR, as well as in establishing the contractual framework of a federated network, including the arrangements and mechanisms required to control data access and to define the conditions for lawful and effective data sharing and reuse. The study critically assesses the commonly cited assurance that “data never leaves the node” and evaluates the compatibility of federated approaches with data protection requirements. It highlights key tensions between legal theory and practical implementation, offering insights relevant to the design and governance of other federated architectures and emerging European data spaces. Study results indicate that while the advantages of a federated approach, such as data minimization, should not be discarded, there are also significant challenges of aligning federated networks architectures with data protection requirements in particular. Federated networks help initiate discussions about data sharing with new data holders, but they do not offer a straightforward solution to legal and technical challenges of data sharing.