Digital Health Legal
Back to Contents

Volume: 4 Issue: 5
(May 2017)

article 29 working party identifies areas improvement draft mhealth code conduct privacy article 29 working party (‘wp29 published 28

Europe EU

Share This Page

Article 29 Working Party identifies areas for improvement with the draft mHealth Code of Conduct for Privacy

The Article 29 Working Party (‘WP29’) published on 28 April 2017 its feedback on the draft mHealth Code of Conduct for Privacy (the ‘Code’) submitted in June 2016 by the Working Group created by the European Commission. The WP29 assessed the Code in regards to both the current EU Data Protection Directive (‘DPD’) and the requirements of the General Data Protection Regulation (‘GDPR’), and specifies a number of areas for improvement for the draft Code: inter alia that the draft Code does not provide sufficient added value to the DPD, and that the draft Code must go further in elaborating on the relationship between the DPD and Member States’ national legislation that implements the DPD.

The Code, intended to be a voluntary initiative for the mHealth industry, was created to build upon the obligations already set out in data protection law and assist mHealth app developers with privacy compliance. Via the EU review process, EU data protection authorities, including the WP29, are reviewing the draft Code to assess its compliance with legal requirements. The WP29 is keen for the Working Group when redrafting the Code to consider the ‘added value’ it provides, in order to warrant the Code achieving WP29 approval. “What is essential is the fact that the draft Code should be sufficiently clear by for example providing practical examples and also by including references to the existing EU and national legal framework,” explain Marc Martens and Tina Van Poelvoorde, Partner and Senior Associate respectively at Bird & Bird. “The Draft Code should also foresee an alignment with the provisions under the GDPR.” 

“The Code should not only address specific issues encountered by app developers and the mHealth sector, but also offer effective and clear solutions for those issues,” adds Mónica Oliveira Costa, Partner at Coelho Ribeiro & Associados. “Therefore, the Working Group should focus on identifying the specific data protection issues mHealth raises and provide solutions compliant with the applicable laws.”

The WP29 urges the Working Group to take into account other legislation beyond the DPD and the GDPR that is relevant to mHealth privacy. Such legislation includes the ePrivacy Directive, the eIDAS Regulation and the Unfair Commercial Practices Directive. “The Working Group will need to consider how the ePrivacy Directive impacts the development of mHealth applications,” said Wim Nauwelaerts, Partner at Hunton & Williams. “This will not be easy, because the ePrivacy Directive is currently being overhauled and it is unclear at this stage what the new legal framework will look like.”    

The WP29 also made a number of comments in relation to specific areas of the draft Code, including in relation to security, third country transfers, and data protection principles. “The WP29 also indicates where it strongly disagrees with statements in the draft Code, for example where the draft Code states ‘it is permissible for the app to make acceptance of advertisements a condition of the use of the app,’ the WP29 refers to the GDPR to imply that this approach is not permitted,” said Victoria Hordern, Counsel at Hogan Lovells.

The Code will now need some redrafting before resubmission to the WP29. Although there do not seem to be any specified timescales for resubmission, Philippe Bradley-Schmieg, Associate at Covington & Burling, notes that on one hand “The Code’s authors - and indeed the wider mHealth sector - may want this out ASAP,” but “if the authors decide to cover the broader legal framework, as urged by the WP29, it may make sense to aim for mid-2018 completion, since by that time the wider legal framework will hopefully be more settled.”

Search Publication Archives

Our publication archives contain all of our articles.
Can’t find what you are looking for?
Try an Advanced Search

Log in to digital health legal
Subscribe to digital health legal
Register for a Free Trial to digital health legal
digital health legal Pricing

Social Media

Follow digital health legal on TwitterView digital health legal LinkedIn Profiledigital health legal RSS Feed