Recital 35
General Data Protection Regulation · UE 2016/679
| (35) | Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. This includes information about the natural person collected in the course of the registration for, or the provision of, health care services as referred to in Directive 2011/24/EU of the European Parliament and of the Council (9) to that natural person; a number, symbol or particular assigned to a natural person to uniquely identify the natural person for health purposes; information derived from the testing or examination of a body part or bodily substance, including from genetic data and biological samples; and any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source, for example from a physician or other health professional, a hospital, a medical device or an in vitro diagnostic test. |
In Luxembourg, health data processing in hospitals is governed by the law of 24 July 2014 on patients' rights and obligations and by the law of 1 August 2018 organising the CNPD and implementing the GDPR, which preserves specific regimes for medical research and health registries. The CNPD is the competent authority and has published specific guidance on occupational medicine and electronic patient records.
Luxgap practice: for healthcare institutions, mutual insurers and employers with in-house occupational medicine in Luxembourg, we calibrate the Health Data Radar with CNPD reference frameworks and integrate eHealth specificities (shared care record, Agence eSante platform) to ensure operational compliance from the very first scan.
