Mass-Scale G2B Data Sharing in an Emergency: between the GDPR, Data Governance Act, and European Health Data Space

During the COVID-19 pandemic, government-to-business (G2B) data sharing became a vital practice, exemplified by the 2021 Israeli Ministry of Health-Pfizer agreement. This established a large-scale data sharing operation outside of research and data protection regulations and oversight. This paper explores two related questions: (i) whether an EU Member State could replicate this scenario, and (ii) whether EU data legislation provides sufficient protection against excessive G2B data sharing. The analysis of the General Data Protection Regulation, Data Governance Act, and European Health Data Space shows that (i) despite the uncertain definitions of research and personal data, it would be difficult for an EU Member State to replicate this scenario; and (ii) despite its many grey areas and flexibilities, EU data legislation offers protection against excessive G2B data sharing. This highlights the need to explore alternative strategies to facilitate data sharing that can address public health emergencies promptly while safeguarding fundamental rights.