Does the European Union allow to store medical (sensitive) data in cloud platforms such as Amazon Web Services or Google Cloud?

Question

Does the EU allow to store patients medical data in cloud databases from providers such as Amazon Web Services or Google Cloud?

What are the legal requirements?

Can you point at some legal source about this matter?

Answer 1

Storing medical data in cloud services can be legal, but isn't necessarily so (as with any other kinds of data).

The GDPR considers health-related data as “special categories” of data per Art 9. Processing such data is forbidden, unless an exception applies. Per Art 9(2)(h) such processing is allowed when it is

[…] necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3

Paragraph 3 requires that processing under 9(2)(h) only occurs under the responsibility of someone who is subject to an obligation of secrecy per Union or member state law, e.g. a doctor. Paragraph 4 allows individual member states to add further conditions, including limitations, to such processing.

Assuming that electronic storage or processing of health data is in fact necessary, the GDPR does not make a strong distinction between in-house processing, and processing via Data Processors. Of course, the usual conditions for using data processors and performing international transfers apply.

However, a data controller processing medical data will almost certainly have to first perform an Art 35 Data Protection Impact Assessment. This DPIA must consider various risks. Transferring data into third countries is risky. Using data processors is risky. But processing data in-house can also be risky, so using an external service could improve things. There is a lot to be balanced here. Where the planned processing has high risks, the responsible supervisory authority has to be consulted first (Art 36). The authority can provide “advice”, or even ban the processing per Art 58.