The European Health Data Space regulation (EHDS) has been proposed to harmonize health data processing. Given its parallels with the Act on Secondary Use of Health and Social Data (Secondary Use Act) implemented in Finland in 2020, this study examines the consequences of heightened privacy constraints on registry-based medical research. Between 2020 and 2023, a median of 5.5% fewer data permits were approved annually in by Finnish university hospitals. Based on linear regression modelling, we estimated a reduction of 46.9% in new data permits nationally in 2023 compared to the expected count. Similar changes were not observed in other medical research types highlighting the consequences of excessive data privacy laws on registry-based medical research.

A.B. declares being an employee of Krogerus Attorneys Ltd and (business law firm) and has assisted private and public clients on matters relating to the relevant legislation, outside the submitted work. O.B. declares no Competing Non-Financial Interests but the following Competing Financial Interests: consultancy fees from Novartis, Sanofi, GSK, Astellas, and Amgen, outside the submitted work; research grants from Pfizer and Gilead Sciences, outside the submitted work; stock ownership (Hematoscope Oy), outside the submitted work. E.S. declares no Competing Non-Financial Interests but the following Competing Financial Interests: consultancy fees from Boehringer-Ingelheim, Pfizer and Orion, outside the submitted work; research grant from Business Finland, outside the submitted work.

The author wishes to thank Susanna Lauren (Turku University Hospital), Jaana Jappinen (Helsinki University Hospital), Minna Makiniemi (Oulu University Hospital), Satu Ranta (Tampere University Hospital), and Tuomas Selander (Kuopio University Hospital) for providing the data for the data permit counts for their university hospital. In addition, we would like to thank Antti Piirainen, Maari Parkkinen, and Johanna Seppanen (Findata) for providing information on the registry holders of Findata data permits as well as for insightful comments. This study was supported by research funding from the Helsinki University Hospital, Finnish Cancer Foundation, Research Council of Finland, and the University of Helsinki.

I confirm all relevant ethical guidelines have been followed, and any necessary IRB and/or ethics committee approvals have been obtained.

Yes

I confirm that all necessary patient/participant consent has been obtained and the appropriate institutional forms have been archived, and that any patient/participant/sample identifiers included were not known to anyone (e.g., hospital staff, patients or participants themselves) outside the research group so cannot be used to identify individuals.

Yes

I understand that all clinical trials and any other prospective interventional studies must be registered with an ICMJE-approved registry, such as ClinicalTrials.gov. I confirm that any such study reported in the manuscript has been registered and the trial registration ID is provided (note: if posting a prospective study registered retrospectively, please provide a statement in the trial ID field explaining why the study was not registered in advance).

Yes

I have followed all appropriate research reporting guidelines, such as any relevant EQUATOR Network research reporting checklist(s) and other pertinent material, if applicable.

Yes