GFF Lawsuit: Dispute over central storage of insured data resumes
The lawsuit filed by the Society for Civil Rights against the central storage of 73 million health data records continued. It had previously been put on hold.
(Image: PopTika/Shutterstock.com)
The lawsuit against the central storage of health data of all statutory insured individuals is being continued. The Society for Civil Rights (GFF) and Constanze Kurz, spokesperson for the Chaos Computer Club (CCC), have filed further briefs with the Berlin Social Court. The proceedings had been dormant since February 2023 because the responsible Research Data Centre Health (FDZ Gesundheit) was initially not operational.
Pseudonymization not sufficient
The lawsuit is primarily directed against the FDZ Gesundheit, which is part of the Federal Institute for Drugs and Medical Devices (BfArM), and which, according to its statements, pseudonymizes and centrally collects billing data from around 73 million statutory insured individuals and makes it available for research purposes. The data has been consolidated in a central database since 2022, supplemented annually, and is to be stored for up to 100 years. “The extended storage period increases the amount of stored data, thus making the data collection even more valuable and increasing the risk of misuse,” the GFF told heise online.
The proceedings were put on hold three years ago because the FDZ could not present a conclusive IT security concept and was not operational due to problems with a service provider. Since October 2025, the FDZ has been operational and enables data access for the first successful applicants. GFF and CCC therefore consider the basis for a judicial clarification to be established.
The plaintiffs particularly criticize that insured individuals cannot object to the data transfer. Furthermore, they consider central storage to be an unnecessary security risk. “Health data absolutely requires appropriate security measures to protect it. And all insured persons should finally be given the right to object to this central data collection,” says Constanze Kurz.
Empfohlener redaktioneller Inhalt
Mit Ihrer Zustimmung wird hier ein externes YouTube-Video (Google Ireland Limited) geladen.
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (Google Ireland Limited) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.
According to the GFF, only the name and date and month of birth are removed for the transfer. An expert report commissioned by the GFF (PDF) by cryptography expert Dominique Schröder concludes that this form of pseudonymization does not offer sufficient protection, as affected individuals can be re-identified by matching with other datasets.
Alternative without central database
In response to an inquiry from heise online, the GFF stated that an alternative would be “to forgo the FDZ as a central data collection point.” Instead of permanent central storage, health insurance companies would transmit requested data on a case-by-case basis in pseudonymized form. The FDZ would merely function as an interface to the researchers. This approach is described in more detail in the expert report prepared by Dominique Schröder. When asked, the GFF also explained that informed consent would generally be a step in the right direction, “because insured persons would thus be able to decide about their data.”
Consequences of a possible successful lawsuit
Regarding the possible implications of a successful lawsuit, the GFF told heise online: “With the ongoing proceedings, we want to clarify fundamental questions about the handling of health data – and achieve concrete improvements for the insured.”
A successful lawsuit could also impact ongoing research projects. At the same time, the organization emphasized that it is not opposed to research with health data. “When used in the public interest, they represent a valuable resource. It is therefore fundamentally sensible to make them accessible to researchers. However, such research must always take the rights of the insured into account.”
(mack)
