The secondary processing of personal health data for scientific research in the medical field is fundamental for fostering innovation and growing knowledge that improves individual and public health. Personal health data that are primarily processed for healthcare purposes by healthcare providers may be secondarily used by researchers for scientific purposes. However, the data controller shall assess the applicable grounds and conditions and then comply with the data protection framework to safeguard fundamental rights and freedoms. In this paper we analyse the legal requirements laid down on these aspects by the General Data Protection Regulation at the European Union level, which harmonises the general rules, and by two national implementations at the Member State level, Italy and France, which further regulate with specific conditions. After this comparative investigation, we propose a proactive, legal-technical e-health solution that complies with the rules and principles of the legal frameworks and empowers the individual���s control over personal health data while promoting medical research. To this end, the data protection by design concept plays a central role, and an interdisciplinary approach is fundamental in combining legal and technical perspectives.

This paper has also been published in open access in the issue 1/2021 of the Journal Opinio Iuris in Comparatione. Paolo Guarda authored paragraphs 2 and 3. Giorgia Bincoletto authored paragraphs 4 and 5. They co-authored paragraphs 1 and 6. All links to websites were confirmed as of 11 November 2021. They grate-fully acknowledge their debt to the "eHealth" Research Units within Fondazione Bruno Kessler, to the Competence Center on Digital Health "TrentinoSalute4.0" and "Laboratorio congiunto con la Facolt�� di Giurisprudenza ��� Universit�� di Trento" for the support received for our research. They would like to thank Lo-renzo Gios for his valuable contributions and feedback. All errors remain their own.