In 2013 England announced a programme called care.data. The idea was sensible on its face: extract information from general practice records into a central database so that researchers and planners could use it, in anonymised form, to improve care. Households received a leaflet. Critics said it described the benefits and not how to opt out. Patients and doctors worried about who would get access, including commercial organisations. The programme was paused, relaunched, paused again, and abandoned in July 2016.
In May 2021 the NHS announced its successor, General Practice Data for Planning and Research. Doctors urged delay. A backlog of patient opt-outs built up. The launch, due for July 2021, was pushed back and then put on hold until conditions were met, including the ability to delete data for people who opted out after upload and the development of a trusted research environment.
In November 2023, NHS England awarded Palantir a seven-year contract worth around £330 million to build and operate a Federated Data Platform connecting data across the health service. The British Medical Association and others criticised it immediately.
Three attempts, over a decade, to do something most health experts agree is worthwhile: use routine health data to improve care. Each ran into the same wall. The wall is usually described as a debate about who owns patient data. My argument is that ownership is the wrong frame, and that clinging to it makes the underlying problem harder to solve. The real questions are about control, access and who captures the value, and they have answers that ownership cannot provide.
Why ownership doesn’t fit
Ownership is a concept built for things like land, cars and shares. If I own something, I can use it, exclude others from it and sell it. When I sell it, I no longer have it.
Health data does not behave like that. A record of my blood pressure exists in my GP’s system, my hospital’s system and perhaps a lab’s. Copying it does not deprive anyone of it. It is created jointly: I provided the body, the nurse took the measurement, the health system paid for the equipment and the record. And it is relational: my records reveal things about my family, and my genome is partly theirs.
If patients “own” their data in a property sense, can they sell it? Most people would recoil at a market where poorer patients sell detailed health records to insurers or advertisers. If the state owns it, can the state sell it? That was exactly the fear behind the care.data backlash. If hospitals own it, they become gatekeepers with commercial incentives. Each version of ownership produces an outcome that most people find unacceptable.
This is why the ownership debate goes round in circles. It keeps offering property rights as the answer to a question about governance.
What data sovereignty actually means
“Data sovereignty” is often used as if it were the same as ownership, but its more useful meaning is different. It is about jurisdiction and control: which laws apply to data, who decides who can access it, and whether those decisions are made by accountable public bodies or by whoever holds the servers.
At the national level, sovereignty concerns are real. A country whose health data is stored and processed by foreign firms, under foreign law, may find that its own institutions have less control over it than the vendor. That is one reason health data sovereignty has become a political issue in countries building digital health systems with the help of large international technology providers.
But national sovereignty is not the same as patient control. A state that insists all health data stay within its borders may also be a state that gives its own security services broad access to it. Patients can trust their own government’s use of their data less than a foreign researcher’s, depending on the government. Sovereignty answers the question “whose law?” It does not answer “is this use legitimate?”
The European model: governed access
The European Union has made the most ambitious attempt to move past the ownership frame. The European Health Data Space regulation, Regulation (EU) 2025/327, was published in March 2025 and entered into force on 26 March. It does two main things. It gives people stronger rights over their own electronic health data, including access and the ability to add information to their records. And it creates a system for secondary use, by researchers, companies and policy-makers, through health data access bodies in each member state that decide on applications.
The logic is not ownership. It is governed access. Data is used for defined, permitted purposes, through approved secure environments, with decisions made by public bodies and published. The regulation even allows data holders to be compensated for making data available for secondary use, which acknowledges that preparing data costs money without turning it into a commodity.
Whether it works will depend on implementation, which runs for years. Member states have to build access bodies with real expertise, standardise records that are currently stored in incompatible formats, and resist the temptation to wave through applications from well-connected organisations. A regulation can set up a sound structure. It cannot, by itself, make that structure trusted. But the design choice matters. It treats the core question as “under what conditions may this data be used, by whom, and who decides?” rather than “whose is it?”
A scenario: the diabetes study
Imagine a university research team that wants to study whether a new diabetes drug is associated with fewer heart attacks in routine practice. It needs records for hundreds of thousands of patients.
Under an ownership model, it would in principle need permission from each patient, or from whoever claims to own the records. That is impractical at scale and produces biased samples, because people who respond to consent requests differ from those who do not.
Under a governed-access model, the team applies to a public data access body. It explains its question, methods and safeguards. The body checks that the purpose is legitimate, that the data requested is the minimum needed, and that analysis will happen in a secure environment where the researchers can see results but cannot take individual records away. The decision and the purpose are published. Patients who have opted out of secondary use are excluded.
Now change one detail: the applicant is not a university but a pharmaceutical company, perhaps the drug’s manufacturer. Should the answer change? Many people would say the company should be allowed access for genuine research, under the same conditions, but should pay, and should not be able to use the data for marketing. A governed-access model can express those distinctions. An ownership model cannot.
The strongest counterargument
The best argument for a stronger patient ownership or consent model is about power. Governed access puts decisions in the hands of institutions, and institutions can be captured. Data access bodies may be under pressure from governments eager to attract investment, or from industries with lobbying power. Patients, in this view, need an individual right to say no, not just a public body deciding on their behalf.
This argument has real force. The history of care.data and its successors is, in part, a history of institutions assuming public support they did not have. Patients’ trust depends on being able to opt out, and on the opt-out being honoured.
But an individual veto on every use cannot be the main mechanism. Research using data from only those who actively consent is less representative, and the people most likely to be left out are often those whose health is worst. The more effective answer is to combine governed access with a meaningful right to opt out of secondary use, genuine transparency about every access decision, and strong limits on commercial uses such as marketing and insurance pricing. Patient voice should be built into the governance bodies themselves, not only exercised through individual opt-outs.
The commercial question underneath
Much of the public anxiety about health data is not about research at all. It is about who profits.
Public health systems generate data at enormous public expense. When private companies use that data to develop products, some people see a fair collaboration and others see a transfer of public value into private hands. The Federated Data Platform controversy was partly about privacy, but also about a large contract going to a company with a controversial reputation, and about whether the NHS would retain control of its own data infrastructure.
Governments rarely address this head on. They should. If commercial use of health data creates value, the public should share in it, through fees, royalties, access agreements or reinvestment in the health system. Making the terms explicit is far better for trust than leaving people to suspect the worst.
Second-order effects
How a country answers these questions shapes its health system in ways that go beyond privacy.
Trust failures are expensive and persistent. Each abandoned programme in England made the next one harder, because people who opted out during one controversy tend to stay opted out. Opt-outs are not evenly spread across the population, so data sets become less representative over time. A governance failure today degrades the evidence base for years.
Data governance also shapes which firms can compete. When access depends on large, bespoke contracts, only the biggest vendors can bid, and the health system can become dependent on one supplier’s infrastructure. When access runs through public data bodies and standard secure environments, smaller firms, universities and public agencies can all use the same data on the same terms. Governance is, in effect, a form of competition policy.
And data governance shapes the workforce. Health systems that want to use their own data need analysts, data engineers and information governance specialists. If those skills sit only with vendors, the public system cannot even judge whether it is getting good value, let alone do the analysis itself.
What this means for each actor
- For health ministries: stop framing data policy around ownership. Legislate for governed access with independent bodies, published decisions and a clear opt-out for secondary use.
- For hospital leaders: as data holders, you will be asked to share more. Invest in data quality and security, and insist that access decisions are made transparently, not through side deals.
- For funders and development partners: when supporting digital health in lower-income countries, fund national capacity to govern data, not just the platforms that collect it. Infrastructure without governance creates dependency.
- For clinicians: patients will ask you about data use. Being able to explain, simply, who can access their records and for what purpose is part of maintaining trust.
What to watch next
Watch how EU member states set up their health data access bodies under the new regulation, and how transparent their decisions are. Watch whether England’s data platforms win public confidence or face renewed opt-out waves. And watch how countries building national digital health systems handle the question of where data is stored and who controls access to it.
The debate over who owns patient data will not be settled, because the question is poorly posed. The questions that can be settled are practical: who decides, under what rules, who benefits, and whether the public can see what is being done in its name.
In your health system, who actually decides whether patient data can be used for research, and would most patients know?
