LIBERUM releases templates to block EU health data sharing

LIBERUM distributes templates to deny health data transfers

A citizen prints a document, signs it, submits it at their regional health registry, and demands a stamped copy with the entry date. This gesture, multiplied by thousands, is what the association LIBERUM aims for. On August 29, 2023, they released a statement with PDF and Word document models so anyone can preemptively refuse consent to transfer their health data to European Union countries.

The approach is blunt. The association argues that Brussels intends to access all citizens' health data and that the Government of Spain has created an agency to manage and share them with other member states, equating this directly with digital identity. According to their account, the process will start in four autonomous communities before extending to the rest.

What exactly does the statement request?

The text encourages denying consent for any administration—central or regional—to "transfer, sell, or use whatever methods occur to them" to hand over health data to foreign countries without explicit permission. The underlying thesis is that there will be no prior notice: logically, express consent should be requested, but they argue it will happen by default and without informing anyone.

Hence the urgency. Those who do not submit their refusal in advance are warned that their data will flow to other European partners without being asked. The stated goal is cumulative effect: thousands of identical submissions would force a rethink of the procedure.

Where to file the document

The association details the channels. The first is Redsara, the common electronic registry of the Administration. The second is the relevant regional registry, addressed to the Ministry of Health and each community's health department. Those preferring paper have two options: deliver it in person at their health area registry or town hall, or send it via burofax (certified mail). In all cases, one point is emphasized: demand a copy with the entry stamp.

The thread recommends calling the health department beforehand to ask which specific registry to use. It also notes that a known individual filed their document a year before the statement was published, suggesting the procedure has been circulating through closed channels for some time.

Can health data be transferred without patient consent?

This is where the narrative splits. Against the theory of default transfer, part of the legal analysis recalls that data protection regulations act as a barrier: only the individual can transfer their personal data, and no administration can pass them to a third party without consent. The LOPD (Spanish Data Protection Law) is cited as an insurmountable obstacle.

On the opposite side, others counter that legal safeguards have stopped nothing in recent years. These procedures are formalized with fine print when renewing the DNI (national ID card) or signing any transaction, and most people sign without reading. The comparison drawn is medical consent: in Spain, organs from a deceased person can be donated if they did not leave prior record against it, an example that silence favors transfer.

The legal route beyond the template

The path proposed from a legal perspective is different and more structured. First, exercise the right to oppose the transfer of health data to foreign countries or entities. If there is no response or it is unsatisfactory within one month, the next step is filing a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) via its electronic registry. This is the regulated path, slower than burofax, but with administrative backing.

The discussion also drifted toward the regulatory framework mentioned in the exchange. Several messages try to locate the European regulation on the health data space, landing instead on Regulation (EU) 2023/607 of March 15, 2023, which actually modifies rules on medical devices and in vitro diagnostics due to the pandemic's impact. The confusion reveals how easy it is to mix up the medical device regulation with the one governing clinical data exchange.

Underlying skepticism

Not everyone buys into the framework. One current argues that data has already been transferred for decades, in every unchecked box, and that the template arrives late: the charade ended long ago. Another goes further, labeling the initiative a distraction, arguing that the real solution is not an administrative letter but accepting that one must operate outside the system.

Others raise a different risk: that signing the refusal could end up generating lists of dissidents. And some recall that, in practice, the European Health Insurance Card does not always work as promised, with transfers between regions already causing friction at service counters.