The document summarizes the results of a survey of Europeans regarding their perceptions and behaviors related to personal health information. Key findings include: - Around 3/4 of Europeans view medical records and health information as personal data. - A small percentage (5%) disclose such information on social networks and websites. - Respondents can be characterized as "Self-revealing", "Indifferent", or "Cautious" based on their views and sharing behaviors. - Self-revealing individuals disclose information despite risks but see benefits, while Cautious individuals are more protective of privacy. - Trust in institutions influences concerns about data use and privacy protections.

1. The views expressed in this presentation are those of the author and do not (necessarily) reflect the position of the European Commission. Neither the Commission nor any person acting on behalf of the Commission can be hold responsible for the use which is made of this presentation Francisco Lupiáñez-Villanueva, Wainer Lusoli, Margherita Bacigalupo, Ioannis Maghiros, Norberto Andrade, Cristiano Codagnone Information Society Unit - European Commission, Institute for Prospective Technological Studies (IPTS), Seville, Spain Health-related Information as Personal Data in Europe: Results from a Representative Survey in EU-27 Medicine 2.0'11 (Stanford University, USA)

2. Institute for Prospective Technological Studies Francisco Lupiáñez-Villanueva, PhD http://www.ictconsequences.net Information Society Unit European Commission, JRC Institute for Prospective Technological Studies (IPTS) Edificio Expo - Calle Inca Garcilaso, s/n E-41092 Seville - Spain http://ipts.jrc.ec.europa.eu [email_address] Phone +34 954 488 206 (direct) Fax +34 954 488 208 IPTS : Part of Joint Research Centre (JRC) of the EC: 7 Research Institutes across EU As a service of the European Commission, the mission is to provide customer-driven scientific and technical support for the conception, development, implementation and monitoring of EU policies. JRC functions as a reference centre of science and technology for the Union. It serves the common interest of the Member States, while being independent of special interests, whether private or national.

4. Legal background Data Protection Directive (95/46/EC) general EU law in the field of protection of personal data and the most prominent legislative act regulating the processing of medical data Recommendation R(97)5 Protection of Medical Data (Feb. 13, 1997) explicitly defines the expression “medical data” and the expression “genetic data” Directive on Patients’ Rights in Cross-Border Healthcare : on the application of patients’ rights in cross-border healthcare. Digital Agenda for Europe: strategy for a flourishing digital economy 2020 Key Action 13: secure online access to their medical health data widespread deployment of telemedicine Key Action 14: minimum common set of patient data for interoperability of patient

7. Medical information socio-demographics traits Female (75%) Middle-age 25-39 and 40-54 (75%, 76%), Higher level of formal educatio n (81%), Manager (83%) or other white collar (78%), Affluent (almost never / never difficulties to pay bills (76%) Internet users (78%) are more likely to consider medical information to be personal These results point to a significant disparity in the perception on one’s own health, as people from poorer backgrounds may be less protective of their medical data privacy than wealthier Europeans.

8. Medical information as personal – Country profile A large majority of European interviewees see medical information as personal. But respondents located in the north and west of the European Union (77% - 100%) are most likely to regard medical information as personal.

11. Management of personal data by other parties, trust and concern Medical information as personal data

13. About a third of all Europeans use SNS and/or websites to share pictures, videos.. Over half of all internet users (52%) use a social networking site and more than four in ten (44%) use websites to share pictures, videos, movies , etc. Socio-demographic characteristics that influence social networking and sharing sites are age, education, occupation, financial situation, household composition and frequency of Internet use.  DIGITAL DIVIDES - younger age cohorts (15-24 and 25-39) are more likely than the older age cohorts (40-55 and 55+) to undertake both activities. - Internet users with higher educated are more likely to engage in these activities - Interviewees who use the Internet every day undertake both activities more often than average Medical information & Web 2.0

14. The respondents who use SNS and sharing sites were then asked which types of personal information they disclosed in these environments . Medical information disclosure & Social Computing

15. Perception & Behaviours Medical information as personal PERCEPTION YES NO Medical information disclosure BEHAVIOUR YES NO Self-revealing 5% Only 5% disclose medical information on SNS and sharing sites 3% of Internet users disclosed medical information in the context of eCommerce

16. Characterisation medical information perception and behaviours Self- revealing users are more likely to be older; to have ended education at the age of 16-19; to live in a house with three persons; not to have difficulties to pay their bills; and be heavy Internet users at home. Cautious users are slightly more likely to be female; to be 15-24 or 55+; to be students or manual workers; to end education at the age of 16-19 or 20; to live in a house with 4+ (34%); not to have difficulties to pay their bills; and to be heavy Internet users at home and at work. Indifferent users are slightly more likely to be male; to be 15-24; to be student; end education at 20+; not to have difficulties to pay their bills; and to be heavy Internet users at home and at work.

17. User generating & seeking health information The absence of patterns indicates the lack of network effect in the number of users generating medical information content and the number of users seeking health information on the Internet Cautious – 73% Indifferent – 22% Self-revealing – 5%

20. Informed consent & responsibility Self-revealing users are more likely to consider that SNS sufficiently inform their users about the possible consequences of disclosing personal information (65% vs 47% cautious and 61% indifferent). Attribution of responsibility appears stable regardless of disclosure and perception of medical information

21. Trust National public authorities and European institutions are considered as the most trusted institutions by Self-revealing individuals. Even though the level of trust is lower, self-revealing individuals are more likely to trust shops and department stores (55%) and Phone companies (49%) and Internet companies (45%) than cautious and indifferent .

22. Approval and concern regarding re-use of personal data Self-revealing users are: less likely to consider that specific approval is required before personal information is collected and processed . more likely to be concerned about the re-use of personal data for different purposes (75% self-revealing – 70% cautious – 66% indifferent). BUT, in the context of personal information asked on the Internet these individuals are more likely to require specific approval.

23. Control, data deletion & portability Perception of control does not vary significantly whether user disclosed or not medical information. Indifferent individuals are slightly more likely to feel they have control over the information than cautious users. Data deletion, self-revealing individuals are more likely to want to have the possibility to delete personal data when they change Internet provider (23% self-revealing vs. 11% indifferent) Data portability , self-revealing individuals are more likely to consider it important (84% vs. 75% cautious individuals & indifferent individuals (80%)

24. Control: deletion of personal data and portability Medical information & Social Computing

26. Genetic data Seven out of ten Europeans stated that special protection is needed in the case of genetic data. However, self-revealing individuals are less likely to consider that this special protection is needed definitely (55%) than cautious (75%) and indifferent (60%) individuals. In essence this is evidence that self-revealing individuals are not likely to be revealing genetic information while sharing information over Social networks.

30. Thank you very much for your attention @flupianez http://www.ictconsequences.net Francisco Lupiáñez-Villanueva, PhD http://www.ictconsequences.net Information Society Unit European Commission, JRC Institute for Prospective Technological Studies (IPTS) Edificio Expo - Calle Inca Garcilaso, s/n E-41092 Seville - Spain http://ipts.jrc.ec.europa.eu [email_address]