Safeguarding privacy and efficacy in e-mental health: policy options in the EU and Australia

Abstract

Inadequate data protection and privacy practices, along with a lack of demonstrated efficacy, are hindering the beneficial implementation of digital technologies in mental healthcare and the sustainable growth of an e-mental health industry. As the European Union (EU) develops policy actions for a comprehensive mental health strategy, it is crucial to incorporate a strong framework for e-mental health addressing these concerns from the onset. Australia is a frontrunner in e-mental health, its regulatory initiatives can inform the debate due to its more advanced state. While the EU adheres to a strict distinction between medical devices and consumer health/well-being products, Australia adapts the medical devices legislation to e-mental health tools by introducing a ‘conditioned exemption’. Concerning matters of privacy and data protection, however, the EU has suitable legal instruments sui generis (eg a GDPR-code of conduct and/or a GDPR certification scheme)—they just need effective implementation. Digital technologies have made a significant impact on the mental health sector, and they are likely to continue doing so. Despite the increasing demand for e-mental health solutions, there are concerns regarding poor privacy and data protection practices, as well as a lack of evidence to support their effectiveness. Both are considered impediments to fully reaping the benefits of digital technologies in mental health. European Union (EU) policymakers are currently developing actions for a comprehensive mental health strategy. It would be prudent to incorporate a robust regulatory framework for e-mental health from the outset in order to encourage a sustainable European industry for e-mental health. Partially, this framework can take recourse to existing legal instruments available under current EU data protection law, while also taking inspiration from recent regulatory efforts in Australia. The focus of this article is on the grey zone between classified medical devices and simple consumer health products. Whereas the EU adheres to a strict distinction between these two categories, Australia adapts the regulations for medical devices to the needs and specificities of e-mental health tools by assigning them their own niche within the medical devices systematics under a ‘conditioned exemption’. With regard to devices beyond the scope of the medical devices legislation, Australia is implementing a coordinated regime of complementary regulation of sectoral standards combined with an accreditation scheme. To a certain extent and its data protection-related aspects, this coordinated regime shows conceptual similarities with co-regulatory instruments under EU data protection law, such as a sector-specific data protection code of conduct and a data protection certificate. Digital technologies have reached the mental health sector, and they have come to stay. A general trend for digitalization in all spheres of being as well as specific advancements in emerging mental technologies, such as emotion technology and neurotechnology, have aligned and are driving what can be called a technological revolution in mental health. The COVID19-pandemic, too, has contributed its part. A noteworthy increase in demand collided with a sector that has been suffering from undersupply already before the beginning of the pandemic; the sudden disruption of (so-far) common forms of service due to lockdowns even exacerbated the situation.1 In addition, the media coverage has supported a growing overall awareness about mental health and a boost in e-mental health tools. E-mental health tools have become a serious market segment. Some predict the global e-mental health market to reach USD by with for the market The sector is and has consumer health and products. are mental health and concerns privacy and data protection, such as that be by for by that it be with to a to the effective of digital technologies in mental The data protection, and even the concerns digital technologies for mental with the to a of the currently in the are in mental health that the awareness about is increasing are to about the to an they concerns regarding data protection in the by about the protection, and privacy are crucial for a sustainable and growth of the A the in e-mental health that there is for In has more to in and the and that of all to be for and In the privacy and of of the mental health The of to data to even that health and are and that with such as about these with and and privacy and about poor in the e-mental health sector have been for from to the and The is a of in a a of data privacy in the of e-mental health to be of even to in digital health. The data by e-mental health tools are as being and about their about of about their and their for a about their mental in order to it from of while they between a and a to this of the data it that the mental health a service for with and data for there a The to of service that the of data for the data in and the that the data with a and the data can be fully and can what they are and service that even in the the of the data been of the that this be for can it in a that it it they are in a a of can have an impact on the and in need to even come in a mental to of privacy in in a they are already and for is an that even in a take A on the general and with privacy and by the that of the privacy they are to the of them and of the of the them the the privacy of what they are and a a in the the data with its The concerns and of the and digital it to the that data is being to specific be with a a just The that the to the that to data with even the data is and of The mental The of by mental health is for a and their it be a data can their and their for the of their a in a mental health about and have their the them and have been of the in the media the of of the about mental health to be a about about of the and of of that of well on the it for to as an that in the to the policymakers in the EU have on mental health, likely in to the for health and the before the of the that mental in the EU is in of the a mental health with a by a more common in and It is to that these have the In to the in of and about the have and for of in and are the of in the European called for an on mental health, with being to the and of mental EU policy initiatives addressing mental health are the on the of in European initiatives by the on to the of mental health and to them the called for by the to an EU on mental health that would a In the European its to mental health and a In the European a on mental health in the digital of In in of the Union a on mental health for In order to from and the European has a for evidence on a comprehensive to mental health in In the a on a comprehensive to mental health and to to the mental health The to a comprehensive mental health is and the initiatives with by the has and and for mental health as for such a European mental health e-mental health as of its Digital tools they and and they have the for and The would be to the benefits of e-mental health for a comprehensive mental health strategy. In the for evidence that it to to and as well as to such as and the of digital The the of global and for a in mental As the European mental health is being it is crucial to incorporate a robust framework for e-mental health from the the in the in privacy and data protection as well as about a in such a While the EU is in the of developing a general comprehensive for mental health, such as Australia and are already taking a more and are suitable regulatory for the sector of e-mental Australia has been the to an of specific regulatory instruments for e-mental health The focus on the regulation of e-mental health tools to a of and policy In the of have the and In order to and service the in with and the that and for digital mental health to to and to of and support for with and mental and to for the of digital mental health and health in the that a Digital be with these the has to digital mental health (eg that an to support their To the and of all the the of a and The of the legal framework for e-mental health tools in the EU inspiration from of the regulatory A beyond European legislation can inform the debate on policy to regulatory A framework for e-mental health needs to data protection and privacy practices, and an to and In the these are data protection and The to as the general legislation for the protection of and the to as is the for medical While the GDPR is a legislation and to all of the sector, industry in the data is being the is a sectoral and to classified medical The a framework of and to a the of to a that to the specific medical sector The that all medical devices have to as of the general and the scope of the The the for on the available on the market service of medical medical devices as by the to be in for for more of the specific medical The medical such as of and the common and of e-mental health tools. that have an medical are beyond the scope of the that for and is a medical of the under the to that have a With regard to mental tools for the consumer health market are to by the to as The is the for in the EU and as a The to all consumer there are specific to its as a general a sectoral the sector-specific such for of be in sectoral The an can be as a medical with the by the The of a is in as for a is to the data by the on the in the for in and as by the in the the to made by the The the medical devices with regard to the are however, they a and are to be are by with health and (eg industry health and European that be that the as by the of the is for the and of and by of the it be It is the and the of a a on an medical and the of medical the on the of with the of digital the implementation of the has to the digital devices specific regulations the In the of specific digital devices classified as The the for the with regard to and a more regulatory the of as to is to take with is classified as such have an impact that an of a of health, in it is in a serious of a of health in it is classified as to is classified as it is for of the of of is such that it in to the in it is classified as is classified as a e-mental health with an medical can be to be more As a e-mental health tools are likely classified under as is to take with The of from under the to in the has significant and The between and is for the the the the more the that be devices have and a scheme. In the for are a and the of a of the under are they are and they take a significant of to to the market of a medical by and of a The for for of e-mental health is to the strict under the and to the on the market as a simple consumer health health mental health be by they their for as to a medical is to It be it is such as with an to to a the the medical and/or medical such as is to the is in the grey the between mental health and and the of these in the can the of the The mental health as of mental that to with the of their well and and to their and as the of mental the EU being as of being with to and being these are to a of distinction for mental health of e-mental health devices to their tools as medical devices their is a it be to for a of e-mental health devices to be by the A certification under the that are to with a of the the needs of the it significant on in to advanced overall market and benefits The is the sector-specific legislation that for the of that the in the e-mental health sector, are more common with that and are to health With specific regard to and data protection, the that all the of and data in their to the by the the general and that be and in with the of the taking the of the and In addition, of medical devices have to and protection to the as to As for devices and devices to that they need to be and in order to as as that the from as GDPR the an on As it currently however, the of for in the the of an e-mental health as a medical for the of the in between a medical and a more general and to in e-mental health have a to European to the regulatory with regard to the regulation of e-mental health tools. to the European too, has medical devices of the to as to medical matters to the and of medical devices are and are in the to of of the a medical is by the under it is is to be to be for for the of more of the of this the devices that are by the in the In the is the similarities with the are the of the for an is to be is to be from the by the under the is is to be on in more of the the on the the for the to the the of of the are for the and of the The regulation on the in more the of a medical The is as for the of the it to be as the with the the for of the to the the of of the it is the by the that the of to devices under the health and that are of tools to a that the of a medical under are within the scope of the In an to the regulatory needs and specificities of Australia has with a of and an for specific of products. The in the consumer health for the as well as devices specific are the devices that have been from regulatory on the the that are to be from the of the consumer health products. digital mental health tools are as a of consumer health and products. The consumer health devices for consumer health and and digital mental health tools that by its to be by a consumer for the of an existing that is a serious serious and by its to be in in to a serious serious for the of a specific about the of a that is a serious serious a of and that by its to be by a consumer to general health by a such as and by its to be in for the of a about the of a serious a serious that by its to be by a consumer to general health by in to such as and by its to be in to to the consumer that would be to the of a health for the of a about the of a that is a digital mental health a on that are and in the in a that is by the digital mental health tools that the of medical devices are from to with the and the are and the to them is in the and the can the The are and have to be The are as that have been by health and/or health such as introducing as a Australia that and evidence for digital mental health tools be of the from the of the under the is in of that is that to be fully under the to the a to for from and would under regulation of the as as have been and are Australia an and to digital mental health tools under the existing regulatory framework for medical by them from what an of and The a to digital mental health tools within the systematics of the medical devices market and to to the European legal a of ‘conditioned for e-mental health tools from a significant of under the while the a of as and on a encourage to for their devices as medical it in more devices within the systematics of medical for and overall standards in the the two concerns with regard to e-mental health lack of evidence and the data protection a ‘conditioned under the medical devices legislation even of with a of data protection In the of for the ‘conditioned would be an to addressing data protection and The to in their ‘conditioned for digital mental health tools be in the European by a of with data protection for by implementing a co-regulatory under the GDPR (eg a sector-specific data protection code of conduct as in the In a it can even be that a of data protection under a is with the of the The is to the of the market as medical taking as a a of protection of health for and The of the market medical and the protection of health are the of the Inadequate data protection have been to the to fully the of digital technologies for mental to and health. The current encourage data to the can the health and of it can their in and have a impact on their it can even them from and their mental health an sector-specific co-regulatory to (eg an data protection would the of and the of the market as classified e-mental health to the EU has a robust data protection framework to the data is the data being is within the scope of the and all the and in the GDPR that the data in is for mental health the data the for data health, data to the mental health of a the of health about health The has the for a of the of health data in and of the devices are considered as medical the data the for data to GDPR and the of protection under the the sector of e-mental health is suffering from with data protection As demonstrated are privacy that are and they are with a common of data with policy that support with data protection be for the of e-mental health. The EU has been a more complementary of already such as as an the of for as a regulatory to between the of the strict of and between has become an of the for of a they and that are all for legal on In the EU data protection have a of ‘conditioned the implementation of a specific of legislation that has already been the legal the instruments to the and to the In addition, of a for and the The two co-regulatory instruments in the GDPR to a lack of are the data protection code of conduct and the data protection certification Both a complementary regulatory to increase with the of the Both to for the for accreditation as well as for the certification and to certification and and the Both can be on a regulatory Both be a policy to more in the e-mental health as a regulatory for with data protection regulations have a in the have been already in of the With regard to consumer health the European a for a of on privacy for in for the even in in to the health The of the data protection become already in the The to the and to a for the to the by of industry with the support and of the and as a the of on privacy for of the The of for data privacy by data and data on in the of data for data to for data data and data from the from the a under the in In the their and the a for have come to a the has to in the health to the to GDPR have been with the the GDPR to have been a to a general trend for certification as a legal in EU to and increase of the such as the the and the to this Whereas the is to be an of and of the and of the data protection are to are a and more to and GDPR In with also be more and more for a certain service to to that the data protection of the are they by and and with the on data protection, as well as of and In addition, for a and support the of data to by of they are considered of and in of The of data protection to and to the regulatory the to the of the of under the protection general standards by a and as an they legal and and from the are as a on an industry focus on a are for sectoral they are and Whereas a the sector, a significant of the the from in their specific sector, certification an on the of and in with data protection are to data the GDPR is in that certification are the data their is to to the of data protection of and protection and to consumer A sector-specific data protection certification for mental health would for and mental health in a market is are an already in the consumer it be for products, the and they a certain of to the that with an can market for the data protection become a for that with a of data protection from their In the of e-mental health, and in the are A data protection certification even a A data protection certification for e-mental health tools the benefits for the a of the market protection certification to In by a is of the of the certification to the of mental health for data protection to be an the current It would be a of protection for in a for its as a for a ‘conditioned certification well as on a strict under of the have to be are for a of and can be the of the be this would be of to the is being To this data protection certification to GDPR have fully their within the European data protection a lack of awareness of such certification a lack of and a lack of about that for a certification be A by the European that considered market and about the legal the to be and the European on of accreditation for accreditation of In the is a of the EU is on a data regulation on and in

Cite this work

No public copy is stored for this record, so only the metadata is cited.

Stored only when both papers are in the corpus — 15 citations exist upstream.

Papers that cite the same references — the relational fallback while embeddings are still backfilling.