The politics of constructing health data spaces: Border work and the stickiness of fragmentation

Abstract

This article explores the construction of health data spaces through the lens of border work. It provides insights into the complex attachments and detachments that come to the fore when establishing centralized health data access bodies in the Nordic countries. By comparing Denmark, Norway, and Finland, the study unveils a variety of border work practices. These practices include the complex interplay between national infrastructures, local practices, and regulatory frameworks, the management of continuous attachments through additional loops, and negotiations over public-private borders. The study shows that, despite policy goals envisioning health data access bodies as seamless one-stop shops for ‘detached’ data, the data remains attached to places, institutions, people, and countries. Consequently, new data spaces tend to emerge and co-exist with existing ones. Our analysis of the Nordic experiences offers valuable lessons and critical insights for ongoing efforts to build a European Health Data Space. We further suggest that this stickiness of fragmentation might be a common feature of big data policy efforts.

Introduction

This article responds to a recent call to study health data policies through the theoretical lens of space (Hoeyer et al., 2024). We engage with this call by focusing on the border work in the creation of health data spaces, highlighting how the construction of space hinges on discourses and practices that establish and maintain borders as well as organize border crossings. When the European Union proposes “to facilitate new ways of making health data available across domains, national borders, and purposes” (Hoeyer et al., 2024: 1), via a European Health Data Space (EHDS), we suggest that it is mainly engaging in border work. We suggest that focusing on border work brings into view the politics, work and impact surrounding the construction of health data spaces.

An important dimension of building an EHDS is enabling easier access for secondary use of health data by creating health data access bodies in all member states. These are imagined as national one-stop shops because those who wish to re-use health data will need to apply for a permit from this one instance instead of contacting health registries separately. One key policy vision underlying one-stop shops has been that of “seamlessness” (Askim et al., 2011), which refers to the ability to navigate effortlessly various public services. Over time, one-stop shops have become intrinsically linked to digital government (Knox and Janenova, 2019) and seamlessness is often an explicit goal when creating digital infrastructures, based on the idea that the collection and exchange of data across various infrastructures should occur effortlessly (Wadmann and Hoeyer, 2018), for example by means of standards, metadata, or interoperable file formats. The EHDS takes this idea of seamlessly exchanging data a step further; it aims at making data accessible through secure computing environments from which actors can extract only results or anonymous data.

Since the Nordic countries have come far in developing national health data access bodies, our aim is to explore what it takes for such bodies to work toward the goal of establishing data spaces. The Nordic experiences may have important lessons and critical insights for other countries’ EHDS efforts. In general, the Nordic welfare states’ data collections are outstanding for their wealth of health and social welfare data, including hundreds of public registers (Tupasela et al., 2020; Bauer, 2014; Cool, 2016), the use of unique personal identification numbers (PIN) (Alastalo and Helén, 2022; Svendsen and Navne, 2023; Cakici, 2024), and their citizens’ exceptionally high levels of trust in the states’ data collecting practices (Snell and Tarkkala, 2019; Cool, 2016; Hiilamo, 2021; Holm and Ploug, 2017). Many of the Nordic states’ data collections are also used as research infrastructures; that is, data are used for secondary purposes. Until recently, individual requests to access such data needed the approval of the respective sites and authorities before data could be compiled from various sources. This article focuses on recent developments in Denmark, Norway, and Finland that aim at making health and social welfare data easier to access and more readily available for secondary use.

In the following, we look at what these countries’ key policy visions are for one-stop shops with respect to health data, particularly in relation to access regarding secondary use of health data. We investigate the plans for a Danish health data and analytics platform, the Norwegian health data program, and the Finnish Social and Health Data Permit Authority, Findata.

In Denmark, the vision behind the Danish health data and analytic platform is to become an international leader in the use of health data by enabling advanced data analyses across data sources, ensuring a high level of data security and transparency about data use (see “A vision for better use of health data,” 2021). The main rationale for centralizing access to health data is to facilitate quick access for research purposes. Besides registries, the Danish data landscape consists of major data infrastructures, such as Statistic Denmark and the Danish National Genome Center, which gather data from various sources and provide secure-computing environments. Despite these existing infrastructures, the government envisions a federated health data platform to overcome such challenges as a lack of oversight of data sources, administratively burdensome approval processes, difficulties in linking data across datasets, unclear responsibilities among authorities, and insufficient analytical capacity. A better integrated health data space should also allow the Danish life science industry and national universities to become leaders in the development of novel medicines and treatments, which should result in improved healthcare and economic growth.

In Norway, the primary aim of the Health Data Program (HDP), which ran from 2017 to 2021, was to make it easier to obtain health data for medical and healthcare research (Åm et al., 2021). By centralizing decision-making authority for accessing health data, the HDP also aimed at harmonizing interpretations of regulations and at centralizing responsibility (and accountability). The HDP attempted to establish an “ecosystem for health and data analytics” (Direktorat for e-helse, 2018), including both a one-stop-shop in the form of a central health data access body–the Health Data Service (HDS)—and a health analytics platform (HAP). The platform should have provided a secure computing environment, reducing the number of disclosures of personal data. As we will explain below, the plans for the HAP were halted in November 2021, three months before it should have been up and running and after the government had invested almost 50 million euros in it. Still, as of March 2023 the HDS–a national health data access body for the secondary use of health data–has taken over decision-making authority and the processing of applications for eleven statutory registries.

In Finland, the one-stop shop concept was initiated by establishing the Finnish Social and Health Data Permit Authority, Findata, after an initial pilot project and increased political interest in the field of health data during the previous decade (Tupasela et al., 2020; Helén et al., 2024; Aula, 2019). Findata operates as a national permit authority for the secondary use of social welfare and health data, and it began operating at the beginning of 2020. It was founded in connection with specific legislation enabling secondary uses of health and social welfare data in 2019 (Act on the Secondary Use of Health and Social Data, 552/2019). The purpose of Findata is to streamline the permit process when seeking data from more than one data controller. According to the original tasks set out for Findata, the purpose was to reduce the amount of overlapping permit processing, increase the speed of granting permits, make the use of register data easier and more efficient, improve information management by data controllers, and align existing Finnish data practices with the General Data Protection Regulation (GDPR) (Sosiaali- ja terveysministeriö, 2019).

The policy efforts in the three Nordic countries share a common vision where users need to go to only one stop–a health data access body–and where data flow effortlessly between different points. All three countries seek to ensure easier, faster, and more efficient access to health data. Importantly, centralized health data access bodies should harmonize regulatory practices and eliminate overlapping organizational structures. Authorities want to allow dynamic data access and sharing, as well as increase the availability of data for multiple purposes. Finally, secure computing platforms should increase privacy and thus comply with the GDPR. Finland is furthest along in the process of centralizing access to health and welfare data with Findata. In Norway, the HDP led to the establishment of a centralized, administrative one-stop shop, the HDS. Denmark is still in a policymaking phase, and its plans resemble Norwegian policy efforts. How do centralized health data access bodies live up to these expectations, and what tensions emerge when constructing health data spaces?

In the next section, we briefly outline conceptualizations of space, in which we highlight border work to understand how data spaces are constructed and maintained in a datafied society. We then use this analytical approach to study policies regarding health data space in the Nordic countries. Our analysis shows that the exchange of data through new health data bodies is anything but effortless. Building new data spaces and centralizing access to data is accompanied by a complex dynamic of attachments and detachments at the organizational and policy levels. We have not observed the tearing down of borders among existing data infrastructures, as ideas of seamlessness seem to suggest. Instead of a “borderless” data space, access bodies to data spaces can just as well enact borders and function as gatekeepers. Besides, there seems to be a constant overflow and mushrooming of data spaces next to existing ones. We suggest that this stickiness of fragmentation might be a general feature of big data policy efforts.

Border work as an analytical approach to studying data spaces

Recently, Hoeyer et al. (2024: 2) have called for an examination of the term “space” in relation to the EHDS to “reinvigorate it as a sociotechnical concept”. They highlight the material and abstract as well as the bounded and infinite character of spaces and suggest defining data spaces as

[c]onditions of being that are enacted when people, computers, and organizations use data for maneuvering hopes, opportunities, risks, and challenges–or think that others might be doing so. (2024: 3)

Their definition highlights the entanglement of physical lives and data lives. Building on their social scientific understanding of space, we will, in the following, suggest that the entanglement of physical and data lives can be expressed in dynamics of attachments and detachments that emerge when policy makers try to create, enable access to, or merge health data spaces. In a further step, we propose border work as a sensitizing concept to analyze these dynamics and the work associated with it, assuming that they are constitutive of the construction of spaces.

Policy actors might think of (data) spaces as abstract, detached from material forms and cultural interpretation, and therefore easy to centralize with respect to access. In this manner, the policy approach to space resembles Gieryn's (2000: 465) definition that “[s]pace is what place becomes when the unique gathering of things, meanings, and values are sucked out.” However, in practice, challenges may emerge because of the entangled places that constitute data collections, comprising an array of “people, objects, practices, and representations” (Gieryn, 2000: 465). Previous research on data work shows that it is not at all easy to “suck out” the relational aspects of data work. Researchers (Pinel et al., 2020; Metzler et al., 2023), social and health care professionals (Navne and Svendsen, 2022; Choroszewicz, 2022), and patients (Skovgaard and Svendsen, 2023) build and invest in relations to data and to other data workers, and those relations are constitutive of data. It might not even be possible or beneficial to suck out the relations because they are crucial for mobilizing the flow of data, as, for example, Metzler et al. (2023) have shown for biobanks. “Movement,” Pinel and Svendsen (2021: 2) argue, “comes with attachments to places and people. That is, even when data flow towards new fields, they are materially connected to specific places, groups and individuals who helped create them or previously used them.”

Therefore, the dynamics of attachments and detachments (Pinel and Svendsen, 2021; Skovgaard and Svendsen, 2023) need close attention when investigating the building of health data spaces. Policy actors imagine data spaces as contexts in which repurposed data can flow. However, it requires work to detach data from their original contexts, for example to detach data from the state (Cool, 2016), and data acquire new attachments in repurposing efforts (Skovgaard and Svendsen, 2023). Thus, repurposing practices raise important questions about the sorts of relationships they shape (Pinel and Svendsen, 2021).

While previous research (Pinel et al., 2020; Choroszewicz, 2022; Metzler et al., 2023; Pinel and Svendsen, 2021) mostly focuses on “attached actors” (Skovgaard and Svendsen, 2023) at a microscale (addressing the close relations and daily work of researchers, patients, data workers, or clinicians), the organizational and policy scale has received less attention concerning the relations that constitute data work. We expect that questions of power and controversies over control of access to data are more pronounced at this scale. Since Callon and Latour's (1981) work on baboon society, we know that objects can act as important signifiers in stabilizing communities and power relations. Therefore, centralizing data may bring about tensions when actors who have strong ownership ties and interests vested in the data increasingly let go of or share data control and access.

To analyze the politics of attachment and detachment at the policy and organizational levels, we suggest that “border work” is a useful sensitizing concept. Our use of the concept is inspired by poststructuralist analysis of identities and communities (Laclau and Mouffe, 1985/2001; Yuval-Davis, 2011), as well as postcolonial scholarship on border work (Somerville and Perkins, 2003). We consider borders contingent and antagonistic products of the ongoing, discursive processes of demarcating and enacting spaces. The process of defining communities–who, for example, constitutes, belongs to, or gains access to data–involves drawing boundaries between those who are on the inside and those who are on the outside (Yuval-Davis, 2011). Thus, building centralized health data access bodies may trigger contestation, including counter-efforts at enacting and even strengthening borders. At the same time, border work is not only about constructing and maintaining spaces; it can also more positively denote efforts that enable contact, understanding, and collaboration at borders, where contact across communities, disciplines, or organizations occurs (Somerville and Perkins, 2003). Thus, we use “border work” to denote the organizational and policy work done in constructing, maintaining, and overcoming attachments when building (health data) spaces.

Previous research has documented that repurposing health data can create problems. When the number of “attached actors” (Skovgaard and Svendsen, 2023) increases, the purposes and contexts of data spaces become transformed and “misaligned actors” (Langhoff et al., 2018: 51) may emerge. Previous research has also found that publics tend to draw boundaries between commercial and public interest use, with acceptability attached to the latter (Tupasela and Snell, 2012; Vezyridis and Timmons, 2017: 6f). Arguing from a legal perspective, Jacobs and Popma (2019) note that keeping data in their original context is necessary to avoid friction. Centralizing efforts seem counterintuitive in this regard, and their effects demand critical attention. It is, for example, unclear how citizens’ acceptance of secondary uses of data can be sustained in the long run since the values attached to the Nordic welfare states and to the global data economy might not always be aligned (Snell et al., 2023; Reutter and Åm 2024).

Despite negative findings and warnings, the EHDS is proof that policy efforts for repurposing health data have gained momentum as never before. This makes our analysis of border work in constructing health data spaces a timely and necessary undertaking. We focus specifically on the dynamics of attachment and detachment when constructing health data spaces that policymakers need to be aware of.

Methodology

We examined Nordic countries’ policy efforts at centralizing health data access for secondary purposes by means of interviews and document analysis. Our analytical focus is on the key institutions envisioning and strategies for implementing the secondary use of health data. Our study evolved from a research network on the datafied welfare state in the Nordics. While we originally conducted three independent studies on different aspects of health data infrastructures, we identified commonalities across countries in one of our meetings. We eventually decided to follow up on this insight and designed a comparative cross-country study on the topic of this article. We outlined a thematic interview framework and criteria for selecting sites for empirical research, as well as criteria for selecting possible interviewees.

In Denmark, we followed the policy strategy named “A better use of health data,” (A vision–Strategic collaboration for a better use of health data, 2021) which emerged from the national life science strategy (The Danish life science strategy, 2021) and conducted a total of seven expert interviews. In Norway, we studied the Norwegian health data program and conducted eight expert interviews. A key document analyzed was the concept evaluation for a health analytics platform that thoroughly discussed the enactment of the HDP (Direktorat for e-helse, 2018). In Finland, we selected Findata as a concrete institutional actor to study and conducted a total of ten expert interviews. The Finnish analysis has been based on policy initiatives seeking to develop a fair data economy, such as the Sitra report on the fair data economy (Hendolin and Hämäläinen, 2022), and improve the utilization of social welfare and health data in R&D more efficiently, such as the law on the secondary use of social and healthcare data (Ministry of Social Affairs and Health, 2023; Bützow, 2021)

In all three countries, the interviewees were involved in the policymaking efforts at centralizing health data access, for example as governing board members for the health data programs, as public registry actors, or as managers for health data access bodies. In Finland and Norway, we also talked to several reviewers who process data access demands.

Following an interpretive approach, we paid attention to how interviewees and documents construct meaning. Thus, our aim was to identify the social understandings upon which improved health data access was envisioned by focusing on what the phenomenon means for the actors involved and on its shared and contested meanings in their social worlds (Yanow, 2007). In the interviews, we asked what informants experienced as rationales for initiatives designed to centralize health data, and for whom it was most important to obtain easier and quicker access to such data. We also asked about the actors involved in decision-making and any concerns and tensions that emerged in the process. Furthermore, we interrogated the regulations, public value, and practical experience underpinning how re-organization efforts are conducted. We analyzed the interviews thematically. The acronyms indicate the informant's country and the interview number.

We validated our findings in two internal workshops, where we compared our findings from the interviews and document analyses in the three countries. We identified common themes and issues, which we abductively (Timmermans and Tavory, 2014) highlighted for further analysis and discussion, such as the border work expressed in themes such as competition, pricing, or local competencies. The fact that we identified common themes underscores the methodological benefits of comparison. If we identified tensions and problems that emerge in implementing health data access bodies in only one country, then such findings could depend on the specific situation of that country. However, if similar tensions emerge on a broader level, then we can assume that others can learn from the Nordic countries’ experiences when implementing the EHDS. At the same time, it is interesting to note, as we demonstrate in more detail below, that even though the Nordic countries are rather similar, they also differ in terms of their approaches and practices. Thus, the EHDS's demands for regulatory and organizational changes will affect the EU member states differently, a relevant insight for further work with the EHDS.

Border work at play

In the following, we explore how border work plays out in constructing health data spaces in practice. We use border work as an analytical concept for studying the politics of attachment and detachment at play at the policy and organizational levels in the discourses and practices of constructing centralized health data access bodies. In reporting on our findings, we structure the presentation along three identified categories of border work: data border controls, border crossings, and negotiating public-private borders.

Golden eggs and barbed wire: Health data spaces with data border controls

As mentioned above, the use of secure computing environments has been central to visions for GDPR-compliant Nordic health data spaces, and the fact that data can be accessed and processed only in closed secure environments figures prominently in the policy plans for an EHDS ¹ . Secure computing environments are computing platforms which reduce the risks associated with working with high risk data, which includes personal and identifiable health and welfare data. These environments help to reduce the work and effort required of researchers to ensure that their work is compliant with regulations on working with sensitive data, such as the GDPR (EU), HIPAA (USA), and APPI (Japan). Access to such secure environments can be given through an access body that acts as a gatekeeper and a new type of data governance intermediary. Secure computing environments allow only for the exporting of analytical output, anonymous and aggregated data.

Findata is a good example of authorities enacting the health data access body role in such a manner. It is responsible for providing permits and access to data when it is sought from two or more of the 14 different data controllers in Finland (such as the Finnish Institute of Health and Welfare, Social Insurance Institution of Finland, Finnish Centre for Pensions, or public and private healthcare providers ² ). If data does not need to be combined from two or more controllers (e.g., only from one data controller) then that can be applied for directly from that controller. From a more technical and legal standpoint, one of the most important roles of Findata is to ensure that access to sensitive personal data meets the requirements set out in the GDPR. Before the establishment of Findata, researchers had to approach each data controller individually to secure a permit to use the registry data. When a permit was granted, the data that were requested were sent directly to the researcher, who would then, in turn, compile and combine the data that he or she had received from different data controllers on his or her own computer. The data would often also contain sensitive personal data. Therefore, when Findata was established, the process of accessing sensitive personal data required that they were entered into a secure computing environment.

While compliance with GDPR requirements has been one of the most significant achievements of Findata, the achievement is hampered by the challenges that it has posed for international collaboration, which is one of the main goals of Finnish health sector strategies and roadmaps (e.g., Tarkkala et al. 2019; Helén et al. 2024). The law on the secondary use of health and social data stipulates that all data that are delivered to Findata from data controllers must be deposited and analyzed in a secure computing environment. Although Findata provides such an environment, other Finnish institutional actors have also set up secure computing environments that can be used to analyze data. To be classified as a secure computing environment, an independent Finnish auditor must audit it regarding whether it meets the established requirements. Subsequently, no foreign organization has sought such auditing. The Finnish research community has noted that the Finnish interpretation of GDPR has been significantly more stringent than in other European countries, which has hampered Finnish research. As noted in a plea to the Finnish Parliament by several leading Finnish physicians,

It is also a question of harmonizing the national secondary law and European practices in the processing of personal health data. The purpose of the Data Protection Regulation has been to harmonize guarantees for data protection regulation in the EU area, and Finland with a national regulation that differs substantially from it excludes itself from the benefits of the data protection regulation and international research cooperation. (Vetoomus, 2021)

This somewhat unique feature of the Finnish data analysis landscape has resulted in challenges in enabling and facilitating international research collaboration (see Brück et al., 2024). In addition, an early report noted that the capacity of existing secure computing environments, such as that of Findata, did not meet the needs of some user groups, including users who needed large amounts of parallel GPU processing for making deep learning and neural network calculations (Pajula et al., 2021).

Thus, the legal requirements enabling the secondary use of social and health data have strengthened the national attachments of the data and effectively functions as a border control. In this manner, international collaborations have halted almost completely, and at the same time it has posed challenges for many users.

Likewise in Norway, the persistence of national borders has had a significant impact on the HDP, which attempted to establish an analytical platform that its advocates considered a “golden egg” (IN1):

The real golden egg of the Health Data Program was not to have one place for applications, but that there is one environment where you get access to all the data, like, you don't have to distribute what you have data on. If you can sit down in what we call HAP, with all the big data with all the important sources and no matter how many registries and variables you want to use, you have the data on the HAP. (IN1)

The platform should resolve the policy problem of ensuring privacy by providing a secure computing environment that reduces the amount of personal data disclosure. Yet, the Directorate for e-Health halted the plans for a HAP shortly before go-live (and after substantial public financial investments) because the HAP was using Microsoft Azure, and after the Schrems II verdict, there were legal uncertainties as to whether health data could be stored outside Europe. Thus, legal requirements maintained borders that the HAP should have overcome.

While the Finnish case shows how national attachments are strengthened and the Norwegian case points to legal challenges in detaching data from the national, the Danish case shows that the issue of border control in relation to health data spaces can also have an impact within the national level. Different Danish data infrastructures have established ways of working together and their guidelines for data use demand special setups. For example, data from the National Genome Center (NGC) are not allowed to leave the center's secure computing environment. So, when researchers want to combine data from the genome center with data from, for example, Statistics Denmark, which cannot be sent to NGC, a solution needs to be set up. At present, Statistics Denmark can set up projects on NGC's computing environment, including data under Statistics Denmark's control. But to combine these data with data outside Statistics Denmark's control, e.g., genome data from NGC, a supplementary model needs to be established, and hence a pilot has been set up. One informant said:

What already exists today … there is a little corner of the NGC, called Statistics Denmark. So … there … we kind of put barbed wire around there, and there inside, you can only carry out projects that we have control of. But data are lying there and is used … they use the computing capacity of the NGC. (ID2)

The informant used the strong metaphor of “barbed wire” to demarcate how secure computing environments establish strict borders enduring the attachment of data to a certain place, in this instance the NGC.

From the three Nordic cases, we can see that the establishment of centralized health data access bodies demonstrates the complex interplay between national infrastructures, local practices, and regulatory frameworks. The Finnish and Norwegian cases, in particular highlight the legal complexities that hinder international cross-border data sharing, whereas the Danish example emphasizes the flexibility required to integrate disparate datasets across separate national data infrastructures securely. Despite the privacy protections provided by these systems, they frequently result in more rigid and lengthy research processes. As a result, while organizations such as Findata represent significant progress toward centralization, they also highlight ongoing challenges, particularly in fostering international collaboration.

The border work of tackling continuous attachments

In this section, we examine the dynamics of attachments and detachments that emerge in the repurposing practices enabled by new health data spaces. Since only Finland and Norway have implemented new centralized health data access bodies, our analysis focuses on those sites. We bring out the work required in mobilizing data on an organizational level. We start by showing how the establishment of Findata has not eliminated the existing borders among different local data spaces and their data controllers but has instead highlighted the significance of them.

Findata: Extra loops

Shortly after Findata began its operations, researchers raised concerns about the secondary act legislation and Findata's insufficient resources to manage and expedite the large number of applications (see, for example, Pihlava, 2020; Myllärniemi, 2021; Reito et al., 2022; Wedenoja et al., 2022; Gesund Partners, 2022). Many applications were quite complex and required consulting with the various data controllers, as only they, who controlled the data, possessed the necessary information regarding the feasibility of providing certain types of data. This means that Findata must work continuously as an intermediary between those requesting data and those providing it, which created long waiting times for accessing data in the first years after the establishment of Findata. To address this issue, Findata started to ask researchers to contact each of the data controllers individually before submitting a request to Findata. This would ensure that all the data they were seeking was available.

Thus, despite the effort to unite existing data spaces into one, by establishing only one access point, prior attachments continue. With respect to the one-stop shop, an “extra loop” has been created because researchers must now be in touch with individual data controllers before applying to Findata. Both data users and the actual data controllers within local organizations, who answer inquiries and requests, invest work to make data flow. Thus, local knowledge of data remains central to Findata operations, and previous borders have not been erased–in a sense, they have even gained new visibility. We see attachments to concrete places and people figure prominently in efforts to mobilize data.

The eventual decrease in handling times for Findata can therefore be explained by the fact that researchers have to do the same amount of preparatory work that they did before the establishment of Findata. From the perspective of the researcher, the time it takes to prepare an application has not diminished; rather, the work has just been re-allocated to them. At the same time, the notion of a one-stop shop has become diluted since applicants must make many stops on their way to acquiring data.

Another challenge that data controllers have noted is that since Findata has instructed researchers to contact them directly for guidance, data controllers have no means of billing researchers for this preparatory work, since it is regarded only as an inquiry rather than a request for information from Findata. This means that data controllers must do preparatory work without financial compensation. As one representative from a hospital region put it:

So Findata wanted the preliminary requests to come to us before they submitted the actual data request. […] So, if the information request leads to an actual permit request, then we get a query from Findata regarding cost, and that is fine because our preliminary work benefits the application. But then some preliminary investigations may be extremely complex and time-consuming to sort out. We might have someone in clinical informatics working for hours to sort something out, but then we never get an actual request from Findata. So, there is a lot of work in the preliminary investigations that we cannot bill for. That is free work and eats up a lot of resources. (IF10)

The quoted passage both illustrates the often extremely complex and time-consuming border work included in making data flow and shows how this border work is not recognized and thus unpaid. This border work may also involve individuals other than researchers in the process of combining data sets. As one interviewee noted, with reference to working within Findata's secure computing environment,

it does limit somewhat that you have to work in a type of standardized work environment. For example, you only have specific software programs and specific versions for use. Then, for example, let's say you want to link statistical data on individuals from their local county to the data you are working on; now that does not work the same way it used to, where you could do multilevel analysis. You cannot do that in this new environment. In a way, someone else has to combine the data beforehand, so it does slow down the process. (IF4)

Overall, the borderless vision that has been a driving force behind Findata has raised a number of concerns and issues regarding whether the unification and integration of data spaces is possible. We find that continuous border work is necessary to make data flow between different data spaces, despite Findata's vision of establishing one integrated data space.

Norway: Work of overcoming tensions

In Norway, the health data program (HDP) described and evaluated different models for the health data landscape in 2018 (Directorate for e-health, 2018). Their evaluation ranged from the least effort to an all-inclusive model which they recommended from a cost-benefit perspective. Implementing the solution brought out tensions regarding border work in terms of both the technical border work and the border work of establishing contact across institutional actors.

According to our informants, a division of labor emerged after this evaluation, regarding the technical border work. While the Directorate for e-health and its consultants focused on establishing a HAP, the main health registry actors worked on a metadata catalog and on a joint application system. The health registries also tried to prepare for what delivering data to a HAP would require of them. The impression prevailed among registry actors that policymakers had a limited understanding of registries, their users, and health data. One register manager described how the HDP demanded that he deliver data to the HAP, while at the same time not specifying what type of data, how it should be structured, or how data updates would be organized. Thus, tensions emerged because those responsible for the data work felt that the Directorate for e-health silenced the border work required to mobilize data and lacked an understanding for how health data are attached to people, practices, and concrete places.

Regarding the border work of establishing contact across institutional actors, Norwegian informants pointed to internal tensions complicating the HAP. Interviewed registry actors criticized the Directorate for e-health's extensive use of consultants and money in the HDP project. At the same time, tensions concerning ownership and control of data emerged. Interviewees indicated that intra-institutional power conflicts may have been an underlying reason why the Health-Ministry initiated the HDP in the first place, to enforce more efficient collaboration among registry actors. Nevertheless, informants were eager to ensure that the atmosphere and collaboration had improved by the time of the interviews in spring 2023. Thus, “attached actors” had to invest heavily in border work to establish understanding and collaboration in the interdisciplinary contact zone created by the HDP.

Another issue during the creation of the HDS was that actors expressed concerns about a lack of competence when a national, centralized health data access body evaluates applications. Those who argued against centralizing decision-making authority pointed out that the registries themselves are the most competent to make decisions about the use of datasets with which they are familiar. For example, the Cancer registry stated the following in its hearing statement:

Very high professional competence is required when it comes to understanding the content of data, medical conditions, and assessment of applications in order to be able to take good measures to ensure that the conditions for making data available are given, including making decisions on data minimization. (Kreftregisteret, 2021)

The Ministry of Health and Care Services listened to such objections and resolved the issue in two ways. First, it obliged the HDS to seek advice from the registries. Thus, as in Finland, an additional loop was added to the process. For the registries, the added loop means that they cannot save on human resources since they still need to have all the required competencies in house. Second, several measures were taken to obtain the right competencies for the HDS. For example, HDS employees spent some time visiting and working at the main registries, and in fact some employees in the HDS have transitioned from positions in health registries. Thus, to be able to detach data from their original contexts, concrete employees had to be detached from their workplaces as well.

Finally, it is worth mentioning that responsibility for technical data delivery is still attached to the health registries, while the HDS evaluates applications from a legal standpoint. According to local data controllers, they are, however, not talking directly to the applicants anymore, which previously was normal procedure. This detachment may have negative consequences for all involved. Furthermore, experienced registry actors point to the fact that the difference between data production and data use is not as clear-cut as the new legislation foresees. For example, a registry may contain scanned images, and to use those images, somebody must manually code and control them. When researchers want access to such data, they visit the registry and, by accessing and working with the data, they also improved the data. The interviewees worried that in the future they would no longer enjoy such direct returns because of registries being detached from researchers, with the HDS then serving as an intermediary between them. Danish interviewees expressed the same concern.

Thus, we see that the centralization of health data access bodies, as exemplified by Findata in Finland and the HAP in Norway, has not fully realized the desired seamless flow of health data through ‘one-stop shops’. Instead, new levels of complexity have emerged as researchers must continue to navigate institutional boundaries and interact with local data controllers. The formation of these new "extra loops" demonstrates the ongoing importance of local expertise as well as the border work required for accessing and using data. In both countries, centralization of health data access increased the visibility of institutional borders, while at the same time making border work invisible. The continued need for local knowledge underlines the stickiness of established structures and practices, necessitating border work to enable data flows and data use.

Negotiating public-private borders

Finally, negotiations about public-private borders figure prominently in all three cases. These borders are invigorated particularly when it comes to costs and prices as well as time and human resources.

A mutual concern among many actors in all three countries has to do with the resources needed to introduce a centralized health data access body. In Denmark, previous experience with building national infrastructures left actors worried that policymakers underestimate the resources needed for a common Danish health data and analytical platform and the resources needed to sustain high-quality data. Here the involvement of local data controllers and the resources needed to sustain the changes in local practices are emphasized.

Another costly lesson learned from other centralizations and […] it's like, you know, that … that to do and organize such things, it takes so much … energy. And it would be a constant development that would require internal energy from the different organizations. (ID7)

In working with the vision for better use of health data, the Danish ambition is to finance the new health data platform in a public-private partnership. The interviewees expressed different opinions regarding this type of approach, but most acknowledge that to finance the model they are aiming for, a great deal of financial resources are needed. In Norway, IN2 highlighted that health data spaces need to be seen as a part of the national infrastructure, implying that the public sector must finance it. In Finland, interviewees expressed concern about costs, specifically the resources that Findata or local data controllers have at their disposal to manage data requests. Some local data controllers are better equipped and have a long history of managing data requests, whereas other institutions may not have sufficient resources allocated to handle secondary data requests.

In both Norway and Finland, the answer to the issue of costs was pricing. In Finland, many researchers noted that, after the introduction of Findata, the prices associated with gaining permits and access to data became so high that they hindered research. Findata objected by noting that the additional costs were small in comparison to the costs charged previously by the local data controllers. Nevertheless, the introduction of costs to secure computing environments was a new cost that researchers had to take into account.

Large institutional organizations, such as the Finnish Institute for Health and Welfare and large hospital regions, have the financial and technical capacities to set-up their own secure computing environments to facilitate in-house analysis. This capacity has important implications in relation to power relations between Findata and individual data controllers since larger data controllers have more influence and power than smaller ones within the Finnish public data ecosystem. This has become apparent in recent discussions regarding the revision of the secondary data law and Findata. Some larger data controllers have unofficially proposed that they be granted some of the regulatory authority of Findata, thus redrawing the borders between data controller and data authority. Although this has not come into effect, the discussion reflects the challenges that the establishment of Findata created. In situations where a data controller wants to use his or her own data in combination with data from another data controller, he needs to apply for a permit from Findata to use his own data.

Likewise in Norway, many stakeholders criticized the pricing methods in the hearing round on changes that needed to be made to the law necessary to implement the HDP. In its hearing statement, the Norwegian Medical Association wrote, for example:

It does not seem appropriate or reasonable that the health services, that carried the costs of data registration, storage, and transfer to these health registers, should pay fees for getting the data–while all the time these services are now essentially for free and provided by the health services themselves. (Den Norske Legeforeningen, 2021)

The quoted passage illustrates that “attached actors” draw boundaries between those who have invested in data work and those who only want to use it. In a similar manner, in their hearing statements, many Norwegian public actors problematized the fact that private and public actors would pay the same price, considering that e.g., municipalities and hospitals contribute to providing data. In contrast, industry representatives argued that the price should be the same for them as for others.

Such discussions about the differences between public and private actors emerged early in Denmark as well. The interviewees referred to their various traditions for granting access to data and expressed concern about the necessary alignment between various actors. Some have granted equal access to data for both for-profit and not-for-profit actors, while others have established special regulations that apply only to for-profit actors.

In all three countries, solutions are needed regarding the demands of private actors. Meanwhile, local data controllers continue to struggle. For example, one data controller from a major Norwegian public registry reported:

In the last few years, there have been many data access applications from pharmaceutical companies … quite complicated applications that take much time. They use us almost like scientific assistants. They consume our time. We are obliged to deliver data. At the same time, we can't be their scientific assistants; it's exhausting.

One application was extreme. They wanted to have a continuous dialogue and collaboration on particular diagnoses. … a long, long list of codes on which they wanted to collaborate, like hundreds of hours for our case manager. In the end, we demanded that they modify the application. (IN8)

Overall, distinguishing between attached and detached actors, based on whether the actors have invested in data work or not, could help break down simplified private-public boundaries. The negotiation of these borders in health data access across Denmark, Norway, and Finland illustrate the challenges about resource allocation, costs, and the roles of various actors. The differences in pricing models and concerns about equitable access highlight the need for a clearer distinction between public and private stakeholders, particularly in data work. While the implementation of centralized health data platforms has a big potential, it must be carefully considered in terms of financial and operational structures for both local and national stakeholders.

Discussion: On the stickiness of fragmentation

Policy efforts at centralizing access to health data to facilitate the secondary use of data can be understood as attempts at encouraging the detachment of data. With health data “one-stop shops,” welfare states would both control access to their data resources and encourage the use of such repositories for innovation and research, thus stimulating new activities and forms of collaboration. Hence, these policy efforts seek to detach data from their primary context (e.g., hospital districts or municipalities). However, the detachment of data in new health data spaces is difficult to achieve in practice.

Despite notions of seamlessness, we see that borders (across nations, organizations, and actors) emerge in unexpectedly strong ways in these policy efforts. Surprisingly, the attachments of data to places, institutions, and countries become glaringly demarcated precisely in those moments when the borders are supposed to be overcome. For example, we showed how laws supposedly enabling the use of health and social data create new types of restraints. The secondary use of data in Finland and Norway, for example, reinforces attachments to national territories, and in all cases, to existing health data organizations. Another example that we provided was how people employed in registries cross institutional borders to bring their attached competencies with them and mobilize data by being mobile themselves.

As a result, the idea of the one-stop shop can become diluted. A tendency exists for data to remain tied back to their original places of origin, including the practical need of re-attaching the data in order to know whether they are usable. This tendency necessitates border work, as we, for example, have seen in the extra loops that are established. Social scientists, such as Marelli et al. (2023), have already warned that initiatives such as the EHDS risk “hindering rather than facilitating health data use and re-use by health professionals and researchers (2).” Our analysis has justified their concern, and we see the contours of problems manifesting themselves already both in Finland and in Norway. In Norway, the waiting time to gain access to data has been described as even longer than before the start of the program (Aukrust, 2023). In Finland, international collaboration especially in registry research is halted in no small part because it is both too expensive and difficult. Moreover, potential customers do not obtain everything they need from the one-stop-shop of Findata; they still need also to discuss matters with the original, local data collectors and controllers. Thus, easier access, efficacy, and the logic of the one-stop do not play out in practice in the way envisioned.

In all three countries tensions emerged in the construction of health data spaces. For example, one consequence of already established data infrastructures is the existence of well-established, professional and organizational environments with strong attachments to the collection and use of what they consider “their” data. Within each infrastructure, they have developed specific guidelines for the collection, storage, and use of data, and they often offer their own analytical platform as a secure environment to analyze the collected data. Many of the actors would prefer to continue to use the setup they have already been using for many years or else they would like to be heading and defining the centralized body themselves. In Norway, the solution as it exists is paradoxically that most registries, including the new centralizing body HDS, were relocated under the mandate of the Institute of Public Health in 2024 ³ and the Directorate for e-health was shut down (Helsedirektoratet, 2023). As far as we can tell, the politics of health data governance, which involves conflicts of interest among existing infrastructures, institutions, and actors, and a constant institutional reshuffling has not yet been addressed in the scholarship or policy work on creating health data spaces.

As a consequence, what eventually has occurred is not a centralization of health data access but rather a federalization of it. In Denmark, where no decision on how best to construct a health data access body has yet been made, the actors involved in the already established data infrastructures are arguing for a federated model, including when it comes to analytical platforms and not only with respect to data access. In a similar manner, the Norwegian decision to continue with the HDP, the “Health data initiative,” has provoked discussions about the possibility of reusing existing infrastructures as one way of addressing the lack of a HAP. Existing infrastructures have been developed by public universities, such as the HUNT Cloud, the University of Bergen's SAFE, or the University of Oslo's TSD, as well as by Statistics Norway (microdata.no). Even in Finland, the most “advanced” of the countries–and best practice model for the EHDS–some organizations have suggested that they be given broader rights for the use of data, where they would not necessarily have to go through Findata, which raises questions about the future role of Findata.

The persistence of fragmentation (in the form of many data spaces, organizational actors and access points) demonstrates the inherent difficulty in separating data sets from their local contexts. Rather than achieving centralization, efforts to streamline health data access have resulted in a new kind of visibility of borders. Data remain linked to their original contexts and established local and institutional practices, while centralization efforts add layers of complexity. Those challenges are likely to confront also initiatives such as the EHDS–the anticipated seamless data flow may be perpetually hindered by the realities of localized practices, resulting in a stickiness of fragmentation.

Conclusion

In this article, we have shown that health data policies and practices involving one-stop shops are about border work, that is, about constructing, maintaining, and overcoming borders. When constructing new data infrastructures, there is a tendency for already existing infrastructures to remain in operation and co-exist with the new ones due to such border work. This tendency leads to overlapping administrative structures and processes, which then can increase overall expenses related to data work and governance. The future of accessing health data may resemble the current situation, which is marked by many different health data spaces. We suggest that this stickiness of fragmentation might be a general feature of big data policy efforts.

Although existing policies focus on the creation of data spaces, we suggest that more discussion is needed about the conditions and ways in which access is granted to various user groups. The notion of “data spaces” can, in our opinion, be misleading and fail to draw attention to the relationality of data or to the data work associated with providing access and combining multiple datasets from various sources. A failure to fund and support this type of work can have a significant negative impact on research itself. It appears that current policies and practices pertaining to data spaces and facilitating research can have the opposite effect to what had been intended. Managing and running access points to data spaces requires resources to make meaningful access possible.

Finally, we would like to ask whether European policies regarding health data spaces have it wrong. The notion of data space does not account for the ways in which researchers work with data and data analysis tools. Furthermore, differences at the national level regarding the interpretation and implementation of access policies is indicative of too much fragmentation and lack of common agreement on the conditions and standards necessary to have a functioning data analysis platform or platforms at the European level. It may be that this vision is too far in the distant future as various countries experiment with and test how data access and analysis take place at the national level first.