This thesis has found a balance between individual data protection rights and the free flow of data. On the one hand, this balance serves to protect the individual and his data. On the other hand,... Show moreThis thesis has found a balance between individual data protection rights and the free flow of data. On the one hand, this balance serves to protect the individual and his data. On the other hand, health care and health research must take place using personal data.A balanced approach can be found in the following four ways. Firstly, a broad(-er) interpretation of the lawful basis of consent can facilitate secondary health research. Secondly, the use of other lawful bases can be a solution for the legitimation of secondary health research. Furthermore, a separate legal ground for secondary research can be a solution to resolve the issue of a lawful basis for health research.Thirdly, a balance can be found in the individual’s autonomy vis-à-vis the accountability of the health institution and the attention drawn to the free flow of data. The focus is shifted from the individual’s control over his data towards the health institution with other lawful bases than consent and a fair balance between data protection rights and the free flow of data.Fourthly, a risk-based approach to monitoring compliance contributes to balancing the rights and interests of individuals with data sharing for health care and research. Show less