The limits of privacy enhancement in healthcare federated learning: a ELSA perspective in the EU context

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Federated Learning (FL) usage is steadily increasing in healthcare. Offering an attractive alternative to centralized data processing, FL is often promoted as a privacy-enhancing technology (PET) because it keeps patient-level data local, exchanging only aggregated data or model updates. As such, it is frequently presented as a means of addressing the ethical, legal and societal challenges associated with the use of sensitive health data. This framing has contributed to growing policy interest in FL within initiatives such as the European Health Data Space (EHDS). This paper examines FL from an ethical, legal and societal (ELSA) perspective in the EU context, focusing on its interaction with the European data protection framework and contemporary debates on health data governance. First, it analyzes the interaction between FL architectures and the General Data Protection regulation (GDPR), showing that questions of controllership, joint responsibility, and identifiability persist despite decentralization, particularly in complex multi-institutional settings. Second, it argues that privacy-centric approaches to health data governance remain ethically insufficient because harmful inferences, discrimination, and collective harms may arise even when data remains formally anonymous. The dominant focus on reidentification risk thus reflects a narrow and individualistic conception of privacy that is poorly adapted to the contemporary data landscape of the EU. It fails to capture broader forms of harm, including group-level discrimination, inferential profiling, and structural power asymmetries. The paper concludes that, despite its framing as a PET, the use of FL alone is not sufficient to guarantee appropriate health data protection. Indeed, FL should also be approached as a distributed data-processing paradigm in which risks and benefits depend on implementation choices, institutional arrangements, and regulatory interpretation. Accordingly, FL should be situated within broader questions of data governance, including how access, accountability, and collaboration are structured and distributed across institutions.