ABSTRACT

Latest developments in technology lead us to the blockchain and artificial intelligence (AI) technologies and these technologies were easily adopted in our daily lives via smartphones, tablets, and computers. However, the field of use of these technologies is not limited to individual usage. Thanks to them, public services have started to take a path in a quite positive direction. Even though it is predicted that these technologies will overstep their current benefits. Especially in healthcare, these technologies have many impacts that are determined to revolutionize medical science. Moreover, these technologies exceeded the pilot scheme and are currently integrated into the healthcare system. Apart from the interventional practices, AI technologies have started to impact children’s health, and this makes sense when considering that today’s children would live in the AI era. However, these technologies that can evolve rapidly and by themselves would raise questions, especially in healthcare. The right to health is one of the most important fundamental rights of humans as it is in direct relation with the right to health taking into account. When it comes to pediatrics, it is obvious that these concerns would reach higher levels, especially for the states who has special liabilities on protecting children’s rights. In this study, we will explain the legal and ethical causes of these concerns and discuss possible solution.

INTRODUCTION

Blockchain and artificial intelligence (AI) technologies are quickly becoming a part of our daily lives. Not only for individual usage but also for public services. Healthcare is one of the popular and life-changing areas when it comes to the integration of blockchain and AI technologies into the service. As a service itself and also as the branches of the service separately, these technologies have so many benefits for the service itself and for improving human life and the treatment of diseases. Like many other branches of medicine, pediatrics is one of the areas in which these technologies can show their significant impacts. As these technologies have many benefits for medicine and patients’ health, they cause many concerns, especially at the point of fundamental rights and patients’ security. Even these concerns outweigh the benefits when it comes to sensitive data and fundamental rights of the patients, especially of the children, for those states must provide higher protection. In this study, first, we will examine the benefits of these technologies separately in pediatrics. Then we will explain the term personal data and regulations on personal data protection which are effective in Turkey, such as General Data Protection Regulation (GDPR) and Kişisel Verilerin Korunması Kanunu/Turkish Personal Data Protection Act (KVKK), and we will discuss the regulations relevant to pediatrics. Finally, we will discuss legal and ethical questions about the usage of these technologies in pediatrics and we will discuss the probable solutions for these questions.

Blockchain Technologies in Pediatrics

Blockchain technology is simply defined as “Distributed database formed as a chain of data blocks and decentralizing the storage and processing of data” in the literature⁽¹⁾. Even though its starting point was digital currency⁽²⁾, now it has various areas of utilization such as finance, gaming, engineering, agriculture, and healthcare⁽³⁾, which is one of the main subjects of this study. In healthcare, blockchain technologies offer various opportunities to use, such as; digital medical record storage, electronic prescription systems, intelligent hospital and telemedicine, clinical research, public health management, medical device tracking and drug tracking⁽⁴⁾. Even though the best-known and commonly used area of blockchain in healthcare is digital record storage, there is no usage of blockchain in healthcare in Turkey. Some may argue that there is a digital medical record storage system in Turkey called ‘e-Nabız’, but e-Nabız is not a product of blockchain technology, nor use the technology. That is why E-Nabız should not be confused with blockchain health record storage systems⁽⁵⁾. In this regard, Estonia is considered as a pioneer of the integration of blockchain technology in the storage of medical health records⁽⁶⁾. In pediatrics, studies show that implementation of electronic health records (EHR) facilitates monitoring diabetes, sickle cell disease and vital signs in pediatric intensive care and also facilitates the treatment of these diseases⁽⁷⁾. The same authors also emphasize the efficacy of the developments in the adaptation of the Telehealth system in pediatric care too⁽⁷⁾. So these systems allow children and their parents to reach healthcare services easily, especially for disease management at home. Apart from EHR, Internet of Things (IoT) devices integrated into the blockchain systems have a great impact on pediatric care too. IoT means devices that have an internet connection. These devices allow data sharing via internet connection and their main purpose is data collection and storage, then their flow to the bigger data systems without human intervention⁽⁸⁾. These devices are useful for monitoring patients’ health status indicators⁽⁹⁾ and provide real-time health data for healthcare professionals⁽⁸⁾. In pediatrics, there are some useful IoT devices such as; monitoring device for obesity prevention⁽¹⁰⁾, monitoring device for diabetes, seizure detection device for epilepsy⁽¹¹⁾, device for management of asthma⁽¹²⁾, IoT supported home mechanical ventilator⁽⁸⁾, smart bracelets for children who have hearing loss⁽⁸⁾, IoT supported smart pillbox, support device for autism spectrum disorder⁽¹³⁾ and wearable IoT connected textile devices for neonatal monitoring⁽¹⁴⁾.

AI Technologies in Pediatrics

Apart from blockchain technology, as AI technology can be integrated into the blockchain technology or stand alone AI have a huge impact on revolutionizing healthcare systems. AI technology’s characteristics are potential human reasoning and decision-making⁽¹⁵⁾. These technologies work by learning, which happens by collecting and analyzing huge amounts of data and then by using these datasets to provide results or suggestions in the scope of their creation or use⁽¹⁶⁾. European Union (EU) Commission’s High-Level Expert Group on AI defines clean and briefly how AI works as “perceiving their environment through data acquisition, interpreting the collected structured or unstructured data, reasoning on the knowledge, or processing the information, derived from this data and deciding the best action(s) to take to achieve the given goal and they can also adapt their behaviour by analyzing how the environment is affected by their previous actions”⁽¹⁷⁾. In healthcare, AI technology uses datasets from patients’ health data and uses these datasets to make analyses and show its results in diagnostics or patient care⁽¹⁸⁾. European Parliamentary Research Service (EPRS) studies AI usage in healthcare into four main domains such as clinical practice, biomedical research, public health and health administration. Under the domain of clinical practice, AI’s role is specified as image analysis, signal processing and integration and array of the results with the other health data. Under the domain of clinical research AI’s role defined as retrieving clinical data by using machine learning algorithms and ranking the data. In public health, AI’s work as specified as risk analysis for diseases according to the demographics analysis. Lastly for healthcare administration, AI’s role is defined as managing administrative workflow⁽¹⁹⁾. In the doctrine, even though some authors make similar classifications according to the medical field⁽²⁰⁾ like EPRS does, many authors address the issue according to its task. Today, the most popular and settled use of area of AI in healthcare is diagnosis and imaging⁽²¹⁾ and also monitoring and remote care⁽¹⁸⁾. There are so many applications of these tasks fulfilled by AI⁽²²⁾. In Turkey, there are some applications of AI in healthcare such as; integration of AI-based software to e-Nabız system⁽²³⁾, AI-based imaging devices, AI tools and software for early diagnosis and personalized cancer treatment, AI-based telemedicine applications⁽²⁴⁾, AI-based EHR and automation systems, biotechnology studies and clinical decision systems⁽²⁵⁾. In pediatrics, AI is being used in personalized medicine⁽²⁶⁾, diagnostics and treatments⁽²⁷⁾, especially in imaging and monitoring⁽²⁶⁾, disease risk analysis⁽²⁷⁾ and clinical decision support⁽²⁸⁾. Some authors also consider the usage of ChatGPT as a diagnostic or clinical decision support tool in pediatrics⁽²⁷⁾. Despite the advantages of this advanced technology, it brings some concerns and questions, not only for its usage in pediatrics, but also for the whole healthcare system. However, we will discuss these concerns for pediatric health care deeply in this study for the delicate structure of children’s personal data, especially in the context of children’s health data and the field of pediatrics. In a study, authors indicated that pediatrics is a field that has more pressure for faster access to medical decisions and lower medical errors⁽²⁹⁾. This can be explained by the parental observation on these patient-physician relationships. So the AI technologies cause anxiety among the parents for their high-risk, especially for the errors and concerns about the protection of personal health data, although this is not a priority⁽²⁹⁾.

Rules on Personal Data Protection Regulations about Pediatric Data

With the start of widespread use of the internet in our daily lives, concerns have been raised about personal data protection within the context of the right to respect for private life. All of these concerns led about the European Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data [Council of Europe Treaty Series (CETS) No.108] in 1981. Then today, it has evolved to the GDPR. In Turkey, as a product of the EU harmonization process, the KVKK/ Turkish Law no. 6698 came into force in 2016. Both GDPR and KVKK, define health data as a special data. There is no such specification for children’s data, but GDPR has a regulation about the matter of consent regarding the children’s personal data. In the following sections we will discuss these regulations.

Rules on Personal Data Protection Regulations about Children’s Data

GDPR

For a lawful personal data collection, GDPR’s article 6 requires the consent of the data subject for processing their personal data. Even though GDPR has no special regulation that regulates children’s personal data under a special category. Therefore, Article 8 is about children’s personal data. More specifically, Article 8 regulates the consent issue of the children’s personal data. According to Article 8 of the GDPR, children at least 16 years old can consent to the processing of their own personal data by themselves. Nevertheless, children under the age of 16 cannot give consent to the processing and collection of their own personal data; their parents can give consent to the collection or processing of their children’s personal data. Additionally, GDPR gives states a special responsibility over the activities for children. Also, GDPR suggests to the states to ensure special protection over children’s personal data and this perspective is repeated in the recital 38 of GDPR, which is an explanatory text about the regulation, therefore there is no explanation of what can be done for the special protection of children’s personal data. That is why this perspective of GDPR lawmakers is criticized in the doctrine⁽³⁰⁾.

KVKK

As a loyal follower of the GDPR, the Turkish legislator, did not recognize children’s personal data as a special data category. Unlike GDPR, KVKK does not regulate the consent issue regarding children’s personal data. This is because, children do not have legal capacity to act in Turkish law. Their parents do legal action in behalf of the children. Also, everyone under age 18 is considered a child in Turkish law. That is why the Turkish legislator found it unnecessary to regulate the consent issue on children’s personal data⁽³¹⁾. Despite having no special regulations on children’s personal data Turkish Ministry of National Education has a cautionary notice on sharing personal data of children in social media within education institutions both individually and institutionally⁽³²⁾. Both GDPR and KVKK are criticized in the legal doctrine for not having a special regulation protecting children’s personal data⁽³³⁾.

Rules on Personal Data Protection Regulations about Health Data

GDPR

Health data is regulated under a special category of the personal data, it is also called sensitive data, in the GDPR. Health data is also specified under a special category of personal data in the European Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No.108) in 1981. Regulating health data under a special category of personal data means it requires special protection and measures. In GDPR, health data is separated from genetic data and within the scope of health data, all of the data regarding the individual’s health, including mental health are defined. Genetic data is also regulated under the same special category of personal data as health data. Collection and processing of sensitive personal data is only allowed if specific conditions are met, such as informed consent before collection⁽³⁴⁾. Sensitive data must be collected and preserved in a secure environment and must meet required measures⁽³⁵⁾. For example there is a prohibition for central data banks for health data and this prohibition is provided by the World Medical Association in 1983⁽³⁵⁾.

KVKK

As a loyal follower of GDPR, KVKK has similar regulations about health data, such as regulating health data under a special category and prohibiting the processing of the special personal data only if specific conditions are met such as informed consent. KVKK also pays great attention to informing data subject and includes a penal provision for contrary action⁽³⁵⁾.

In Turkish law, there is also a regulation about processing personal health data, called “The Regulation on Personal Health Data” which is regulated by the Turkish Ministry of Health. This regulation includes required protection measures for personal health data collection, processing and storage, further information on methods for collection, processing, storage and erasure of the health data, regulations about the e-Nabız central digital health system which is created via Ministry and also conditions for medical research and open health data. This regulation allows the usage of personal health data in medical research only if health data is anonymized and allows open health data only if required protection conditions are met.

Rules on Personal Data Protection Regulations about Children’s Health Data

As we mentioned under the previous headings, both GDPR and KVKK do not provide special protection for children’s personal data. According to both regulations, health data is considered as sensitive data and sensitive data requires special protection. So there is no special protection rule foreseen for children’s personal health data. There are some differences between GDPR and KVKK regarding children’s consent for processing personal data. As we mentioned in the previous headings. Process of health data requires informed consent. GDPR accepts children’s consent as legal consent until the age of 16. Children under 16 years old cannot give legally valid consent for the processing their personal data according to the GDPR. Even though KVKK does not include any regulation about children’s consent capability; general rules of Turkish law consider everyone under the age of 18 as a child and children do not have legal capacity to act. Their parents have the authority to act on their behalf of. That is why KVKK does not contain a special regulation for children’s consent on the usage of their personal data. However, Article 8 of Turkish Regulation on Personal Health Data is about access to the children’s health data and according to this article, parents can access to their children’s health data through e-Nabız system but children who has the capacity of judgement can change the authorization of their parents for access to their health data through e-Nabız app. This article, seems to adopt the perspective of the GDPR on the matter in a way. In the doctrine, lack of special protection for children’s personal data is criticized and it is suggested that children must be as fully informed as possible, even with games or cartoons, about the dangers of sharing their personal data with third parties⁽³⁶⁾. Even so, children can be encouraged to participate in m-health apps which are helpful not only for tracking and monitoring chronic diseases and for treatments of mental diseases such as anxiety disorder, depression, etc.⁽³⁶⁾. Besides, the same author, argues whether prenatal monitoring data is the mother’s personal data or children’s personal data according to the international organizations’ official documents on this matter⁽³⁶⁾.

Personal Data Protection Regulations Applicable to Blockchain Technology

Even though there are many benefits of using blockchain technology in pediatrics, there are some compliance issues with the regulations arising from the nature of the technology. First of all, the problem starts with the question “Is the data used and stored in blockchain a personal data?” If the answer is yes, then it should be emphasized that personal data is under the protection of both GDPR and KVKK. These regulations not only ensure the protection but also give individuals to control over their personal data⁽³⁷⁾. Within the block, there might be data identifiable to the natural person⁽³⁸⁾. So that means, the block can contain personal data and this is where blockchain gets on the radar of the personal data protection regulations such as GDPR and KVKK. In this case, the data subject can use their rights granted to them by these regulations. However, blockchain’s nature cannot allow data subjects to use some of its rights, such as the right to erasure, destruction or anonymization of personal data. Because in a blockchain technology, data in the blocks cannot be changed or erased⁽³⁷⁾. Even though there are some suggestions for compliance with these regulations but there is no exact solution for the rights of the data subject to be met as required⁽³⁸⁾. Even when the sensibility of the health data is taken into account, as we mentioned before, all of the rights of the data subject on their health data must be overemphasized. Thus, management of the medical data causes a great challenge for the data controller⁽³⁹⁾.

Personal Data Protection Regulations Applicable to AI Technology

As we mentioned under the relevant heading, usage of AI technologies has many benefits in healthcare. Nevertheless, AI technologies require a vast amount of data for both learning and analyzing⁽¹⁷⁾. Within the vast amount of data, personal data may appear too. Thus, AI technologies can also get on the radar of the personal data protection regulations too. Collecting vast amount of data raises many concerns about personal data protection in AI technologies, such as re-identification, usage for the wrong purposes or usage beyond the data subject’s consented purpose and transparency. While AI systems use big data to work, even the usage of anonymized data does not protect to data subject whose personal data is anonymized⁽⁴⁰⁾ because with the vast amount of data, anonymized data can be re-identified⁽¹⁷⁾. Thus, anonymized data can no longer be the non-personal data⁽¹⁷⁾. Besides, according to the relevant regulations, there is a ‘purpose limitation’ for the process of personal data. This means, personal data can only be used for the initial collection purpose. But AI technologies can reuse the data for a new purpose as out of control. The same logic applies at the point of consent. Because the consent of the data subject must be specific and the purpose limited⁽¹⁷⁾. When it comes to transparency, it is accepted that there is an uncertainty on the usage and the possible usage of the personal data in AI Technologies⁽¹⁷⁾. This uncertainty affects the usage of the right to erasure for the data subject. This is also a problem for the right to access to the personal data of the data subject. Apart from the personal data protection issues, the transparency problem causes mistrust in AI technologies especially in healthcare⁽¹⁹⁾. Besides, while considering the re-identification problem, since the health data is considered a sensitive data, it must be considered as a great risk of exposure and use of the sensitive personal data. In 2024, the EU AI Act came into force and this act ensures more security and more transparency for the AI users⁽⁴¹⁾. This act adopts a risk-based approach to AI technologies⁽⁴²⁾. In the doctrine, this Act is considered as a great step for the development of AI systems in healthcare which protects and respects the fundamental rights of the patients⁽¹⁶⁾.

Ethical Discussions on Using Blockchain and AI Technologies in Pediatrics

EPRS points out four ethical principles on the usage of AI, such as respect for human autonomy, prevention of harm, fairness and explicability/transparency⁽¹⁷⁾. Besides EPRS for the achievement of these principles, it sets seven requirements to be met such as, respect for the fundamental human rights, safety and security, respect for privacy and personal data, transparency, non-discrimination, sustainability and accountability ⁽¹⁷⁾. When it comes to AI usage in medicine, transparency and respect for the patient’s autonomy are the two moral principles that are generally put on the table. AI technologies have sophisticated self-learning algorithms, and these uninterpretable algorithms are called “The black box algorithms”⁽⁴³⁾. This uninterpretable structure contradicts with the transparency principle and leads to the insecurity for the usage of these systems⁽⁴⁴⁾. AI technologies also raise some concerns with respect to human autonomy especially, on respect to patients’ autonomy in medicine. Some argue that AI can adopt a paternalistic model for decision making and discard the patient’s decision for the treatment⁽⁴³⁾.

CONCLUSION

AI and blockchain technologies have a great impact in medicine, as in many other areas. Even in the different branches of medicine, we see that the use of AI has reached different levels of sophistication. Like the many other branches of medicine, AI and blockchain technologies, make a great contribution to pediatrics especially in monitoring diseases and ensuring the participation and cooperation of the children in treatment.

In addition to its benefits, AI and blockchain technologies raise some legal and ethical concerns in widespread use. As legal concerns, we are commonly encountering the personal data protection issues. As we mentioned in the relevant headings, the usage of AI and blockchain technologies in medicine, currently makes it hard to usage of the data subjects’ fundamental rights regarding their and their children’s sensitive data and we observe the usage beyond the consent of the data subjects in these technologies. As an international authority, EPRS argues that GDPR and GDPR based regulations for personal data protection do not limit the capacity of the usage of these technologies but developers should harmonize their products with these regulations. We believe that EPRS’s suggestions for these legal questions are acceptable. As for the ethical concerns, especially AI technologies, raise big question marks on transparency and respect for the patient’s autonomy principles due to their structure. As the doctrine suggests, especially in medicine more transparent and explainable AI technologies must be chosen and physicians must intervene to the paternalist actions that might be caused by AI technologies in clinical decision making. This means physicians must play an active role with respect to the patient’s autonomy when AI technologies are involved in the medical process.