Protecting Health Data in the Modern Age: Getting to Grips with the GDPR

I am a GDPR "generalist" currently conducting a number of compliance programmes.
I have to warmly congratulate the organisers of the course.
What I very much appreciated in this course is its practical character ; the example is extremely well chosen, is very well documented.
You succeeded in combining most of the important situations under one case : a pregnancy which one wishes to keep secret, the usage of apps (so data flowing outside of the medical establishment), cors-border medical data (both within and outside the EU), etc.
It would be better to check for the English language and spelling, and (this is a remark from a non-native English speaker) to speak slowlier (this course is not a race) - as a matter of fact, I had to resort to the text to understand what was said.
In addition, I wonder (1) where you found the notion of implicit contract (in 1.20) and what it really means ; (2) how one can document and give evidence of an oral consent ! - and can the withdrawal also be oral ??? wher will you find evidence ? imo this contradicts one of the main principles of GDPR, namely accountability - I know that Recital 32 mentions oral consent, but I note that it was not taken to the final GDPR text.
Last point : I think that you might help all students if you clearly indicated who is controller and under which conditions. As you know there are different types of controllers (cfr WP169) : single controller, joint controller, independent controller. I still struggle with this.
Always ready to exchange ideas and comments. Ook in het Nederlands.
Xavier Darmstaedter

The course is informative and with 2 weeks also rather short. The course is not as in-depth as I would like regarding processing health data for research purposes for example, and I think improvements in structure of the course would help a lot: often the most general rules are stated as if these are always the case, only to discover a few sections later, that there are clear (sometimes frequent) exceptions that are also covered within the GDPR. These exceptions are briefly described, but then met with a lot of misunderstandings in the comment sections. I think these frequent and allowed exceptions could be described more elaborately (and briefly mentioned along with the more general rules) to minimise instead of increase confusion.
Additionally, some updating to include more content may be desirable, especially on differences between different types of health data processing and related GDPR requirements.
(e.g. Elaborate on public health data collection by organisations such as WHO, CBS and RIVM, and requirements for WMO vs. nWMO research and GCP requirements to store data for 15, 25, 30 years depending on the type of research, and ICF specifications regarding data processing for research)

Having followed several MOOC courses already, this course really stood out. First of all by the charming enthusiasm of the educators. Secondly by the efforts taken to make this course. It was not like in many other cases a recycling of of-the-shelve content but everything was custom made. Thirdly, it was very good from a pedagogic point of view. There was a good cliffhanger story to make it real-life practical and there was a good alternation between story-video, explaining video, text explaining and interesting supporting interviews. A GDPR course can never be exciting, but they came close. Fourthly, it was not overly commercial. Every chapter already contained a good quiz as a knowledge check. No paying exam at the end. In the end, I decided to pay "out of sympathy" since I do not need the certification (I'm not in healthcare...).