Opting-in or -out or not at all: secondary use of health data in the EHDS framework