European Union

On May 9, 2024, the Italian data protection authority (“Garante”) published a decision identifying the safeguards that controllers must put in place when processing health data for medical research purposes, in cases where data subjects’ consent cannot be obtained for ethical or organizational reasons.

The Garante’s decision follows a recent legislative development, enacted by Law n. 56 of April 29, 2024, and effective as of May 1, 2024, which amended, among other things, Article 110 of the Italian Privacy Code.  The amendment removes the obligation to submit a research program and related data protection impact assessment (“DPIA”) for prior consultation to the Garante, in cases where it is impossible or disproportionately burdensome to contact the concerned individuals.  

We provide below an overview of the legal framework and the safeguards identified by the Garante.Continue Reading Italian Legislator and Regulator Update Rules on Processing of Health Data for Medical Research

The French Public Health Code requires that certain service providers hosting health data hold a specific “HDS” certification.  In order to obtain this certification, providers must comply with the requirements set out in the “HDS” certification standard.  On May 16, 2024, France officially published an updated version of this “HDS”…

Continue Reading France Publishes Updated Certification Standard for the Hosting of Health Data

On March 5, 2025, the final text of the European Health Data Space (EHDS) was published in the EU Official Journal.  In April 2024,we wrote several blog posts on EHDS based on a provisional compromise text.  We have now updated those to reflect the final version and included references to the correct provisions.

This article focuses on the governance and enforcement of the EHDS; for an overview of the EHDS generally, see our first post in this series.Continue Reading EHDS Series – 5: European Health Data Space Governance, Enforcement and Timelines

On March 5, 2025, the final text of the European Health Data Space (EHDS) was published in the EU Official Journal (see here).  In April 2024,we wrote several blog posts on EHDS based on a provisional compromise text.  We have now updated those to reflect the final version and included references to the correct provisions.

This article focuses on the implications for “wellness applications” and medical devices; for an overview of the EHDS generally, see our first post in this series.Continue Reading EHDS Series – 4: The European Health Data Space’s Implications for “Wellness Applications” and Medical Devices

On April 22, 2024, the European Federation of Pharmaceutical Industries and Associations (“EFPIA”) issued a statement on the application of the AI Act in the medicinal product lifecycle. The EFPIA statement highlights that AI applications are likely to play an increasing role in the development and manufacture of medicines.  As drug development is already governed by a longstanding and detailed EU regulatory framework, EFPIA stresses that care should be taken to ensure that any rules on the use of AI are fit-for-purpose, adequately tailored, risk-based, and do not duplicate existing rules.  The statement sets forth five “considerations”:Continue Reading EFPIA Issues Statement on Application of the AI Act in the Medicinal Product Lifecycle

In six months’ time, on 17 October 2024, Member State laws that transpose the EU’s revised Network and Information Systems Directive (“NIS2”) will start to apply.  As described in more detail in our earlier blog post (here), NIS2 significantly expands the categories of organizations that fall within scope of EU cybersecurity legislation. This new, cross-sector law imposes additional and more granular security and incident reporting rules, enhanced governance requirements that apply to organizations’ “management bodies,” and creates a stricter enforcement regime.Continue Reading NIS2 implementation enters the final stretch – six months to deadline

On January 17, 2024, the European Data Protection Board (“EDPB”) published its report on the 2023 Coordinated Enforcement Framework (“CEF”), which examines the current landscape and obstacles faced by data protection officers (“DPOs”) across the EU.  In particular, the report provides a snapshot of the findings of each supervisory authority (“SA”) on the role of DPOs, with a particular focus on (i) the challenges DPOs face and (ii) recommendations to mitigate and address these obstacles in light of the GDPR.  This blog post summarizes the key findings of the EDPB’s 2023 CEF report.Continue Reading EDPB 2023 Coordinated Enforcement Framework on DPOs: What Are the Key Takeaways for Organizations?

On March 5, 2025, the final text of the European Health Data Space (EHDS) was published in the EU Official Journal (see here).  In early April 2024,we wrote several blog posts on EHDS based on a provisional compromise text.  We have now updated those to reflect the final version and included references to the correct provisions.

This article focusses on the obligations of data users; for an overview of the EHDS generally, see our first post in this series.Continue Reading EHDS Series – 3: The European Health Data Space from the Health Data User’s Perspective

On March 5, 2025, the final text of the European Health Data Space (EHDS) was published in the EU Official Journal (see here).  In early April 2024, we wrote several blog posts on EHDS based on a provisional compromise text.  We have now updated those to reflect the final version and included references to the correct provisions.Continue Reading EHDS Series – 1: Five Key Take Aways on Secondary Use of Health Data

On March 14, 2024, the Court of Justice of the EU (“CJEU”) ruled that EU supervisory authorities have the (corrective) power to order data controllers who have been found to process personal data unlawfully to erase such personal data, even if the data subjects have not requested the erasure.  (Case C‑46/23)Continue Reading The CJEU Ruled that Supervisory Authorities Can Order the Deletion of Unlawfully Processed Personal Data