Achieved Compliance Comments on New European Health Data Space Program

Written by Achieved Compliance

As we reported on Twitter, the European Commission announced the launch of the European Health Data Space (EHDS), an initiative designed to empower people to control and use their health data in their home country or in other member states. At the same time, it promotes a consistent framework for the use of health data for research and innovation, and compliance with the EU’s data protection standards.

The Commission emphasizes in its statement that the EHDS builds further on the GDPR as well as anticipated new legislation related to data protection in the EU – the proposed Data Governance Act, the draft Data Act, and the NIS Directive. It will, in addition, establish rules designed specifically for health data - see links below.

For companies and organizations collecting and processing health data, the EU’s heightened focus on health sector data signals the possibility of new opportunities. From a data protection standpoint, the announcement notes that this initiative will offer a framework that promotes compliance with laws in Europe, but that there will be no relaxing of the EU’s high standards for data protection. Instead, it appears likely that additional rules will be put in place to ensure the protection and safe transfer of health data.

Achieved Compliance will continue to monitor the EU’s efforts to implement this initiative.

In the meantime, given its focus on protecting sensitive health data, organizations can best prepare for it will continue to be important that organizations understand the GDPR – and any new law the EU may enact to facilitate the European Health Data Space – and to build the internal programs and processes necessary to comply.

The proposed Data Governance Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52020PC0767&from=EN

Link to the draft Data Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022PC0068&from=EN

Link to the NIS Directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L1148&from=EN

Achieved Compliance can fortify your organization's understanding of the GDPR and potential new regulations to ensure proactive readiness for the evolving data protection landscape. Contact us today to learn more.

PRIVACY BLOG

New Fine Highlights the Necessity of EU-GDPR Article 27 Representation for US Companies](/content/blog/article-27-representation/index.html)

The Data Use and Access Act 2025 (DUAA) Key Changes to Data Protection Law](/content/blog/the-data-use-and-access-act-2025-duaa-key-changes-to-data-protection-law/index.html)

Privacy Compliance: Why Software Solutions Could Put You at Risk](/content/blog/privacy-compliance-why-software-solutions-could-put-you-at-risk/index.html)

The Troubling Cuts to Medical Research](/content/blog/the-troubling-cuts-to-medical-research/index.html)

ARE YOU CREATING PRIVACY ISSUES WITH AI?](/content/blog/are-you-creating-privacy-issues-with-ai/index.html)

European Commission Publishes New Standard Contractual Clauses and Guidance on Implementation](/content/blog/standard-contractual-clauses/index.html)

Dutch Data Protection Authority Fines Uber for Storing Personal Data in U.S. Without Required Protections](/content/blog/dutch-data-protection-authority-fines-uber-for-storing-personal-data-in-u-s-without-required-protections/index.html)

New York State Attorney General’s Office Issues Guidance on Tracking Technologies and Privacy](/content/blog/new-york-state-attorney-generals-office-issues-guidance-on-tracking-technologies-and-privacy/index.html)

Spanish Data Authority Fines Data Processor for Failure to Assess and Address Risks of Security Breach](/content/blog/spanish-data-authority-fines-data-processor-for-failure-to-assess-and-address-risks-of-security-breach/index.html)

Connecticut Attorney General’s Office Releases Report on New Data Privacy Law](/content/blog/connecticut-attorney-generals-office-releases-report-on-new-data-privacy-law/index.html)

Data Protection Commissioner of Ireland (DPC) Investigation Focuses on Location Data The DPC recently wrote to inform data controllers who may be in receipt of or sharing location data that it has initiated the regulatory assessment. It also notified organizations linked to those whose activities are the subject of the DPC assessment and stressed that failure to meet statutory obligations pertaining to processing of location data will result in regulatory action.
read more](/content/blog/data-protection-commissioner-of-ireland-dpc-investigation-focuses-on-location-data/index.html)