Source: European Parliament
In its decision referred to by the Honourable Member, the Conseil d’État acknowledges that the health data concerned will be hosted in data centres located in the EU and that no transfers of health data to a third country are foreseen.
The necessity and proportionality safeguards, put in place by Executive Order 14086[1] in the context of the EU-US Data Privacy Framework (DPF), apply to surveillance under Section 702 of the Foreign Intelligence Surveillance Act (FISA)[2].
Those safeguards and the reauthorisation of FISA Section 702 have recently been assessed in the first DPF review report and are continuously monitored by the Commission[3].
Transfers of personal data to third countries outside the European Economic Area may only be carried out in compliance with the rules laid down in the General Data Protection Regulation[4].
In upcoming initiatives on data use and storage, such as the Data Union Strategy and the Cloud and Artificial Intelligence (AI) Development Act, the Commission will aim at strengthening the position of Europe’s cloud industry and preventing any misuse of our most sensitive data[5].
The Commission is supporting the development of infrastructure to foster innovation and the deployment of digital technologies in health and care allowing for the development and testing of AI-based technologies for diagnosis and treatment.
The Commission has also put forward the European Health Data Space[6], to support the development of AI by ensuring that electronic health data can be made available for purposes of ‘scientific research related to health or care sectors […] including in […] AI systems’[7] under relevant safeguards[8].
- [1] Executive Order on ‘Enhancing Safeguards for United States Signals Intelligence Activities’ — https://www.govinfo.gov/content/pkg/FR-2022-10-14/pdf/2022-22531.pdf
- [2] See recitals 124 and 125 of Commission Implementing Decision EU 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework; 50 US Code §1881a.
- [3] Commission r eport of 9 October 2024 to the European Parliament and the Council on the first periodic review of the functioning of the adequacy decision on the EU-US Data Privacy Framework, COM(2024) 451 final. It is further recalled that under the GDPR, all adequacy decisions are subject to continuous monitoring and all the necessary tools are in place to react to any possible developments. In particular, the Commission has the power to suspend, amend or repeal the adequacy decision if it concludes that the required level of protection is no longer ensured (see Article 3(5) of Commission Implementing Decision EU 2023/1795 and Article 45(5) GDPR.
- [4] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); OJ L 119, 04/05/2016, p. 1-88.
- [5] Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions — A Competitiveness Compass For The EU, 29 January 2025, COM(2025) 30 final — https://commission.europa.eu/document/download/10017eb1-4722-4333-add2-e0ed18105a34_en
- [6] https://oeil.secure.europarl.europa.eu/oeil/en/procedure-file?reference=2022/0140(COD) On 21 January 2025 the Act was adopted by Council after Parliament’s 1st reading. On 11 February 2025 the final Act was signed.
- [7] Article 53(1), point (e) European Health Data Space (EHDS).
- [8] It is worth further noting that s everal actions are funded and will continue to be funded under Horizon Europe, Digital Europe and EU4Health, to enable AI-driven breakthroughs in biomedical research and clinical care. This includes disease prevention, which is one of the priorities of this Commission.