Data Protection Monitor
Global Privacy & Data Protection Intelligence

European Economic Area (EEA) · Module Detail

European Economic Area: Sectoral Watch

← Full European Economic Area overview Build report with European Economic Area Request deeper dive

#

Health and telecoms/eprivacy overlays are actively evidenced; other sectoral overlays (financial, employment, education, insurance) lack direct 2026 sourcing in this pass and are flagged as gaps.

Primary frameworkGDPR (Regulation (EU) 2016/679) with sector-specific overlays (ePrivacy Directive 2002/58/EC)
Supervisory authorityNational DPAs (e.g. CNIL for health-data enforcement)
Traffic-light rationale — AmberHealth and telecoms/eprivacy overlays are actively evidenced; other sectoral overlays (financial, employment, education, insurance) lack direct 2026 sourcing in this pass and are flagged as gaps.

Sub-modules (8)

Data Access SharingNot assessed

No narrative recorded for this sub-module.

Claims (2):

  • EU Data Act Art. 29 prohibits: From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process; until that date, only cost-covering reduced switching charges are permitted.
  • EU Data Act (data access by design) requires: The Data Act's data-access-by-design obligation for connected products and related services applies from 12 September 2026, forward-looking only.
Category narrative241 words

Across the EEA, horizontal GDPR obligations intersect with dense EU sectoral regulations and national opening-clause laws. In financial services, DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025), PSD2 (and the incoming PSR/PSD3 package), and the AML Regulation (EU) 2024/1624 require strict ICT incident reporting, fraud-monitoring data governance, and AML retention reconciled with GDPR data minimisation (per EDPB Guidelines on PSD2/AML interplay). In health and life sciences, Regulation (EU) 2025/327 establishing the European Health Data Space (EHDS) was adopted on 11 February 2025 and entered into force on 26 March 2025 (with phased application from March 2027 to 2031), creating harmonised primary patient electronic health record rights and a permit-based secondary health-data research framework across all Member States alongside Art. 9(4) national laws. Electronic communications remain governed by Directive 2002/58/EC (ePrivacy Directive) and national transpositions following the Commission's February 2025 withdrawal of the proposed ePrivacy Regulation. Employment data is governed by Art. 88 GDPR national rules (such as § 26 BDSG in Germany as interpreted in CJEU Case C-34/21 and Case C-65/23 MK v K GmbH of 19 December 2024, confirming national collective agreements and laws must still satisfy every substantive Art. 5/6 GDPR condition) and the Platform Work Directive (EU) 2024/2831 (enacted October 2024, prohibiting processing of platform workers' emotional state, private conversations, and off-duty data). Credit scoring is tightly constrained by CJEU Case C-634/21 SCHUFA Holding (7 December 2023) and Case C-203/22 Dun & Bradstreet Austria (27 February 2025).

Sources and claims (5)
  1. ConfirmedCNIL — CNIL imposed a €5 million fine against IQVIA in connection with health-data processing, evidencing active French enforcement in the health sector.observed
  2. Confirmedunavailable — The Digital Omnibus proposes amendments to the ePrivacy Directive including limited additional derogations to the general prohibition on storing or accessing data in terminal equipment, which the EDPB/EDPS urge be balanced by incentivising contextual over behavioural advertising.
  3. ConfirmedMedical Law Review / NCBI PMC — In December 2023, the CJEU issued its first interpretation of Article 22 GDPR (right not to be subject to solely automated decision-making) in the context of automated credit scoring (Case C-634/21, SCHUFA).observed
  4. Probableunavailable — EU Data Act Art. 29 prohibits: From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process; until that date, only cost-covering reduced switching charges are permitted.
  5. Probableunavailable — EU Data Act (data access by design) requires: The Data Act's data-access-by-design obligation for connected products and related services applies from 12 September 2026, forward-looking only.