---
title: "European Economic Area — Sectoral Watch | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/european-economic-area-bloc/sectoral-watch/
source_html: /jurisdictions/european-economic-area-bloc/sectoral-watch/index.html
description: "European Economic Area (Bloc) — Sectoral Watch (Amber, 8 sub-modules, 5 claims): Health and telecoms/eprivacy overlays are actively evidenced; other sectoral overlays (financial, employment, education, insurance) lack direct 2026 sourcing i"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 33d6a5d80c14389761012f9f156e1a32edf0f41a0669c1939bb45b0edfbd7ded
generator: "fe-fleet/md-twin@1.0"
---
# European Economic Area — Sectoral Watch | Data Protection Monitor

### D6Sectoral Watch8 sub-modules5 claimsAmber▾#

Health and telecoms/eprivacy overlays are actively evidenced; other sectoral overlays (financial, employment, education, insurance) lack direct 2026 sourcing in this pass and are flagged as gaps.

Primary framework GDPR (Regulation (EU) 2016/679) with sector-specific overlays (ePrivacy Directive 2002/58/EC)

Supervisory authority [National DPAs (e.g. CNIL for health-data enforcement)](https://www.cnil.fr/en/investigation-powers-cnil/sanctions-issued-cnil)

Traffic-light rationale — Amber Health and telecoms/eprivacy overlays are actively evidenced; other sectoral overlays (financial, employment, education, insurance) lack direct 2026 sourcing in this pass and are flagged as gaps.

#### Sub-modules (8)

#### Data Access SharingNot assessed

No narrative recorded for this sub-module.

Claims (2):

- EU Data Act Art. 29 prohibits: From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process; until that date, only cost-covering reduced switching charges are permitted.
- EU Data Act (data access by design) requires: The Data Act's data-access-by-design obligation for connected products and related services applies from 12 September 2026, forward-looking only.

Category narrative 241 words

Across the EEA, horizontal GDPR obligations intersect with dense EU sectoral regulations and national opening-clause laws. In financial services, DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025), PSD2 (and the incoming PSR/PSD3 package), and the AML Regulation (EU) 2024/1624 require strict ICT incident reporting, fraud-monitoring data governance, and AML retention reconciled with GDPR data minimisation (per EDPB Guidelines on PSD2/AML interplay). In health and life sciences, Regulation (EU) 2025/327 establishing the European Health Data Space (EHDS) was adopted on 11 February 2025 and entered into force on 26 March 2025 (with phased application from March 2027 to 2031), creating harmonised primary patient electronic health record rights and a permit-based secondary health-data research framework across all Member States alongside Art. 9(4) national laws. Electronic communications remain governed by Directive 2002/58/EC (ePrivacy Directive) and national transpositions following the Commission's February 2025 withdrawal of the proposed ePrivacy Regulation. Employment data is governed by Art. 88 GDPR national rules (such as § 26 BDSG in Germany as interpreted in CJEU Case C-34/21 and Case C-65/23 MK v K GmbH of 19 December 2024, confirming national collective agreements and laws must still satisfy every substantive Art. 5/6 GDPR condition) and the Platform Work Directive (EU) 2024/2831 (enacted October 2024, prohibiting processing of platform workers' emotional state, private conversations, and off-duty data). Credit scoring is tightly constrained by CJEU Case C-634/21 SCHUFA Holding (7 December 2023) and Case C-203/22 Dun & Bradstreet Austria (27 February 2025).

Evidence 5

Sources and claims (5)
- Confirmed[CNIL](https://www.cnil.fr/en/investigation-powers-cnil/sanctions-issued-cnil) — CNIL imposed a €5 million fine against IQVIA in connection with health-data processing, evidencing active French enforcement in the health sector.observed 2026-08-05
- Confirmedunavailable — The Digital Omnibus proposes amendments to the ePrivacy Directive including limited additional derogations to the general prohibition on storing or accessing data in terminal equipment, which the EDPB/EDPS urge be balanced by incentivising contextual over behavioural advertising.
- Confirmed[Medical Law Review / NCBI PMC](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11347939/) — In December 2023, the CJEU issued its first interpretation of Article 22 GDPR (right not to be subject to solely automated decision-making) in the context of automated credit scoring (Case C-634/21, SCHUFA).observed 2026-08-05
- Probableunavailable — EU Data Act Art. 29 prohibits: From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process; until that date, only cost-covering reduced switching charges are permitted.
- Probableunavailable — EU Data Act (data access by design) requires: The Data Act's data-access-by-design obligation for connected products and related services applies from 12 September 2026, forward-looking only.