Health Data Under Pressure: US Legislative Shifts, AI Privacy Risks and EU Cloud Sovereignty Disputes | Weekly Digest

1. US Legislative and Regulatory Upheaval: Health Data Protections and the FTC's Future

Two developments this week fundamentally alter the US regulatory landscape for health data: a proposed federal ban on data broker sales of health and location information, and a Supreme Court ruling that may strip the Federal Trade Commission of its political independence. Together, they create material uncertainty for any organisation relying on the EU-US Data Privacy Framework (DPF) as a lawful transfer mechanism under the General Data Protection Regulation (GDPR), which is the EU Regulation 2016/679 governing the processing of personal data.

US Senator Introduces the Health and Location Data Protection Act

Representative Katie Scanlon's bipartisan Health and Location Data Protection Act, introduced on 1 July 2026, would prohibit data brokers from selling or transferring Americans' health and location data and would grant enforcement powers to the Federal Trade Commission (FTC), state attorneys general and private individuals. The bill proposes an allocation of USD 1 billion to the FTC over ten years for implementation, signalling a significant federal commitment to curbing the data broker economy. For life sciences companies that purchase real-world health data sets for research or commercial purposes, this legislation, if enacted, would require a fundamental review of data sourcing arrangements and vendor contracts.

Click to read more

Supreme Court Ruling Threatens FTC Independence and the EU-US Data Privacy Framework

In a 6-3 decision issued in late June 2026, the US Supreme Court held that the President may dismiss FTC commissioners at will, overturning the longstanding precedent established in Humphrey's Executor v. United States and endorsing the so-called unitary executive theory, which holds that the President must retain direct control over all executive officers. This ruling places the political independence of the FTC in serious jeopardy. Because the EU-US Data Privacy Framework (DPF), the adequacy decision adopted by the European Commission in July 2023 to permit personal data flows from the EU to the US, relies in part on the FTC's capacity to act as an independent enforcement body, this judgment raises a credible risk that the European Court of Justice could revisit the DPF's adequacy status in proceedings that commentators are already calling a potential Schrems III. EU-based sponsors and healthtech companies transferring personal data to US processors should urgently review whether supplementary safeguards such as Standard Contractual Clauses (SCCs) are in place as a contingency.

Click to read more

2. AI in Healthcare: Membership Inference Risks and Clinical Trial Data Integrity

Medical Diagnosis AIs Vulnerable to Membership Inference Attacks

Research reported by The Register on 26 June 2026 demonstrates that medical diagnosis AI models are highly susceptible to membership inference attacks, a technique whereby an adversary determines whether a specific individual's data was used to train a model, using only partial medical information as an input. The vulnerability is more pronounced for under-represented or sensitive demographic groups, and risk increases with larger or more specific data sets. Under GDPR Article 35, controllers deploying such models are required to conduct a Data Protection Impact Assessment (DPIA), which is a structured analysis of the risks that a processing activity poses to individuals' rights and freedoms; the findings from this research suggest that existing DPIAs for medical AI systems may be materially underestimating re-identification risk and should be reviewed and updated accordingly.

Click to read more

Data Flow Integrity in AI-Assisted Clinical Trials

An analysis published by Clinical Leader on 26 June 2026 sets out how AI tools expand data integrity obligations across the entire clinical trial lifecycle, from protocol design through to submission. Sponsors must ensure end-to-end governance, provenance and traceability of source data, derived data and AI-generated outputs in line with the ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring and Available) as well as FDA and ICH expectations. Critically, these obligations extend to Contract Research Organisations (CROs) and other vendors acting as data processors, meaning that data processing agreements must explicitly address AI tool validation, human oversight requirements and audit trail preservation.

Click to read more

3. Healthcare Vendor Breaches: A Growing Compliance Emergency

Analysis of data published by the US Department of Health and Human Services Office for Civil Rights (OCR) shows that business associates, defined under the Health Insurance Portability and Accountability Act (HIPAA) as third parties that handle protected health information on behalf of covered entities, were involved in 34% of reported healthcare breaches between 2018 and 2026, rising sharply from an average of 20% during the period 2009 to 2017. In the first half of 2026 alone, that figure reached 43%. Vendors are attractive targets because they frequently hold large volumes of protected health information and may provide access to multiple covered entities simultaneously. For EU-based organisations, this pattern reinforces the imperative to conduct robust due diligence on processors under GDPR Article 28 and to include specific breach notification obligations and audit rights in all data processing agreements.

Click to read more

4. EU Cloud Sovereignty: French Healthtech Challenges SecNumCloud Orthodoxy

Five major French healthtech scale-ups, namely Alan, Doctolib, Implicity, Lifen and Resilience, have publicly challenged the French government's insistence on SecNumCloud, the French National Cybersecurity Agency (ANSSI) cloud security certification scheme, as the default or sole acceptable standard for sensitive health data. As reported by Les Echos on 29 June 2026, the companies are calling for a risk-based approach incorporating audits and a graduated sovereignty score, arguing that the current framework is commercially unworkable and disproportionate. The French government and security advocates maintain that SecNumCloud provides protections against third-country government access that lower-tier certifications do not. Health data controllers operating in France should monitor this debate closely, as any revision to SecNumCloud policy could alter the lawfulness of existing cloud processing arrangements under the French Health Data Hub framework.

Click to read more

‍

‍