This collection examines data protection, health research and data access in Switzerland and the EU. Other articles cover cloud contracts, international transfers, clinical trial consent and the interaction between Swiss professional secrecy and foreign disclosure requests.
These articles provide general information and are not legal advice.
The European Health Data Space compels holders to make health data available through health data access bodies, from 2029 for general records and 2031 for genomic and clinical-trial data; a US biotech's EU subsidiary may itself be a holder.
Findata admits foreign sponsors to Finnish registry data for real-world evidence, but the analysis stays in a secure environment in the EU or EEA, and a login by the sponsor's US staff is a data transfer. The European Health Data Space rewrites the terms from 2029.
The EU Data Act has applied since 12 September 2025 to any provider serving Union customers, wherever established, and its switching, access and unfair-terms rules override much of what standard US cloud and Internet of Things (IoT) contracts still say.
The EU-US Data Privacy Framework rests on the independence of three American institutions, and the 2026 Supreme Court ruling on at-will removal of Federal Trade Commission members unsettles that premise for companies that retired their standard contractual clauses.
The Digital Omnibus would make the GDPR's personal-data definition relative to the holder, put AI training on an express legitimate-interest footing, and route cookie consent into a new Art. 88a GDPR. None of it is yet law.
The EU Digital Omnibus moves at two speeds: an adopted AI Act track defers high-risk deadlines to December 2027 and August 2028, while the GDPR, ePrivacy and Data Act rewrite remains an unagreed proposal.
A trial with EU and Swiss sites must satisfy both the GDPR and the Swiss data protection act (DSG). Consent to take part in a trial is not the same as consent to process the data, and whether Swiss trial consent meets the DSG for health data remained unsettled as of September 2025.
One informed-consent form under the Swiss human research act (HFG) does not automatically discharge the duties the data protection act (DSG) attaches to the same sensitive health data. For US sponsors, the open question surfaces in protocol design and site contracts, not during the trial.
The Swiss data protection act (DSG) attaches to the data category, not the entity holding it. A US health-SaaS or digital-therapeutics vendor mapped for HIPAA and the GDPR may still have to designate a Swiss representative, and the DSG's criminal fines fall on named individuals.
A US CLOUD Act order can reach data a US provider controls wherever it is stored, and complying may breach Art. 271 of the Swiss criminal code (StGB), the ban on unauthorized official acts for a foreign state. A choice-of-law clause displaces neither the Swiss data protection act nor the GDPR.
Art. 321 of the Swiss criminal code (StGB) makes revealing professional secrets a crime and Art. 271 StGB restricts gathering evidence in Switzerland for foreign proceedings, but a US court may sanction a refusal to produce. In-house counsel's protection turns on pre-dispute choices.
A US company may need a Swiss data-protection representative even if it already has one in the EU. The Swiss duty turns on separate conditions, including gross risk, and the mandate carries its own register and contact functions.
Pseudonymized health data can have different legal status for a warehouse and its licensee. The IQVIA fine, SRB judgment and draft EDPB guidance show why anonymity warranties, lawful collection and transfer responsibilities require separate assessments.
For in-scope medical-device units placed in the EU after 12 September 2026, the Data Act adds access-by-design duties. MDR change control and separate GDPR requirements can constrain how a manufacturer provides that access.
For advice on a particular matter, please get in touch.
Make an enquiry