Bringing Data Autonomy and Digital Sovereignty to the European Health Data Space

Abstract

The European Health Data Space (EHDS), established by Regulation (EU) 2025/327, represents the EU’s most ambitious attempt to enable secondary use of health data across Member States while safeguarding individual rights. Yet the EHDS is fundamentally a data access framework: it enables institutional intermediaries to govern the flow of health data to researchers and policymakers, without by itself satisfying the more demanding standard of data autonomy and digital sovereignty as developed in recent scholarship. This article develops a normative framework for evaluating the governance conditions under which the EHDS can be said to deliver genuine data autonomy rather than formal compliance with it. Drawing on theories of data autonomy, cybernetic governance, and digital identity infrastructure, the article argues that data autonomy at individual, regional, and European levels requires four governance conditions: layered data sensitivity assessment, institutional locality, controlled data mobility, and substantive democratic accountability. It then derives from these conditions a concrete institutional proposal‚ the enhanced Health Data Access Body (HDAB)‚that can be implemented under existing EHDS law through the sub-national designation mechanism of Article 55 of the Regulation, requiring no primary legislative change. The enhanced HDAB architecture, combined with a 3-tiered data governance framework constitutes the minimum institutional design for a genuinely data autonomous and digitally sovereign European health data space, including for non-anonymisable data categories such as genomic data and human digital twins.