4th European Health Data Protection Congress

Congress opening

Opening remarks and strategic outlook on the future of health data governance in Europe and globally.

Opening Pierre-Yves Lastic, EFDPO / EHDPC Secretary General; EHDPC Chairman France

Revolution or evolution in health data protection?

Focus · Guidelines 1/2026 on the processing of personal data for scientific research purposes

The health data ecosystem is undergoing unprecedented transformation. New regulations, technological breakthroughs and increasing societal expectations are reshaping the way organisations collect, share and protect health information.

This session will examine whether Europe is witnessing a regulatory revolution or a natural evolution of existing governance models, and what this means for healthcare organisations, researchers and innovators.

Introductory presentations (30 min) followed by a 45-minute panel discussion.

Co-chair Pierre-Yves Lastic, EFDPO / EHDPC Secretary General; EHDPC Chairman France

Co-chair Giuseppe D’Acquisto, Garante (Italian DPA) Senior Technology Policy Adviser Italy

OL Keynote Owe Langfeldt, European Commission, DG SANTE Policy Officer, Digital Health Unit Belgium

DS Panellist Donovan Sheppard, UCB Head of Data Protection Advisory & Global DPO Belgium

SM Panellist Sarah Maalej, Aix-Marseille Université Data law counsel, CEDRE project France

The Biotech Act and Europe’s innovation agenda

Europe’s ambition to remain globally competitive in life sciences depends on its ability to foster innovation while ensuring robust safeguards for patients and citizens.

This session will explore how the Biotech Act may influence research, investment, innovation and international competitiveness within the healthcare and pharmaceutical sectors.

Introductory presentation followed by a panel discussion.

Co-chair Kristof Van Quathem, Covington & Burling Of Counsel Belgium

KW Co-chair Martha Siemaszko, Data Privacy, Digital AI, Novartis (PL) Global Operations Director Germany

Keynote European Data Protection Board

Panellist Industry & biotech

Panellist Academic research

Panellist Hospital representative

The Digital Omnibus

The Digital Omnibus package reopens parts of the European digital rulebook, from AI Act deadlines to transparency obligations. This session unpacks what changes, what stays, and what health data controllers should be doing now.

Introductory presentations (15 min) followed by a 45-minute panel discussion.

Co-chair Anastasia Negrouk, MyData-Trust COO & DPO Belgium

Keynote European Commission

Panellist Natalie Stockmann, Ascensia Diabetes Care Data Protection Officer, PHC Group Europe Natalie is Data Protection Officer for the European companies in the PHC Group, including Ascensia Diabetes Care. In this role, Natalie heads the Data Privacy Office and advises on data-, AI- and cybersecurity related legal and policy matters globally (outside Japan). Prior to joining, she was Data Protection Officer and General Counsel at a tech scale-up.

Panellist Nathalie Poupaert, Fieldfisher Counsel, Technology & Data Belgium

To record or not to record: that is the question

Consultation recording, ambient scribes and clinical documentation tools are spreading faster than the guidance that governs them. Supervisory authorities, platform providers and practising clinicians compare positions.

Regulatory data protection sandboxes: how they work and what organisations gain from them

What exactly is a regulatory data protection sandbox, how does the process run, and what are the benefits for a company or a healthcare institution taking part in one?

• Legal framework of a regulatory data protection sandbox
• Data protection sandboxes in Europe — overview and comparison
• How the LfDI Rheinland-Pfalz sandbox works, step by step
• First participants in the health area

Interactive segment: what does the audience expect from a sandbox? Which innovations would you submit — or did you shelve because of data protection uncertainty?

Chair Nils G. Indahl, Norwegian Association of DPOs Chair; DPO, Church of Norway Norway Nils G. Indahl is chair of the Norwegian Association of Data Protection Officers and DPO of the Church of Norway. He holds a M.Sc. degree in political science from the University of Copenhagen.

Speaker Erik Boucher, CNIL Senior health expert engineer France Erik Boucher de Crèvecoeur is an information technology expert at the CNIL, the French data protection authority. With nearly 30 years of experience in software development, quality and security management, he is currently involved in the compliance checking of personal data processing for the French Health Sector, subject to authorization by the CNIL. As a representative of the CNIL, he also takes part in several working groups in charge of defining national data protection frameworks, as well as international standards for privacy management, such as ISO/IEC 27701.

Speaker Elisabeth Herzog, LfDI Rheinland-Pfalz Research Associate, Data Protection Sandbox Germany Elisabeth Herzog studied at the universities of Trier and Bergen. Since 2021, she is a PhD student at Göttingen University, writing about “Access to Health Data in Germany, Norway and under the EHDS”, for which she also spent time at the University of Bergen as a guest researcher. Following placements at Göttingen University and a law firm in Frankfurt am Main, she has been working for the project “Die Datenschutz-Sandbox” at the Authority for Data Protection and Freedom of Information Rhineland-Palatinate since 2025.

Speaker Dr Dieter Kugelmann, LfDI Rheinland-Pfalz State Commissioner for Data Protection Germany Prof. Dr. Dieter Kugelmann studied at the universities of Mainz and Dijon. After his Pd.D. in European media law he qualified at the university of Mainz. He is author of numerous publications especially on European fundamental rights, European law, media law, security law and data protection law. In 2008 he became a fully tenured professor at the German Police University with a specialization for public law with a focus on police law including international and European Law. In 2015 he was elected for President of the Authority for the protection of data and the freedom of information of Rhineland-Palatinate and in 2023 he was re-elected for a second term. He is the editor of a commentary on the data protection law of Rhineland-Palatinate and co-editor of a commentary on the GDPR.

Speaker Rafal Yeisen, Helse Stavanger HF Data Protection Officer Norway

Striking the right balance: don’t throw the baby out with the bath water

Ensuring privacy regulation achieves its purpose without holding back innovation and treatment

This session brings together privacy leaders in the life sciences industry and data protection authorities to consider the evolving regulatory landscape, including EU regulations such as the EHDS, the AI Act, the GDPR and MDR/IVDR. Panellists will address regulatory complexity, and how companies and regulators can partner to achieve shared goals by building trust and enabling responsible data use.

Industry leaders will also discuss why internal partnerships with senior management and IT leaders are essential in navigating regulatory requirements while committing to a strategy that embraces innovation and competition. Panellists will share lessons learned, including case studies from the pharmaceutical and medical technology industries where regulation either created barriers to treatment and best practice, or achieved a healthy balance.

Chair Mary Devlin Capizzi, Faegre Drinker Partner United States Mary Devlin Capizzi is a partner at the law firm of Faegre Drinker Biddle & Reath and based in Washington, DC. Mary has nearly three decades of experience building relationships at the intersection of law, regulation, science, and policy, advising pharmaceutical, biotechnology, medical device, and consumer health clients on complex compliance, legislative, scientific, and agency-facing matters. She currently serves Faegre Drinker as the leader of its global life sciences consortia management team and has held numerous firm leadership roles over her career, including as a longtime firm Board member, an executive partner, and co-leader of the firm’s health and life sciences sector. For almost 30 years, Mary has partnered with industry leaders to establish and operate pre-competitive collaborative initiatives on a wide range of topics, including data governance, cyber security, AI and federated learning, innovation in drug development, supply chain security, patient safety, product quality, clinical trials, and data sharing. Mary enjoys solving complex problems collaboratively. She and the consortia management team proactively align industry leaders around shared goals, maintain rigorous, efficient coordination among stakeholders, and build and sustain trust to ensure flourishing of industry initiatives and achieving identified objectives. Mary, along with her colleague, Peter Blenkinsop, worked with global industry leaders to establish the International Pharmaceutical and Medical Device Privacy Consortium (IPMPC) in 2001–2002. Mary received her law degree from Emory University School of Law in Atlanta, Georgia, her BA, and MBA from the University of Dallas, in Irving, Texas. She is a fluent Spanish speaker who has lived and worked in Spain, France, Italy and Mexico.

Panellist Dorotea Alessandra De Marco, Garante (Italian DPA) Senior Officer, Digital Technologies & IT Security Italy Dorotea Alessandra de Marco Senior official at the Italian Data Protection Authority since 2014 within the Digital technology and IT security department. Her role includes providing technical consultancy to the legal Departments regarding complaints, inspections on lawfulness and security measures of data processing, data breaches, prescriptions and opinions with a focus on personal data protection in the health sector. She is in charge of any activity related to accreditation, certification and code of conduct under the GDPR. She has been appointed expert in the international, european and national standardization bodies (ISO/IEC JTC 1/SC 27/WG 5 “Information technology - Security techniques - Identity management and privacy technologies”, former ISO PC 317 “Consumer protection - Privacy by design for consumer goods and services”, CEN/CENELEC JTC 13/WG5 “Privacy management in products and services”) and she is also involved in the development of many privacy standards. She worked for the Ministry of Health, IT Division (2004-2013), Ministry of Economic Development, IT division (2000-2004) and Telecom Italia, Network Division (1995-2000). She is an electronic engineer and graduated at “Tor Vergata” University of Rome, she also achieved a Master's Degree in Telecommunications from the High School of Specialization in Telecommunications.

DS Panellist Donovan Sheppard, UCB Head of Data Protection Advisory & Global DPO Belgium

Panellist Data protection authority

EHDS: never-ending story — are we any closer?

With implementation approaching, organisations across Europe are asking the same question: are we truly ready for the European Health Data Space?

The European Commission speaker will give a reminder of the current situation and an update on the latest developments. Together with health data holders, health data users from academia and the life sciences, and patient representatives, the session will assess implementation progress, operational readiness and the challenges facing healthcare institutions.

Chair Dipak Kalra, i~HD President United Kingdom

Speaker Guillaume Byk, European Commission · DG Health Legal and Policy Officer · Unit C1 Digital Health Guillaume Byk is a legal and policy officer at the European Commission, DG Health, Unit C1 on Digital Health. He is a lawyer specialised in data protection and biomedical law. Prior to joining DG Health, Guillaume worked at the office of the European Data Protection Supervisor and at the national data protection authority of Luxembourg on the implementation of the GDPR. Previously, he worked for more than 10 years as a data protection officer and legal counsel in a public biomedical research centre in Luxembourg.

Speaker Yacine Daquin, Health Data Hub Head of Legal France Yacine Daquin is the Health Data Hub's head of legal. He is in charge of legal matters relating to the secondary use of healthcare data, both at national and European level. In particular, he supports the Health Data Hub's activities in prefiguring and preparing for the future European health data space. Previously, he pursued a PhD on the regulation of artificial intelligence in healthcare, investigating the legal and ethical issues associated with the design and deployment of these systems.

ST Speaker Dr Sofia Tsekeridou, Netcompany Senior Research & Innovation Manager Greece

Speaker Yann Heyer, European Patients’ Forum Policy Officer Belgium In his role as Policy Officer, Yann contributes to EPF’s policy and advocacy work, including formulating positions in consultation with patient organisations and engaging with external stakeholders. He covers mainly topics such as digital health and artificial intelligence. Yann is Franco-German and holds a Franco-German degree from Sciences Po Lille and the University of Münster.

Speaker Hospital DPO

Becoming EHDS ready: the operational roadmap

A European Commission update on the implementing acts and on progress across Member States, followed by a panel on what it actually takes to deliver.

Speakers each take a different perspective on one question: how should a DPO help their organisation get EHDS ready?

• Meeting the primary use obligations
• Acting as a data holder
• Acting as a data user
• Responding to the new rights of patients

Panel discussion: what operational steps deliver on the EHR obligations, what are the capacity-building challenges, and how can the costs be met?

Chair Nathan Lea, i~HD Data-driven health innovation, regulation and ethics expert

ST Speaker Dr Sofia Tsekeridou, Netcompany Senior Research & Innovation Manager Greece

Speaker CNIL EHDS specialist

Speaker To be announced

Artificial intelligence, global health data governance and the future of healthcare

A forward-looking keynote examining how AI, health data governance and international cooperation will shape healthcare systems over the next decade.

Keynote Eric Sutherland, OECD Senior Health Economist, Digital Health France Eric is a Senior Health Economist leading the OECD’s work in Digitalisation of Health, bringing together policy guidance for digital security, integrated data, and responsible analytics including artificial intelligence. In that role, he is accountable for measuring and evolving the OECD’s Recommendation on Health Data Governance (2016) and supporting policy for digitalisation of health that provides data protection (e.g. security and privacy) and timely access to quality data to optimize the use of data for information, insights, and impact among individuals, health workers, policy makers, researchers, and innovators.