D7.2: In-depth legal and ethical study

This deliverable examines the legal, regulatory, and ethical frameworks relevant to the HEREDITARY project, building on the preliminary assessment provided in D7.1. HEREDITARY develops a federated, interoperable, and privacy-preserving framework for the integration and analysis of multimodal health data, including clinical, genomic, imaging, and environmental data, through federated learning, federated analytics, and citizen science approaches.

The deliverable assesses the relevance of the principal EU regulatory frameworks applicable to HEREDITARY, including the General Data Protection Regulation (GDPR), the European Health Data Space (EHDS), the Data Governance Act (DGA), the Artificial Intelligence Act (AI Act), and the NIS2 Directive. Particular attention is given to issues such as governance arrangements, processing of sensitive health data, interoperability, cross-border data access, cybersecurity, and the use of AI in biomedical research environments.

To improve readability and focus the main body on project-specific implications, detailed legal analysis is provided in Annex 1, detailed ethical analysis in Annex 2, and a case-specific assessment of the principal HEREDITARY use cases in Annex 3. Together, these analyses illustrate how the applicable legal, regulatory, technical, and ethical requirements apply to the HEREDITARY architecture, governance model, and research workflows.

The findings provide the basis for the final phase of WP7, which will focus on identifying remaining regulatory and ethical gaps and developing recommendations for the compliant, trustworthy, and sustainable implementation of the HEREDITARY framework.