• access to health data
• brain-computer interfaces
• european health data spaces

This thesis examines the legal challenges faced by companies developing brain–computer interfaces (BCIs) in obtaining access to health data in the European Union. Neural and clinical datasets are indispensable for training therapeutic and assistive BCIs, yet under the General Data Protection Regulation they fall within the strictest category of protected personal data. Current access pathways rely on Article 9(2)(j) GDPR research exemptions and fragmented national ethics approvals, which are sufficient for small-scale projects but impracticable for the volumes of data required to train modern BCI systems.
A comparative analysis shows how this framework places European innovators at a disadvantage. US firms such as Neuralink have progressed quickly from FDA investigational approvals to first-in-human trials, supported by a more permissive and centralised approach to clinical data access. By contrast, European companies like INBRAIN Neuroelectronics have advanced through hospital partnerships and ethics approvals but without harmonised channels, slowing iteration and limiting scale.
The European Health Data Space Regulation adopted in 2025 offers a more structured system for secondary use of health data, but its gradual implementation means that BCI companies will not benefit fully until 2028–2030. To bridge this gap and to provide a long-term solution, this thesis proposes a functional data provision for BCIs within the EHDS. Hospitals would be required to channel pseudonymised neural and clinical datasets to Health Data Access Bodies, which would authorise access for therapeutic and assistive BCIs under strict safeguards, including trusted research environments and biannual independent audits.
The conclusion is that such a mechanism would reconcile Europe’s commitment to fundamental rights with the urgent need to enable neurotechnology innovation, ensuring that patients and society benefit while preserving privacy and dignity.