1.1 Health AI is lucrative – but data are hard to get

AI systems, particularly those developed for health-related applications, rely on vast quantities of high-quality personal health data. These data are essential for training, testing and validating AI models. The need for such data has only intensified with the global push toward digital health solutions such as AI-powered diagnostic tools and medical chatbots. AI in health is a lucrative field. As a result, both public institutions and private companies are investing heavily in the development of health AI. However, access to such data is highly constrained within the EU due to technical, commercial and legal barriers.

First, technical barriers include the fragmentation and lack of interoperability between health data systems in EU Member States. Electronic health records (EHRs) are often held in different formats and maintained by a range of public and private actors with inconsistent standards and varying access policies (Stegemann and Gersch Reference Stegemann and Gersch2019). The European Commission has attempted to remedy this through the European Health Data Space (EHDS), but progress remains slow and stakeholders are sceptical about its technical feasibility (Marelli et al. Reference Marelli2023). Second, commercial barriers arise because health data is a valuable asset. Obtaining data directly from medical records or medical questionnaires is time-consuming and costly. Large health datasets are often held by hospitals, insurers or private companies who are reluctant to share them without high compensation. The scarcity of freely available, high-quality health datasets contributes to rising costs for data acquisition (Raab et al. Reference Raab2023).

Third, and most importantly, there are legal constraints to the collection of personal health data. The GDPR, in force since 2018, plays a central role. It applies to all types of personal data, regardless of sector, and is fully binding and directly applicable across the EU (Articles 1–3). The GDPR requires every instance of personal data processing to be underpinned by a legal basis (Article 6), and provides individuals with several rights, such as the right to information, the right to access and the right to withdraw consent (Articles 7(3) and 12–15). Similarly, it imposes duties on data processors and controllers, and confers rights on data subjects to increase their control (Chapter III). Notably, the GDPR qualifies health data as ‘sensitive’ personal data; Article 4(15) states: ‘personal data related to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about his or her health status’. This definition is explicitly broader than personal data obtained in the medical sphere.Footnote ⁵ The GDPR stipulates a general prohibition on the processing of health data, while providing for limited derogations (Article 9). In short, in the EU, the collection, processing and sharing of personal data to develop AI technology are bound to strict conditions (e.g. based on informed consent or in the public interest) and safeguards (e.g. protection of data subjects’ rights). Therefore, not all actors in search of personal data to develop AI systems are able or willing to obtain enough high-quality data.

These constraints also intersect with the EU AI Act, which entered into force in August 2024. The AI Act stipulates the legal framework for the development, the placing on the market, the putting into service and the use of AI systems in the EU. Its objective is to foster innovation by harmonising the market, while simultaneously offering protection to fundamental rights (van Kolfschooten Reference van Kolfschooten2022a). The AI Act imposes further requirements on the development of high-risk AI systems, which include most medical AI. For instance, developers must ensure the use of high-quality datasets that are representative, free of errors and biases and relevant to the intended use. Finally, the EU Medical Devices Regulation (MDR) sets strict requirements for the quality and safety of AI-based medical devices (van Kolfschooten 2022b, 2023). As a result, companies increasingly consider LMICs to meet their data demands. While the AI Act includes provisions to prevent circumvention of EU rules – applying extra-territorially to providers and deployers of AI systems established outside the Union where the output is intended to be used in the EU (Recitals 21–22; Article 2(1)) – these safeguards do not prevent the use of personal data collected under weak or absent protections abroad.

1.2 The price of AI: from regulatory avoidance to data colonialism

Together, these technical, commercial and legal hurdles may create incentives for AI developers to seek data elsewhere. Indeed, evidence is growing that Big Tech companies are turning to LMICs, particularly in sub-Saharan Africa, where large and diverse populations offer valuable data sources, and data protection regimes are often less stringent or poorly enforced. Africa has even been described as a ‘data goldmine’. This section outlines three interrelated activities that demonstrate how these incentives play out in practice. While the third activity – large-scale extraction of personal data – most directly supports the argument that strict EU regulation pushes health data collection for AI system development abroad, the first two illustrate broader patterns of technological dependency and epistemic injustice in relation to data collection.

First, Big Tech companies are building digital infrastructures in LMICs, often framed as philanthropic initiatives to expand Internet access and digital inclusion. In reality, these projects serve as entry points for datafication and establish long-term dependencies (Magalhães and Couldry Reference Magalhães and Couldry2021). In 2013, Mark Zuckerberg published a paper titled ‘Is connectivity a human right?’ – presenting Facebook’s philanthropic mission to ensure worldwide Internet access (Zuckerberg Reference Zuckerberg2013). Indeed, in 2016, Facebook launched a ‘Free Basics platform’ in over twenty African countries, in partnership with local telecoms operators. This platform provided users with free access to a list of websites (Nothias Reference Nothias2020). In the same vein, in 2018, Google collaborated with a local cable company in Lagos, Nigeria, to launch a network of free Wi-Fi hotspots in Nigeria (Oyedemi Reference Oyedemi2021). Both Google and Meta are working on undersea cables to further connect the African continent to the Internet (Browne Reference Browne2020). However, it has been argued that these datafication projects in LMICs do not actually do social good – but are mainly undertaken in the interest of the profitable good (Magalhães and Couldry Reference Magalhães and Couldry2021). At the same time, there has been a recent surge in the building of data centres on the African continent, often with the help of international loans (Soulé Reference Soulé2024). The establishment of digital infrastructures in Africa by foreign actors can cause dependency and may limit local innovation and control over digital infrastructure (Birhane Reference Birhane2020). While this infrastructuring may not result directly from EU regulation, it lays the groundwork for the exploitative data practices discussed below.

Second, there is a growing trend of AI technologies developed in HICs being exported to LMICs, often without adequate contextual adaptation or local innovation capacity. For example, empirical research shows that more technology-advanced States, such as Nigeria, mainly import their technological products from HICs. This is problematic for numerous reasons. First, these AI models do not necessarily address the critical issues experienced on the African continent, as the context in which the tools are deployed matters (Arun Reference Arun, Dubber, Pasquale and Das2020). Second, if designed to work for people living in HICs in the Global North, these tools do not necessarily function as well for populations in LMICs. Research shows that patterns of health inequality and discrimination are deeply embedded in most AI systems (Leslie et al. Reference Leslie2021). Most of the time, medical AI is developed for high-resource settings in HICs, and does not take into account the different deployment contexts in LMICs, for example, regarding varying population groups, diseases, available resources or digital education. For example, research on breast cancer detection technology shows that the same tool was less effective in sub-Saharan Africa than in HICs (Black and Richmond Reference Black and Richmond2019); African AI researchers often critique the lack of ‘African context’ in research on AI (Cisse Reference Cisse2018; Hassan Reference Hassan2023; Wairegi et al. Reference Wairegi, Omino and Rutenberg2021). On top of that, AI systems often mimic existing stereotypes, prejudices and discriminatory practices linked with ethnicity, gender and socio-economic status (van Kolfschooten Reference van Kolfschooten2025). These biases in the choices for the development, design and deployment of medical AI eventually augment global health inequity (Owoyemi et al. Reference Owoyemi, Owoyemi, Osiyemi and Boyd2020). Finally, importing AI tools hinders the development of local tech products, and thus obstructs innovation (Birhane Reference Birhane2020; Ruttkamp-Bloem Reference Ruttkamp-Bloem, Eke, Wakunuma and Akintoye2023). Although not a direct consequence of EU digital regulation, these practices reveal how structural inequities in AI development and deployment align with, and are reinforced by, the data collection strategies addressed in the next section.

Third, and most directly relevant to the EU’s regulatory impact, are practices of large-scale personal data extraction in LMICs, named by Floridi (Reference Floridi2019) as ‘digital ethics dumping’. These involve transferring data collection activities that would not be ethically permissible under the GDPR to jurisdictions with minimal legal oversight. International corporations and foreign governments harvest vast amounts of data from – mainly – African countries without informed consent, adequate compensation or benefit sharing. Indeed, Africans do not actually receive Internet services for free from Big Tech companies. The price Africans pay for this is their personal data, and thus their right to privacy. Tech companies collect personal data through online behavioural tracking technology – especially in countries in Africa with limited data protection legislation and/or enforcement – and count on the relative lack of digital literacy and privacy awareness (Nhemachena et al. Reference Nhemachena, Hlabangane and Kaundjua2020). Personal data are sold for health analytics or targeted advertisement. Foreign tech companies also provide governments in Africa with free access to AI and other technology solutions, in exchange for access to local citizens’ data (Calzati Reference Calzati2022; Odero Reference Odero2024; Soulé Reference Soulé2024). Given its need for large amounts of data, AI and its growing use may lead to further exploitation of populations in vulnerable positions, due to lack of oversight or regulation.

Practices surrounding the collection, sharing and analysis of data from LMICs by Big Tech companies have been problematised by numerous scholars (Coleman Reference Coleman2018). Comparable to traditional patterns of colonialism, these practices see Big Tech companies in Africa exploit their powers by extorting personal data from individuals (Abebe et al. Reference Abebe2021). Applied to data collection, the concept of data colonialism critiques how data and digital technologies are deployed in ways that mimic colonial practices, often extracting value from the continent and its peoples, without equitable return or respect for their sovereignty and rights. In many cases, the local community lacks the capacity to access their own personal data and thus misses out on potential economic benefits. At the same time, ‘global’ AI ethics instruments, such as the OECD’s AI Principles, the UNESCO Recommendation on the Ethics of AI and the G7 Hiroshima Process International Guiding Principles for Advanced AI Systems, do not consider the African context, imposing ‘Western’ values on the African continent, for example in relation to privacy and data protection (Corrêa et al. Reference Corrêa2023; Gwagwa et al. Reference Gwagwa, Kazim and Hilliard2022). In turn, this lack of fair distribution of benefits amplifies global health inequity. It has been argued that this extraction of personal data is similar to historical colonial extractions of resources (Coleman Reference Coleman2018).

In the domain of health AI development, there is growing concern that personal data collected in LMICs – often without individuals’ knowledge, informed consent or fair compensation – may be used to train algorithms commercialised in HICs. While the full scope of these practices remains difficult to trace due to the opacity of AI development pipelines and proprietary data-sharing agreements, research consistently shows large-scale health data collection in LMICs (Abebe et al. Reference Abebe2021; Coleman Reference Coleman2018; Nhemachena et al. Reference Nhemachena, Hlabangane and Kaundjua2020). These dynamics raise particular concern in the context of AI, where large and diverse datasets are needed to develop systems for diagnosis, triage or health monitoring. As demand for such data increases – and as EU regulations like the GDPR and the AI Act place stricter limits on data collection within Europe – the risk of digital ethics dumping is likely to grow. The current EU legal framework does not directly constrain these practices.

1.3 Limited restraints on obtaining personal data abroad

While Sections 2.1 and 2.2 have shown how regulatory, technical and commercial constraints within the EU incentivise the outsourcing of data collection to countries in the Global South, this section turns to the legal frameworks that fail to restrain such outsourcing. Specifically, the GDPR, AI Act and MDR – while strict in their application within the EU – provide no meaningful safeguards for how personal data is sourced from LMICs for the development of AI systems.

First, the GDPR applies primarily to personal data processing in the context of the activities of an establishment in the EU (Article 3(1)), and to data processing related to the offering of goods or services to, or the monitoring of, individuals in the EU (Article 3(2)). It does not extend to the processing of personal data relating to individuals outside the EU, unless those individuals are being specifically targeted. As a result, the GDPR’s strong safeguards, including lawful grounds for processing (Article 6), the prohibition on processing special categories of data including health data (Article 9(1)) and the requirement for explicit consent (Article 9(2)(a)), do not apply to the collection and use of health data from LMICs when EU residents are not involved. This legal gap allows EU-based developers to train AI models using personal data from non-EU contexts without being bound by the GDPR’s protections, as long as their processing activities do not fall within the Regulation’s territorial scope.

Second, the AI Act imposes detailed obligations on developers of AI systems that are placed on the EU market or used in the EU (Article 2(1)), including those developed outside the EU. High-risk AI systems – which include many health-related applications (see Annex III and, in the case of medical devices, Article 6(1); van Kolfschooten Reference van Kolfschooten2022a) – must meet strict requirements regarding risk management (Article 9), data governance and data quality (Article 10), transparency (Article 13) and human oversight (Article 14). Notably, Article 10(3) requires that training, validation and testing data sets be ‘relevant, representative, free of errors and complete’, but it does not address how the data must be obtained or whether it must be collected in an ethically sound or legally compliant manner abroad. Nor does the AI Act require disclosure of data origins or mechanisms for informed consent or benefit-sharing with non-EU data subjects. Although Recitals 21 and 22 and Article 2(1) of the AI Act extend the Regulation’s scope to providers and deployers established in third countries, this applies only when the AI output is intended to be used within the Union. The provision aims to prevent circumvention of EU rules and protect individuals located in the EU. However, it does not impose ethical standards for how data used to train the AI was sourced, nor does it extend protections to individuals outside the Union whose data may be used in training. Moreover, non-medical health-related AI systems (such as menstruation apps, symptom trackers and assisted living sensors) do not have to comply with the AI Act standards (van Kolfschooten 2022b, 2023).

Third, the MDRFootnote ⁶ governs medical devices placed on the EU market, including software using AI for medical purposes (Article 2(1) and Annex VIII, Rule 11). The MDR requires manufacturers to perform a clinical evaluation to demonstrate conformity with general safety and performance requirements (Articles 5(3), 10(3) and 61). Where clinical investigations are used, they must comply with the ethical principles of the Declaration of Helsinki (Article 62(4)(h)), and with Good Clinical Practice as detailed in Annex XV. However, these requirements are limited to clinical investigations (which not all AI medical devices require), and do not apply to personal data used outside a trial setting – such as data collected through digital health apps, third-party partnerships or observational studies. While medical AI is increasingly used as a health intervention, this regime is not nearly as strict as the EU’s legal framework regulating medicinal products (Albuquerque de Almeida and Ricardo Reference Albuquerque de Almeida and Ricardo2023). The MDR does not require access to the full training dataset used to develop an AI-based medical device – only a summary of safety and clinical performance (Article 32).

In sum, the EU legal framework does not directly prevent AI ethics dumping. As will be shown below, this is consistent with previous patterns in the conduct of clinical trials – where stringent regulations within the EU led to a practice of ethics dumping by EU pharmaceutical companies, which conducted clinical trials in LMICs with often comparatively limited (or at times absent) regulatory legislations.

2.1 Territorial extension of EU ethical standards through hard law

Joanne Scott’s conception of territorial extension offers a helpful lens to understand how EU legal and ethical standards shape conduct beyond the EU’s borders. Where EU regulations make compliance (and consequently, market entry) ‘conditional upon conduct or circumstances abroad’, this can be understood as giving rise to territorial extension of EU law outside the EU. For territorial extension to apply, two conditions must be met: first, the application of the regulation in question must be triggered by a territorial link, such as the import of pharmaceutical products into the EU; and second, assessing compliance with the regulation requires an evaluation of conduct undertaken abroad to determine whether EU (or EU-equivalent) standards have been met. (Scott 2014, 2020). This differs from extra-territorial application in which EU law explicitly applies to conduct outside the EU regardless of where the product or service is used. It also differs from the Brussels effect, where non-EU actors voluntarily adopt EU standards (Bradford Reference Bradford2020). EU regulations governing the conduct of clinical trials in non-EU countries are acknowledged as instances of territorial extension (Flear Reference Flear2014).

In 2001, the European Parliament and Council adopted Directive 2001/20/EC regarding the implementation of good clinical practice in the conduct of clinical trials on medicinal products for human use. Founded on the protection of human rights and human dignity codified in the Declaration of Helsinki (1996), Directive 2001/20/EC sought to protect trial participants in the European Community and third countries from ‘obsolete or repetitive tests’ by harmonising the technical requirements for product development in global fora, namely the International Conference on Harmonisation.Footnote ⁷ In other words, the European Community’s first binding law regarding the conduct of clinical trials flagged the need to regulate the ethical conduct of trials within and outside the Community; it then delegated the task of harmonised regulation to international fora, rather than taking it up in the binding law of the Community.

Only three years later did EU lawmakers use binding EU law on territorial extension to attempt to regulate the ethical conduct of some trials taking place outside the Union. EU lawmakers introduced the explicit requirement in Regulation 726/2004 (establishing the EMA) that any trial conducted outside the EU supporting an application for market approval of a new medicine for use within the Union must include a statement that Directive 2001/20/EC ethical requirements have been met.Footnote ⁸ Moreover, Regulation 726/2004 requires the EMA’s Committee on Human Medicinal Products (responsible for evaluating most market approval applications) to ‘seek guidance on important questions of a general scientific or ethical nature’.Footnote ⁹

For this purpose, the EMA adopted a guideline of ‘points to consider’ for Agency committees evaluating medicines tested outside Europe and seeking EU market approval. First, any evaluation of an EMA application ‘should ensure that these Good Clinical Practice (GCP) principles have been applied to all clinical trials submitted in the dossier’, regardless of where the trials were conducted (EMA Working Group on Clinical Trials conducted outside of the EU/EEA 2012, p. 34). Other points for consideration include the acceptability of ‘foreign data’ from a scientific perspective; ‘the conduct of the study and data reliability’; and the study design (e.g. use of placebos, comparators, informed consent).

There is a dearth of data regarding the global impact of the EU’s territorial extension of its binding norms for ethical trial conduct. EMA data on the authorisation of medicines for sale in the EU between 2005 and 2011 reveals that 27.8 per cent of clinical trials supporting EU market approval applications were conducted outside the EU/EEA/EFTA area and outside North America (EMA 2013, p. 9). Included in this group are 23,165 patients enrolled in 1,024 different investigator sites throughout the continent of Africa, in so-called ‘pivotal trials’, submitted to the EMA as part of a market approval application (EMA 2013, pp. 10, 12, 14). Therefore, it is reasonable to assume that the EU’s ethical requirements in Regulation 726/2004 have added an additional layer of rights protection to these trials’ participants outside the EU (Perehudoff Reference Perehudoff2024).

2.2 EU soft law framing global research norms

Later, European lawmakers took a complementary soft policy approach to introduce safeguards against ‘ethics dumping’, a term first coined by the European Commission in 2013, to describe the emerging practice of outsourcing or offshoring drug development, and specifically clinical trials, to LMICs to avoid strict regulatory regimes. The European Commission explains that research activities conducted outside the EU are particularly vulnerable:

More recently, the European Commission adopted a new Code of Conduct as a mandatory reference document for its Horizon 2020 projects to include clear guidelines to aid researchers in identifying and mitigating the sometimes unintentional and obscure instances of ethics violations (TRUST 2018).

As a rising global health actor, the EU expanded its soft policy approach in the field of research policy to avoid undermining the protection of participants in the offshoring of clinical trials (Petryna Reference Petryna2007). In 2018, the European Commission also proposed a global code of conduct for international research partnerships to counter ethics dumping. The Global Code of Conduct for Research in Resource-Poor Settings (later renamed ‘for Equitable Research Partnerships’) provides clear guidelines for research conduct between partners from the so-called Global North and Global South. The code was developed in collaboration with UNESCO, European academics and representatives from LMICs, as part of an EU Horizon 2020 project. DG Research and Innovation, the department of the European Commission responsible for EU policy on research, science and innovation, committed to proposing the Code as a reference document for funding applications to the (Trust Equitable Research Partnerships 2021).Footnote ¹⁰

With the rise of digital technology to tackle health issues comes the need to govern the ethical development of such technologies. The development of AI for health purposes is particularly susceptible to the scourge of ethics dumping. Steps to prevent it must be taken at an early stage – and for this, the EU’s regulation of the clinical development of medicines offers a source of inspiration.