EDPB and EDPS Issue Joint Opinion on the European Biotech Act Proposal
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have jointly issued an opinion on the European Commission’s Proposal for a European Biotech Act. This legislative proposal aims to boost Europe’s biotechnology and biomanufacturing sectors, especially in health-related fields, by simplifying the regulatory framework and updating clinical trial rules. The EDPB and EDPS support the goal of improving the EU’s competitiveness and reducing inconsistencies in applying the Clinical Trials Regulation (CTR).
A key aspect welcomed by both authorities is the establishment of a single legal basis for processing personal data by sponsors and investigators. This change is expected to enhance legal clarity across member states. However, the EDPB and EDPS emphasize the need for strong protection measures for sensitive health and genetic data used in clinical trials. They recommend clear definitions of data controller roles to ensure accountability and responsibility among all parties involved.
The opinion also addresses data retention concerns, suggesting that the mandatory 25-year retention period should only apply to the clinical trial master file, not all personal data processed during trials. Additionally, the Biotech Act should specify the purposes and safeguards for further processing of trial data for new clinical trials or scientific research. The proposal should align with the AI Act, ensuring sponsors’ obligations complement existing AI regulations for a consistent legal framework.
Technical and organizational safeguards are also highlighted. The CTR should require pseudonymization whenever direct identification of personal data is unnecessary. For regulatory sandboxes related to clinical trials, the Commission’s implementing acts must provide a legal basis for processing sensitive data and allow derogations under GDPR Article 9(2). For other sandboxes, data processing should always have a GDPR-compliant legal basis. These recommendations aim to balance innovation with strong data protection and legal certainty for researchers and participants.
