EDPS Opinion 11/2026 on the Proposal for a Directive as regards the placing on the market of genetically modified micro-organisms and the processing of organs

Opinion 11/2026

on the Proposal for a Directive amending Directives 2001/18/EC and 2010/53/EU as regards the placing on the market of genetically modified micro-organisms and the processing of organs

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending Directives 2001/18/EC and 2010/53/EU as regards the placing on the market of genetically modified micro-organisms and the processing of organs . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal for a Directive of the European Parliament and of the Council amending Directives 2001/18/EC and 2010/53/EU as regards the placing on the market of genetically modified micro-organisms and the processing of organs that are relevant from a data protection perspective.

Executive Summary

On 16 December 2025, the European Commission adopted the Proposal for a Directive of the European Parliament and of the Council amending Directives 2001/18/EC and 2010/53/EU as regards the placing on the market of genetically modified micro-organisms and the processing of organs.

The objective of the Proposal is to create and reinforce favourable conditions for health biotechnology while safeguarding high standards of protection of human health, patient safety and animal health, the environment, ethics, quality of products, food and feed safety, and biosecurity. The Proposal accompanies the Proposal for a European Biotech Act and aims to make targeted updates to two pieces of sectoral legislation, Directives 2001/18/EC and 2010/53/EU, to ensure this new framework operates effectively within the existing acquis.

The EDPS welcomes the Proposal’s objectives of improving consistency, legal clarity and the smooth functioning of the Union legislative framework for biotechnology, and eventually to ensure the availability of safe and high-quality therapies and other products for Union citizens. The EDPS recalls that compliance with data protection rules must be ensured, as the provision of healthcare by its nature entails the processing of personal data, including special categories of data.

Exceptions to the prohibition on processing of personal data concerning health may be provided for by Union law where necessary for reasons of preventive or occupational medicine, medical diagnosis, and the provision of healthcare or treatment based on Union or Member State law or pursuant to contract with a health professional. The EDPS recommends explicitly clarifying that Directive 2010/53/EU, as amended by the Proposal, aims to provide an exception to the prohibition to process sensitive categories of data under Article 9(2)(h) GDPR.

The Proposal makes reference to the exchange of clinical outcome data between competent authorities. Considering the sensitivity of personal data concerning health, the EDPS recommends that the Proposal clearly define what constitutes clinical outcome data, how this data is exchanged and what safeguards apply. The EDPS also recommends clarifying the allocation of roles and responsibilities of the competent authorities exchanging this data under EU data protection law.

Finally, considering that organ exchange and transplantation may occur between Member States and third countries, the EDPS recommends clarifying if the authorisation of organ processing may also involve the transfer of personal data to third countries.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 16 December 2025, the European Commission adopted the Proposal for a Directive of the European Parliament and of the Council amending Directives 2001/18/EC and 2010/53/EU as regards the placing on the market of genetically modified micro-organisms and the processing of organs (‘the Proposal’). On 1 April 2026, the Commission formally requested an opinion from the EDPS in accordance with Article 42(1) EUDPR.

2. The objective of the Proposal is to create and reinforce favourable conditions for health biotechnology, from research and development to the timely placing on the Union market and production of biotechnology innovations and products, while safeguarding high standards of protection of human health, patient safety and animal health, the environment, ethics, quality of products, food and feed safety, and biosecurity .

3. The Proposal accompanies the Proposal for a Regulation of the European Parliament and of the Council to establish measures to strengthen the Union’s biotechnology and biomanufacturing sectors (‘Proposal for a European Biotech Act’) , which establishes a legislative framework to strengthen the competitiveness of the health biotechnology sector . The Proposal also aims to make targeted updates to two pieces of sectoral legislation for the new framework to operate effectively within the existing acquis , namely 8 9 Directive 2001/18/EC and Directive 2010/53/EU . This Proposal was announced as part of a package of measures to improve the health of EU citizens, while ensuring the long-term resilience and competitiveness of the health sector .

4. The proposed amendments to Directive 2001/18/EC aim to unlock the innovation potential of genetically modified micro-organisms (‘GMMs’) and to render the EU market more attractive for their development, production and marketing by making the applicable rules on GMMs fit for purpose . Directive 2001/18/EC was primarily designed to regulate genetically modified plants, making it less suitable for GMMs which differ significantly from plants in terms of biological properties, capabilities and potential applications. The adjustments in the Proposal aim to create a tailored, more efficient and streamlined regulatory framework for GMMs.

5. The proposed amendments to Directive 2010/53/EU aim to address the extension of the exvivo time window between procurement from the donor and transplantation into the recipient, which creates opportunities for applying different types of processing to maintain or improve the functional status of organs prior to transplantation . The Proposal introduces, with the aim of legal certainty, provisions clarifying how these processing activities can be organized under the oversight of transplant authorities. Clarifying the regulatory treatment of organ processing and strengthening oversight mechanisms aligns Directive 2010/53/EU with current clinical practice and supports coordinated implementation across Member States.

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 April 2026, pursuant to Article 42(1) of EUDPR.

2. General remarks

7. The EDPS welcomes the Proposal’s objectives of improving consistency, legal clarity and the smooth functioning of the Union legislative framework for biotechnology, and eventually to ensure the availability of safe and high-quality therapies and other products for Union citizens .

8. As the provision of healthcare by its nature entails the processing of personal data, the EDPS recommends inserting a recital recalling the applicability of the GDPR and of the EUDPR to any processing of personal data conducted in relation to the processing of personal data covered by the Proposal.

9. The EDPS notes that there is no reference in the Proposal to the consultation of the EDPS in accordance with Article 42(1) EUDPR and recommends including such a reference in a recital to the Proposal.

10. The EDPS notes that Directive 2010/53/EU contains provisions addressing data protection aspects. Article 16 in particular makes reference to Directive 95/46/EC , now repealed by the GDPR, and requires that Member States ensure that the fundamental right to protection of personal data is fully and effectively protected in all organ donation and transplantation activities, in conformity with Union provisions on the protection of personal data such as Articles 8(3), 16, 17 and 28(2) of Directive 95/46/EC. Article 17 of Directive 2010/53/EU also provides that competent authorities must ensure that the fundamental right to protection of personal data is fully and effectively protected in all organ transplantation activities, in conformity with Union provisions on the protection of personal data, in particular Directive 95/46/EC .

11. The EDPS recalls that, as per Article 94(2) GDPR, references to the repealed Directive 95/46/EC are to be construed as references to the GDPR. However, as the Proposal aims to amend and update Directive 2010/53/EC, the EDPS recommends updating Articles 16 and 17 of Directive 2010/53/EU to make references to the relevant provisions of the GDPR.

3. Amendments to Directive 2001/18/EC on the deliberate release into the environment of genetically modified organisms

12. Proposed Article 24b and 24e(3)(c) empower the Commission to adopt delegated acts, in accordance with proposed Article 29a of Directive 2001/18/EC, to amend Annex III of Directive 2001/18/EC to provide for specific information requirements in notifications concerning 1) the placing on the market of GMMs, and 2) the placing on the market of lowrisk GMMs respectively. Annex III sets out the information required in the notification to the competent authority. Annex III A, in particular, sets out the information required in notifications concerning releases of GM organisms other than higher plants, including the name, qualifications and experience of responsible scientist(s). Proposed Article 24g also empowers the Commission to adopt implementing acts on adapted modalities and additional information required for the notification. The EDPS recalls that if delegated or implementing acts provide for the processing of personal data, the EDPS should be consulted pursuant to Article 42(1) EUDPR.

4. Amendments to Directive 2010/53/EU on quality and safety of human organs intended for transplantation

13. The EDPS previously issued an Opinion on the Proposal for a Directive of the European Parliament and of the Council on standards of quality and safety of human organs intended for transplantation . In this Opinion, the EDPS noted that while it is questionable whether biological materials of human origin, such as organs, tissues, cells or blood, can be as such considered as personal data, it is undisputed that such materials can be used as sources of personal information about their holder . Furthermore, this Opinion noted that Directive 95/46/EC (now replaced by the GDPR) applied to the collection, storage and processing of identifiable organs and the subsequent extraction of information from such organs, for as long as it remains possible, with due account of all means likely reasonably to be used, to identify the person concerned . The permanent traceability of organs as set out by Article 10 of Directive 2010/53/EU keeps the persons identifiable throughout the lifecycle of organs. Moreover, Article 16 of Directive 2010/53/EU provides that donors and recipients whose data are processed within the scope of this Directive must not be identifiable, except as permitted by Article 8(2) and (3) of Directive 95/46/EC (corresponding to the derogation under Article 9(2)(i) GDPR).

14. As information about organs reveals information about the health status of the donor, and thus qualify as ‘data concerning health’ under Article 4(15) GDPR, it is particularly important to ensure robust safeguards. Information about organs may also constitute genetic data under Article 4(13) GDPR, notably if they contain an analysis of the deoxyribonucleic acid (DNA) of the donor or otherwise provide information about the inherited or acquired genetic characteristics of a natural person which give unique information about their physiology or health . Both genetic data and data concerning health are especially protected under Article 9(1) GDPR.

15. The Proposal modifies the current definition of ‘transplantation’ in Article 3(q) by removing the specific mention of a donor, whereby transplantation is amended to mean ‘a process intended to restore certain functions of the human body by transferring an organ to a recipient’ . Other parts of Directive 2010/53/EU continue to refer to the donor in the context of transplantation . In particular, Article 15 of Directive 2010/53/EU requires that Member States take all necessary measures to ensure the highest possible protection of living donors to fully guarantee the quality and safety of organs for transplantation, and that Member States must keep a register or record of the living donors in accordance with Union and national provisions on the protection of personal data and statistical confidentiality . Article 16 of Directive 2010/53/EU further requires that Member States ensure that the fundamental right to protection of personal data is fully and effectively protected in all organ donation and transplantation activities. The EDPS understands that, notwithstanding the removal of the word “donor” from the definition of transplantation, the relevant protections for donors continue to apply.

16. Proposed Article 6a(8) provides that competent authorities under Directive 2010/53/EU, Directive 2001/83/EC, Regulation (EC) No 726/2004, Regulation (EU) 2017/745 and Regulation (EU) 2024/1938 must collaborate to exchange clinical outcome data. A definition of clinical outcome data is not provided by these legal acts, although Regulation (EU) 2017/745 notes that clinical outcomes may “includ[e] […] outcome(s) related to diagnosis, or a positive impact on patient management or public health” . Considering that clinical outcome data might constitute personal data pertaining to the health status of a data subject and thus qualify as ‘data concerning health’ under Article 4(15) GDPR, a derogation from the prohibition under Article 9(1) GDPR would be required in order to process clinical outcome data. The EDPS understands that Article 16 of Directive 2010/53/EU would provide for a derogation to Article 9(1) GDPR under Article 9(2)(h) GDPR, but recommends making this explicit in a recital of the Proposal.

17. In addition, the EDPS recommends that the Proposal defines the term “clinical outcome data” and provides further clarifications which categories of personal data, in particular those concerning health, that the clinical outcome data may include. The EDPS further recommends specifying how this information is exchanged and which safeguards shall be in place. The EDPS also considers that the Proposal should determine the roles and responsibilities of the parties exchanging clinical outcome data under Article 6a of the Proposal under EU data protection law .

18. Proposed Article 6a(12) confers on the Commission the power to adopt implementing acts, in particular to lay down detailed rules for the application and authorisation of organ processing in accordance with the procedure referred to in Article 30(2) of Directive 2010/53/EU. The EDPS recalls that, where such implementing acts provide for the processing of personal data, the EDPS should be consulted pursuant to Article 42(1) EUDPR. The EDPS also recommends clarifying in a recital to the Proposal whether the authorisation of organ processing may involve the transfer of data on organs to third countries. If so, the EDPS reminds that Chapter V GDPR continues to apply when transfers occur.

5. Conclusions

19. In light of the above, the EDPS makes the following recommendations: (1) to add a recital to the Proposal recalling the applicability of the GDPR and of the EUDPR; (3) to update Articles 16 and 17 of Directive 2010/53/EU in the Proposal to make references to the relevant provisions of the GDPR; (4) to make explicit in the Proposal that Article 16 of Directive 2010/53/EU provides for a derogation to Article 9(1) GDPR under Article 9(2)(h) GDPR; (5) to define ‘clinical outcome data’ in the Proposal; (6) to determine in a recital to the Proposal what the exchange of clinical outcome data involves, in what environment this exchange occurs, and what safeguards should be put in place to ensure the security of this data; (7) to determine in a recital to the Proposal the roles and responsibilities of the parties exchanging clinical outcome data under Article 6a of the Proposal under EU data protection law; (8) to clarify in a recital to the Proposal whether the authorisation of organ processing involves the transfer of data on organs to third countries. Brussels, 27 May 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9