EDPS Opinion 13/2026 on the Proposal for a Regulation on monitoring and controlling drug precursors and repealing Regulations (EC) No 273/2004 and (EC) No 111/2005

Opinion 13/2026

on the Proposal for a Regulation on monitoring and controlling drug precursors and repealing Regulations (EC) No 273/2004 and (EC) No 111/2005

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on monitoring and controlling drug precursors and repealing Regulations (EC) No 273/2004 and (EC) No 111/2005 .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 3 December 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on monitoring and controlling drug precursors and repealing Regulations (EC) No 273/2004 and (EC) No 111/2005.

The objective of the Proposal is to address the challenge of preventing the use of drug precursors in the illicit manufacture of drugs, whilst simplifying rules and procedures for legitimate trade. It also aims to increase digitalisation and automate several obligations, aiming to significantly reduce the costs and administrative burden for operators and Member State national authorities.

Under the Proposal, the Commission must establish and maintain a centralised electronic system for the submission, storage, processing, decision-making, and exchange of information for the monitoring and control of drug precursors.

The EDPS welcomes that the Proposal includes a specific provision concerning the protection of personal data. To facilitate the effective exercise of data subject rights, the EDPS recommends clarifying the roles of the Commission and Member States as controller, joint controller, or processor in relation to the centralised electronic system. The Proposal would require the Commission to adopt an implementing act to establish implementing arrangements for the electronic system. The EDPS recommends that this implementing act also address the interconnection of various systems envisioned by the Proposal, particularly the interoperability of these systems, the exchange of data and relevant data protection safeguards.

The EDPS notes that the electronic system would enable competent authorities to make decisions regarding the issuance of a license to an operator, including the refusal, revocation or suspension of a license. The EDPS recommends stipulating that the possibilities of appeal under national law shall be explicitly mentioned in any decision to refuse, revoke or suspend a license, or an order to suspend or cease activities.

Finally, Articles 23(3) and (4) of the Proposal require customs authorities to conduct verification activities prior to releasing substances for a customs procedure or re-export. The Proposal envisions that these verifications would be conducted automatically. The EDPS recommends defining suitable measures to safeguard the rights and freedoms and legitimate interests of data subjects in cases of automated individual decision-making.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 3 December 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on monitoring and controlling drug precursors and repealing Regulations (EC) No 273/2004 and (EC) No 111/2005 (‘the Proposal’).

2. The objective of the Proposal is to address the challenge of preventing the use of drug precursors in the illicit manufacture of drugs, whilst simplifying rules and procedures for legitimate trade . The introduction of specific rules on designer precursors and innovative means for their inclusion aims to allow for quicker action to prevent their diversion .

3. The Proposal would also increase digitalisation and automate several obligations, aiming to significantly reduce the costs and administrative burden for operators and Member State national authorities .

4. The EDPS previously issued an Opinion on the Proposal for a Regulation amending Regulation (EC) No 273/2004 on drug precursors, which governs the monitoring of intra-EU trade, and the Proposal for a Regulation amending Council Regulation (EC) No 111/2005 laying down rules for the monitoring of trade between the Community and third countries in drug precursors, which governs the control of external trade . The current Proposal merges Regulation (EC) No 273/2004 and Regulation (EC) No 111/2005 into one Regulation .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 11 June 2026, pursuant to Article 42(1) of EUDPR.

2. General remarks

6. The EDPS welcomes the Proposal’s objectives of better addressing the developments in the illicit manufacture of drugs, in particular the proliferation of designer precursors . The EDPS also welcomes that this Proposal aims to give effect to the obligations deriving from Article 12 of the United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances .

7. The EDPS notes that the measures established by the Proposal imply the processing of personal data of operators . The Proposal, for example, obliges operators to document information relating to each transaction, including the names and addresses of other operators involved in the transaction ; to notify competent authorities of suspicious transactions, significant disappearances and thefts of scheduled drug precursors and subsequently to provide available information to the competent authorities including names and addresses of operators involved in the supply chain ; and operators must obtain a license from the competent authorities, for which application requires information such as the name and contact details of the operator, including their postal and electronic address and telephone number .

8. Considering both Member States and the Commission will process personal data in the context of their use of the central electronic system established in Article 35 of the Proposal, both the GDPR and EUDPR are applicable. The EDPS welcomes that Recital 26 of the Proposal specifies that the processing of personal data must be carried out in compliance with the provisions of the GDPR or the EUDPR, within their respective scope of application.

9. The EDPS also welcomes the reference in Article 28(2) of the Proposal, requiring that competent authorities protect personal data in accordance with Union and national law.

10. The EDPS notes that there is no reference in the Proposal to the consultation of the EDPS in accordance with Article 42(1) EUDPR and recommends including such a reference in a recital to the Proposal.

3. Drug precursors electronic system

11. Article 35(1) of the Proposal provides that the Commission must establish and maintain a centralised electronic system for the submission, storage, processing, decision-making, and exchange of information for the monitoring and control of drug precursors in accordance with the Proposal . The Commission must establish the electronic system to be capable of the following functions: a. To enable operators to: i. register in the system in order to perform formalities set out in the Proposal; ii. request a license in accordance with Article 9 and 18; iii. make the registration required by Article 9(7) and 15; iv. file a prior notification in accordance with Article 17(2); v. verify in accordance with Article 13 and 19(1) that other operators hold a licence or made a prior notification; vi. notify quantities to competent authorities in accordance with Articles 20 and 22; b. To enable operators and providers of online marketplaces to report on suspicious transactions in accordance with Article 8 of the Proposal; c. To enable competent authorities to: i. issue, suspend or revoke a licence; ii. order operators to suspend or cease activities covered by a registration or a prior notification, in accordance with Article 15(5) or Article 17(5) respectively; iii. provide information in accordance with Article 32 and 33; d. To facilitate the preparation of the report to the International Narcotic Control Board in accordance with Article 34, by the Commission in consultation with Member States .

12. The EDPS notes that the accompanying documents to the Proposal include a mapping of the data flows envisioned by the Proposal . The EDPS takes note that only data of responsible officers in charge of licenses, self-registration or prior notification is referred to as being ‘personal data’. The EDPS recalls that in addition to the data relating to responsible officers, the information required for the application for a license pursuant to Article 9 and 18, registration pursuant to Article 9(7) and Article 15, and prior notification pursuant to Article 17(2) may involve the personal data of operators (including external traders), which may be natural persons . This information includes, for example, the name and contact 1920 details of the operator, including postal and electronic address, and telephone number ; 2122 the name of the responsible officer appointed and their contact details ; and a certificate of good conduct of the operator and the responsible officer . Furthermore, when personal data is associated with an application or other type of procedure where it cannot be separated at the time of collection, the entire data set should be treated as personal data.

13. The competent authority may issue a license through the electronic system after confirming that the operator demonstrates, among others, integrity by the absence of any serious infringements or repeated infringements in the field of drug precursors and the absence of a record of serious criminal offences . The decision to refuse or revoke a license, to suspend an existing license, or to order the suspension or cessation of activities in 25,26 accordance with Article 15(5) is also communicated through the electronic system . Each of those decisions must be motivated and subject to appeal under the conditions set out in the national law. For the avoidance of doubt, the EDPS recommends stipulating that the possibilities of appeal shall be explicitly mentioned in any decision to refuse or revoke a license, to suspend an existing license, or to order the suspension or cessation of activities.

14. The EDPS notes that the decision by a competent authority to refuse or revoke a license, to suspend an existing license, or to suspend or cease activities in accordance with Article 15(5) may contain or refer to personal data, particularly when that decision is based upon findings that a prior serious infringement or serious criminal offence by a natural person acting as operator exists . The EDPS recalls that any processing of personal data relating to criminal convictions and offences is subject to compliance with Article 10 of the GDPR and Article 11 of the EUDPR. In this regard, the EDPS welcomes that the Proposal includes a specific provision concerning the protection of personal data (subject to the recommendations provided below).

15. The Proposal also requires that the Commission interconnect the electronic system with the EU Single Window Environment for Customs (‘EU CSW-CERTEX’), established by 2829 Regulation (EU) 2022/2399 . The EDPS understands that, through the electronic system established in Article 35 of the Proposal, the EU eLicensing central portal for licenses and registrations would be connected to the EU CSW-CERTEX and would contain information on substances, validity, quantity and whether exemptions apply, enabling the automation of the authorisation process. The EDPS notes in particular that Article 23(3) and (4) of the Proposal require that customs authorities release a substance for a customs procedure or re-export only after verifying, at a minimum, that an active license, registration, or prior notification exists, where required, and that the quantities are within the thresholds established in Article 20 and 22 of the Proposal. The Proposal notes that the verifications referred to in Article 23(3) and (4) would be carried out automatically via the interconnection with the EU CSW-CERTEX from the date the interconnection is operational . The EDPS understands that the automatic, digital verification of operators by customs authorities would involve processing of personal data, for example, in the information about economic operators, applications, registrations or prior notifications or other documentation, including reports on suspicious transactions . The EDPS recalls that automated individual decision-making is subject to compliance with Article 22 GDPR and the corresponding provisions of the EUDPR. The EDPS recommends defining suitable measures to safeguard the rights and freedoms and legitimate interests of data subjects in cases of automated individual decision-making, including at least the right to obtain human intervention on the part of the controller, to express their point of view, and to contest the decision .

16. The EDPS understands that the electronic system established in Article 35 of the Proposal may also be used by external traders, which engage in the import and/or export of drug precursors . Considering that import and export of drug precursors involve the movement of non-Union goods in, and the movement of Union goods out, of the customs territory of the Union, the EDPS understands that the transfer and exchange of data by external traders via the electronic system may involve the transfer of data to third countries. On this basis, the EDPS recalls that all transfers of personal data to third countries must comply with Chapter V GDPR and the corresponding provisions of the EUDPR.

4. Data protection in the context of the electronic system

17. The EDPS welcomes that the Proposal includes a specific provision concerning the protection of personal data. Article 36 of the Proposal establishes that the processing of personal data within the electronic system will be carried out in compliance with the GDPR or EUDPR, as applicable. It further specifies that the processing of personal data under the Proposal within the electronic system will take place only for the purposes established by the Proposal. Access to personal data is limited to duly authorised staff of the Commission and other Union bodies, competent authorities and customs authorities to the extent necessary for the performance of their tasks under the Proposal. Those Union bodies and authorities must ensure the confidentiality and integrity of those data and protect them against unauthorised access, use or disclosure, in accordance with applicable Union data protection rules.

18. The EDPS understands that the Commission is tasked, pursuant to Article 35 of the Proposal, with establishing and maintaining the electronic system for the submission, storage, processing, decision-making, and exchange of information for the monitoring and control of drug precursors . The EDPS recommends clarifying in Article 36 of the Proposal the roles and responsibilities applicable with respect to the processing of data in the context of the electronic system, in particular by clarifying the roles of the Commission and of the Member States as controller, joint controller or processor. These roles should be attributed in alignment with Chapter IV of the GDPR and the corresponding provisions of the EUDPR . Finally, the EDPS recalls that any relationship between (joint) controllers and processors must be governed by appropriate legal arrangements .

5. Other specific comments

19. The EDPS understands that the electronic system established by Article 35 of the Proposal is envisaged to be interconnected with, or to facilitate connections between, various other systems or portals based in the Union, including national export and import systems of 37; 38 Member States the EU eLicensing central portal for licenses and registrations ; the EU 39; 40 CSW-CERTEX and the Drug Precursors Information Repository . The EDPS also understands that Article 35(8) requires the Commission to adopt an implementing act establishing the implementing arrangements for the development and operation of the electronic system, including technical specifications and the procedures to be followed for the implementation of Articles 6, 8, 9, 13, 15, 17, 18, 19(1), 20, 21, 22, 23, 32, 33 and 34 of the Proposal.

20. The EDPS takes note that the implementing act mentioned in Article 35(8) does not envisage establishing the arrangements for the interconnection, or the facilitation of connections, between the various systems or portals mentioned above. The EDPS recommends that Article 35(8) of the Proposal be amended to require that the interconnection of these systems must also be addressed by this implementing act. This should include clarifications on how the interoperability of these systems is envisioned, the types of data that will be transmitted between them, and the safeguards in place to ensure the safety and security of that data, particularly personal data. The EDPS also takes this opportunity to recall the obligation in Article 32 of the GDPR and the corresponding provision of the EUDPR to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

21. Recital 28 of the Proposal states that the implementing powers conferred on the Commission to determine the implementing arrangements for the electronic system should include the rules for the protection, safety and security of personal data. The EDPS notes, however, that Article 35(8) of the Proposal, which obliges the Commission to adopt this implementing act, makes no reference to the implementation of Article 36 on data protection. The EDPS recommends specifying also in Article 35(8) that the implementing act will include the specifications and procedures needed to implement the data protection safeguards specified under Article 36 of the Proposal in the context of the electronic system. The EDPS recalls that if delegated or implementing acts provide for the processing of personal data, the EDPS should be consulted pursuant to Article 42(1) EUDPR.

6. Conclusions

22. In light of the above, the EDPS makes the following recommendations: (1) to add a recital to the Proposal referring to the consultation of the EDPS in accordance with Article 42(1) EUDPR; (2) to specify that the possibilities of appeal shall be explicitly mentioned in any decision to refuse or revoke a license, to suspend an existing license, or to order the suspension or cessation of activities; (3) to define the safeguards applicable to any automated individual decision-making in the context of Article 23(3) and (4) of the Proposal; (4) to clarify in Article 36 of the Proposal the roles and responsibilities applicable to the processing of personal data in the context of the electronic system established by Article 35 of the Proposal, including by defining the controller and processor roles in alignment with Chapter IV of the GDPR and corresponding provisions of the EUDPR; (5) to amend Article 35(8) of the Proposal to require that the implementing act also address the interconnection and interoperability of various systems with the central electronic system established by Article 35 of the Proposal; (6) to specify in Article 35(8) of the Proposal that the envisioned implementing act should implement the arrangements for the electronic system relating to the protection, safety and security of personal data as indicated by Recital 28 of the Proposal. Brussels, 23 July 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10