EDPB-EDPS Joint Opinion 3/2026 on European Biotech Act Raises Data Protection Concerns

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have issued Joint Opinion 3/2026, raising significant concerns about data protection provisions in the European Commission's proposed European Biotech Act. The joint opinion, published on March 10, 2026, warns that certain aspects of the proposed legislation could create serious risks to fundamental rights and undermine existing data protection frameworks.

The European Biotech Act, first proposed in December 2025, aims to streamline regulations for biotechnology research and development across the EU. However, the EDPB-EDPS joint opinion identifies several problematic areas where the proposed act's data processing provisions could conflict with the General Data Protection Regulation (GDPR) and the Charter of Fundamental Rights of the European Union.

Key Concerns Raised by Data Protection Authorities

One of the primary issues highlighted in the opinion relates to the proposed act's broad exemptions for scientific research purposes. The EDPB and EDPS warn that the current wording would allow extensive processing of personal data without adequate safeguards, potentially enabling organizations to bypass GDPR requirements under the guise of research activities.

"The proposed exemptions are far too broad and lack the necessary precision required by EU data protection law," the joint opinion states. "This could create a situation where personal data is processed with minimal oversight, contrary to the principles of data minimization and purpose limitation."

Another significant concern involves the proposed centralized database for genomic and health data. While the European Biotech Act envisions this database as a tool to accelerate research, the EDPB-EDPS warns that it could become a massive repository of sensitive personal information without sufficient security measures or individual control mechanisms.

Compliance Challenges for Organizations

For organizations operating in the biotechnology sector, the joint opinion creates additional uncertainty about how to navigate the intersection between research activities and data protection requirements. Companies developing genomic sequencing technologies, personalized medicine applications, and other biotech innovations may face conflicting obligations between the proposed European Biotech Act and existing GDPR requirements.

The EDPB-EDPS recommends that the European Commission revise several provisions to ensure alignment with fundamental rights and existing data protection frameworks. These recommendations include:

• Narrowing the scope of research exemptions to prevent abuse
• Implementing mandatory Data Protection Impact Assessments (DPIAs) for high-risk processing activities
• Establishing clear consent mechanisms for individuals whose data would be included in centralized databases
• Creating independent oversight mechanisms for data processing under the act

Timeline and Next Steps

The European Commission must now consider the EDPB-EDPS joint opinion as it finalizes the European Biotech Act. While the opinion is not binding, it carries significant weight in the EU legislative process, particularly given the EDPB's role in ensuring consistent application of data protection rules across member states.

Industry stakeholders have mixed reactions to the joint opinion. Some biotechnology companies argue that the current GDPR framework already creates unnecessary barriers to research, while privacy advocates welcome the EDPB-EDPS intervention as necessary protection against potential privacy violations.

The European Parliament and Council of the European Union will review the proposed act and the joint opinion during upcoming legislative sessions. The final version of the European Biotech Act could be significantly different from the current proposal, depending on how lawmakers balance innovation objectives with data protection requirements.

For organizations in the biotech sector, the joint opinion serves as a reminder that data protection compliance remains a critical consideration in research and development activities. Companies should monitor legislative developments closely and prepare for potential changes in how personal data can be processed for scientific purposes.

The EDPB-EDPS joint opinion is available on the EDPB website at edpb.europa.eu, where organizations can also find guidance on GDPR compliance for research activities.