News
The European Commission postpones its “biotech law” again
By Denis MESHAKA
Published on the 09/06/2025
The European Commission’s postponement of its “biotech law” until the end of 2026 is raising questions. Presented as a future “regulation“, this law must be coordinated with other legal acts still under discussion, in particular the one on new genomic techniques (NGT). But the regulation on health data (known as “EHDS“), adopted in February 2025, could also be a reason for this postponement.
Via a consultation (a “call for evidence“) published in April 2025i, the European Commission confirmed that its proposal for a “biotech law“ii – which it now calls the “Biotechnology Regulation” – initially expected for 2025, would not finally be presented until the third quarter of 2026. This postponement could be aimed at bringing the future biotech law more into line with, among other things, the regulation on the “European Health Data Space” (EHDS), adopted on 11 February 2025iii. But beyond a technical readjustment, this postponement could actually be aimed at making it easier to take the industry’s interests into account, at a time when data protection requirements are becoming more stringent.
A forced postponement?
On 13 May, Olivér Várhelyi, the European Commissioner for Health and Animal Welfare, endorsed the postponement of this regulation on biotechnology in front of the European Coalition for Biosolutions, a panel of European companies in the field of “biosolutions“iv. “Bio” refers to the term “biotechnology” and not “biological“, as confirmed in Várhelyi’s speech entitled “Perspectives and priorities for the new European biotechnology law“v. In it, he explains that the Commission “intends to adopt an ambitious and robust biotech law in 2026“, and that it is in the “preparatory phase” of this law, during which it is “examining several key areas for the biotech sector“.
In order to “make the most of the biotechnology revolution in all sectors”, the Commission has announced, via Olivér Várhelyi, that it intends to examine the following key areas: regulatory environment, access to capital and venture capital, existing infrastructures, human capital, supply chains and… digital tools. The work still to be done by the Commission to draw up its biotech law would therefore be substantial. Didn’t the Commission simply feel obliged to postpone the “Biotechnology Regulation” because, in its haste, it had failed to anticipate the scale of the examinations to be carried out, particularly on the issue of health data?
The challenge of health data
Referring to the examination of the “digital tools” area, Olivér Várhelyi refers to the EHDS regulation of February 2025. “Access to data, storage services and IT resources will of course be essential for research and innovation in the field of biotechnology. In this respect, we believe that the European Health Data Space will provide very important support,” Várhelyi told the industry panel on 13 May. The scheme, which will come into force in March 2027, is of crucial importance to the Commission, as digital health data is a valuable “raw material” for biomedical research.
It is for this reason that the Commissioner also reassured the panel of industrialists about the exploitation of such data: “We are therefore seeking to facilitate the development and adoption of digital solutions and artificial intelligence in all sectors of biotechnology. And of course, we need to use this wealth of data that we have in a very strategic way. In a strategic way that will ensure Europe’s global leadership.” The growing role of artificial intelligence in the management and exploitation of healthcare data is undoubtedly attracting the interest of many economic playersvi.
The EHDS regulation
The hypothesis that the framework imposed by the EHDS is one of the main reasons for the postponement of the biotech regulation seems plausible. This very recent regulation – February 2025 – governs the use of primary and secondary digital health data in Europe. Primary use refers to the collection and use of data in the context of patient care (article 2.1). Secondary use concerns the exploitation of data collected and produced in the course of care, for scientific research and in the health sector (article 50 et seq.).
According to the EHDS, secondary use may be authorised without the patient’s explicit consent, provided that the processing has an established legal basis, such as the public interest, public health or scientific research (GPDR Regulation, Article 9)vii, and is accompanied by appropriate safeguards (such as anonymisation, pseudonymisation or secure access). The EHDS Regulation also calls for transparency of processing, data portability, a framework for secondary use of data and technical standards for interoperability. Access to data is only authorised under these conditions, for public, private or not-for-profit entities, as well as for individual researchers. This secondary use may be for the purposes of scientific research, innovation, health policy development, patient safety, regulatory activities or personalised medicine, in particular on the basis of (epi)genomic or molecular data, etc. (recitals 56 and 61, and articles 51 and 61 of the EHDS Regulation).
The EHDS Regulation explicitly states that health data may be used for the development of medicinal products, medical devices or artificial intelligence systems (Article 53(e)), i.e. uses with high commercial and technological potential. In theory, such processing is only authorised where it is intended to “contribute to the general interest” (recital 61) and is subject to a number of conditions set out in Article 54. These include in particular the prohibition of uses that are expressly prohibited, such as targeted marketing, discrimination or the abusive exploitation of data, as well as respect for intellectual property rights and commercial secrets.
An agenda driven by economic interests
The actual strength of the guarantees proposed by the EHDS regulation raises questions. Their practical application will largely depend on the rigour of the controls exercised by a health data access body (HDAB), national interpretations and the ability to detect and punish misuse. In the absence of explicit consent from the individuals concerned, the massive re-use of data, including sensitive or genetic data, calls for particular vigilance, both from an ethical and legal point of view.
In this context, the future “Biotechnology Regulation“, a key lever in the Commission’s health strategy, will necessarily have to be coordinated with the EHDS Regulation. While the EHDS Regulation imposes constraints on the use of health data, it also opens up a wide range of possibilities for the biotechnology sector in terms of access to health data. Do biotech companies see the EHDS framework as sufficiently flexible to support their ambitions? Or are they afraid of coming up against a regulatory environment that is too rigid for them to evolve freely? Postponing the “Biotechnology Regulation” until the end of 2026 would in any case give the Commission the opportunity to adapt it to offset or smooth out any obstacles posed by the EHDS.
The emergence of a democratic risk
This postponement could be more of a political opportunity to review the interests of the market than a simple measure of legal prudence. If the Commission wishes to introduce measures in this future text that will make it even easier for industry to access and/or use health data, it will have to accept the consequences: this would mean redefining the very status of this data, no longer as a protected extension of the individual, but as a shared economic resource subject to transaction.
The EHDS regulation does not offer absolute protection for health data. It would be worrying if the European Union were to increase this fragility by taking the future regulation on biotechnology in the same direction. The risk would then be not only legal but also democratic. For example, by granting industrial players privileged access to data from public health systems, the EU runs the risk of compromising public confidence in its ability to protect personal data. The European model, based on the primacy of people’s fundamental rights, would be weakened in the name of competitiveness.
Health data: US, Swiss and Israeli practices
In the United States, health data protection is based mainly on the HIPAA law, which applies to players in the healthcare system (hospitals, insurers, etc.), but does not cover data collected by mobile applications or connected objectsviii. This fragmented system allows relatively liberal use of health data, especially when it is anonymised. Many private companies can access this data for research, marketing or product development purposes, with fewer constraints than the current European standards.
In Israel, the authorities have set up partnerships between public hospitals and start-ups in the sector, authorising access to anonymised health databasesix. The State plays a facilitating role, allowing companies to exploit these resources under advantageous conditions, with no real obligation for prior consent or profit-sharing. This model of rapid innovation is implicitly based on the free or virtually free availability of private data and highly sensitive public assets: citizens’ medical data.
Switzerland, for its part, is combining an ambitious programme to digitise healthcare (DigiSantéx) with an open data policy that opens the door to the commercial re-use of certain public data, for which patient consent may be implicit in certain cases of care. Here again, the quid pro quo remains unclear: can companies build services or products on the basis of private and public data without any obligation for prior consent and redistribution of profits?
i European Commission, Public consultation on the Biotechnology Regulation, May 2025.
ii Denis Meshaka, “The European Commission wants its “biotech revolution” “, Inf’OGM, 11 February 2025.
iii European Union, “Regulation (EU) 2025/327 of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847”, 5 March 2025.
iv The “European Coalition for Biosolutions” brings together a number of European industrial organisations defending biotechnologies (Germany, United Kingdom, Belgium, Austria, Denmark, Netherlands, Switzerland, etc.), with France represented by Medef.
v European Commission, “Speech by Commissioner Várhelyi at the European High-Level Conference on Biosolutions”, 13 May 2025.
vi Laure Belot, “Les données de santé, un trésor mondialement convoité”, Le Monde, 2 March 2020.
vii European Union, “Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data”, 4 May 2016.
viii “États-Unis : les données relatives à la santé mentale en vente pour quelques dollars”, Gènéthique, 14 February 2023.
ix Ricky Ben-David, “Digital health in Israel: 19 projects worth 100 million shekels”, The Times of Israel, 31 May 2022.
x Swiss Confederation, Federal Office of Public Health (FOPH), “DigiSanté: promoting the digital transformation of the healthcare system”.
