Data protection

Subscribe to Data protection via RSS

On 11 December, after overnight interinstitutional negotiations between the European Parliament and the Council of the European Union (“Council”) and the European Commission, the institutions reached a provisional political agreement on the reform of the European Union (“EU”) pharmaceutical legislation.

This agreement concludes months of trilogue discussions and follows a much longer legislative process that began with the European Commission’s  proposal adopted in April 2023, the European Parliament’s position adopted on 10 April 2024, and the Council’s position adopted on 4 June 2025 (see our detailed advisory on the Commission’s proposal and our BioSlice blog posts on the Parliament’s and Council’s positions here and here).

The provisional agreement must now be formally adopted by both the Parliament and the Council.Continue Reading European institutions agree on the reform to the EU Regulatory Framework for Medicinal Products

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during October and early November 2025 from the the United Kingdom, and European Union.Continue Reading Virtual and Digital Health Digest – November 2025

The EU Commission has published its proposal for the “Digital Omnibus” aimed to simplify and streamline the EU rules governing artificial intelligence, data protection, cybersecurity, and data use more broadly. The proposal seeks to amend several cornerstone EU regulations, including Regulation (EU) 2016/679 (GDPR), Regulation (EU) 2024/1689 (AI Act), Regulation (EU) 2023/2854 (Data Act), Directive 2002/58/EC (e-Privacy Directive) and Directive (EU) 2022/2555 (NIS2). The proposal also foresees the repeal of the fairly recent Regulation (EU) 2022/868 (Data Governance Act).

Below is a high-level snapshot of the proposal, ahead of a more detailed advisory we will publish.

The proposal will now moves through what is expected to be a challenging legislative procedure and policy and political discussions with the European Parliament and the Council.

Below we set out a quick overview of the most relevant elements for companies, including medical device manufacturers and other Life Sciences companies – e.g., changes to the AI Act, updates to the GDPR, reform of the EU cookie and tracking rules, data-sharing rules, and the new single-entry point for cybersecurity and data protection incidents reporting.Continue Reading Digital Omnibus: The European Commission published its proposal to amend the GDPR, AI Act, Data Act and other related frameworks

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during September and early October 2025 from the the United Kingdom, and European Union.

This month, the EU and UK have been actively processing the future of AI development and regulation in life sciences and health care through a combination of legislative initiatives, opportunities for stakeholder engagement, and investment in infrastructure. In the EU, the European Commission has published draft guidance on reporting serious AI incidents under the AI Act, and the European Medicines Agency has initiated a stakeholder survey to define AI priorities in medicines regulation. In the UK, the UK government has announced a National Commission on the Regulation of AI in Healthcare and a new AIR-SP cloud platform. These developments signal a shift from theoretical regulation to practical implementation. There have also been two important decisions from the Court of Justice of the European Union refining the legal boundaries of digital health services and data protection.Continue Reading Virtual and Digital Health Digest – October 2025

On 4 September 2025, the Court of Justice of the European Union (“CJEU”) delivered a notable judgment on what is considered pseudonymised personal data under EU data protection law. While, technically speaking, the judgment concerns the interpretation of Regulation (EU) 2018/1725 (which governs the processing of personal data by the EU institutions and bodies), it fully applies to the interpretation of the concepts of personal data and pseudonymised data under Regulation (EU) 2016/679 (“GDPR”).

This question is essential for many companies operating in the EU, and in particular Life Sciences companies handling key-coded or otherwise pseudonymised patients’ personal data in the context of research and development, supply of healthcare products and related safety monitoring.Continue Reading CJEU clarifies the concept of pseudonymised data

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during June and early July 2025 from the United Kingdom and European Union.

There has been a flurry of new guidance from the Medical Device Coordination Group this month, including guidance on classification of medical device software, on supply of software apps through online platform such as the App Store and Google Play, and on the interaction between the Medical Device Regulation and the EU AI Act. These are welcome guidance documents to provide important clarification for manufacturers as they develop software medical devices, although the guidance documents inevitably cannot cover every situation and leave some questions unanswered. Continue Reading Virtual and Digital Health Digest – July 2025

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during May and early June 2025 from the United Kingdom and European Union.

There has been a lot of focus on AI this month. The European Commission has launched a consultation on high-risk AI systems, which includes medical devices and is therefore highly relevant for digital health companies. The European Medicines Agency has published a workplan on data and AI use, which sets out how the European Medicines Regulatory Network plans to leverage large volumes of regulatory and health data to support regulatory decision-making for better medicines. There has also been international guidance published on the use of AI in pharmacovigilance. However, there has also been controversy as the UK Data Use and Access Bill continues through the parliamentary process, as there is disagreement on its treatment of copyright-protected material in the development of AI systems. As uses of AI continue and authorities seek to put in place relevant legislation and guidance to match the speed of development, expect this focus to continue.Continue Reading Virtual and Digital Health Digest – June 2025

Introduction

On 4 June, EU Member States, meeting in the Council of the European Union (‘Council’), have agreed on a position on the pharmaceutical reform package.

This agreement was reached despite significant divergences between EU Member States in the preceding weeks. It marks a key milestone in the process for adoption of the EU revision of EU’s general pharmaceutical legislation, as it sets out the Council’s position for the trilogue negotiations to find a text agreeable to the Parliament and the Council, which can now begin.

The innovative pharmaceutical industry will welcome aspects of the Council’s adopted negotiating mandate as it provides greater certainty with regards to regulatory data protection and it lightens some of the obligations introduced in the European Commission proposal for reform of the EU pharmaceutical legislation adopted in April 2023 and the European Parliament’s position adopted on 10 April 2024 (see our detailed advisory). At the same time, the Council has adopted positions on some aspects of the proposals that could be seen as less favourable to industry.

We discuss some of the key provisions and changes in the Council’s adopted position below. This is, however, not covering all elements of the reform of the EU pharmaceutical legislation and the final outcome of the legislative process remains uncertain.Continue Reading Council of the European Union backs reforms to the EU Regulatory Framework for Medicinal Products

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during April and early May 2025 from the United States, United Kingdom, and European Union.

Cybersecurity is a hot topic in the UK and EU this month. In both, cybersecurity plans are developing, with the European Commission conducting a consultation on the EU Action Plan to strengthen cybersecurity within hospitals and health care providers, and the UK Cyber Security and Resilience Bill being published, introduced partly because of cyberattacks on UK hospitals. This is clearly an important area for developers of digital products and services, who should watch the progress of these policies closely.Continue Reading Virtual and Digital Health Digest – May 2025

On 21 May 2025, the European Commission published its Proposal for a Regulation (“Proposal”), amending several existing regulations, including the General Data Protection Regulation (EU) 2016/67 (“GDPR”), to simplify obligations for small and medium-sized enterprises (“SMEs”) and extend certain mitigating measures to small mid-cap enterprises (“SMCs”).Continue Reading Proposed GDPR Simplifications for SMEs and SMCs