Life Sciences

Subscribe to Life Sciences via RSS

On 23 September 2026, the Italian data protection authority (the Garante) fined IQVIA Solutions Italy €7 million under the GDPR. The decision concerns a database of patient records collected from around 800 general practitioners and covering around a million patients. IQVIA used the database for observational studies requested by pharmaceutical companies. IQVIA treated the data as anonymous. The Garante did not agree with this classification and considered that the data is, instead, pseudonymised patient-level personal data that is subject to the GDPR.

This decision by the Garante is particularly interesting. As we discussed in our earlier post on the EU Digital Omnibus, the EU is in the middle of a wider effort to simplify its digital rulebook. One of the changes on the table in the Digital Omnibus is a narrower concept of personal data, so that coded data in the hands of a company that has no realistic way of identifying who the patients are would fall outside the scope of the GDPR. The Garante decision shows, however, that, in the meantime, regulators are  taking a strict and conservative approach to what constitutes personal data.

Continue Reading Pseudonymised, Not Anonymous: What the Italian Garante’s €7 Million IQVIA Fine Means for Health Data

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during August 2026 from the EU and UK.

The more significant developments this month have been in the data protection space. Notably, Uber was fined almost €825 million following a finding that they breached the general prohibition on fully automated decision-making in the General Data Protection Regulation (GDPR). This decision serves as an important reminder for the need for meaningful human review in the Life Sciences industry as companies increasingly rely on AI-assisted decision-making, for example in screening candidates for eligibility to take part in clinical trials.

Further, the European Data Protection Board (EDPB) has written to the European Commission to request that the commission “closely assess” the recent U.S. Supreme Court decision of Trump v. Slaughter and its impact on the EU-U.S. Data Privacy Framework (DPF) adequacy decision. The EDBP has raised that this decision, which holds that the statutory protection against removal of Federal Trade Commissioners are unconstitutional, may affect the validity of the DPF decision.

Other developments include that the International Medical Device Regulators Forum (IMDRF) has published technical guidance regarding Predetermined Change of Control Plans (PCCP) for medical device software. This guidance intends to foster regulatory harmonization by identifying the essential principles for developing PCCP. 

Continue Reading Virtual and Digital Health Digest – September 2026

Since 12 September 2025, the EU Data Act (Regulation (EU) 2023/2854, the “EU Data Act”) has required manufacturers of connected products and providers of related services to make in-scope data accessible to users, whether through direct or indirect access mechanisms. On 12 September 2026, a further dimension of that obligation becomes applicable: new connected products and related services placed on the EU market after that date must be designed with direct access capabilities built in by default, where relevant and technically feasible. Because the obligation to provide direct access is explicitly not absolute, manufacturers that already offer users indirect access through a portal or account may find that the practical change is limited.

The September 2026 date is nonetheless a valuable opportunity for companies, including those in the life sciences sector, to review their compliance position: not only on access by design, but across the broader set of EU Data Act obligations that have been applicable for almost a year and are now increasingly attracting scrutiny from marketplaces, customers, and emerging national enforcement bodies.

Continue Reading The EU Data Act’s Access-by-Design Deadline: What Life Sciences Companies Need to Know Before September 2026

On 12 August 2026, the EU Packaging and Packaging Waste Regulation (Regulation (EU) 2025/40) (the “PPWR”) becomes applicable. It replaces the long-standing Packaging and Packaging Waste Directive with a directly applicable, EU-wide regime governing the design, documentation, labelling and end-of-life management of virtually all packaging placed on the EU market. Some in the life sciences field may assume that medical device, IVD and pharmaceutical packaging sits outside general packaging rules. That assumption is misguided: the PPWR applies broadly, and the sector-specific exemptions it contains are narrow and conditional.

Non-compliance is not a minor administrative matter. Packaging that does not meet PPWR requirements cannot lawfully be placed on the EU market, and life sciences companies that fail to act risk losing EU market access for their products, regardless of whether those products themselves hold valid CE Certificates of Conformity under the MDR, IVDR or marketing authorisation under applicable pharmaceutical legislation.

Continue Reading The EU Packaging and Packaging Waste Regulation: Why Life Sciences Companies Should Act Now

On 7 July 2026, the European Data Protection Board (“EDPB”) adopted its Guidelines 02/2026 on Anonymisation for public consultation (the “Guidelines”), replacing the Article 29 Working Party’s Opinion 05/2014 that served as one of the primary EU references on the topic for over a decade.

Since 2014, the legal landscape has, however, shifted considerably, most notably through the Court of Justice’s judgment in EDPS v SRB (Case C-413/23 P) (see our blog on that judgment), and the practical landscape even more so, with the proliferation of AI, large-scale data pooling, and cross-border research collaborations. For life sciences companies handling key-coded clinical data, safety reports, or real-world evidence, the Guidelines, once finalised and adopted, will set out a clear framework for determining when data is genuinely anonymous and therefore falls outside the GDPR’s scope.

Continue Reading EDPB Guidelines on Anonymisation: What Life Sciences Companies Need to Know

On 7 May 2026, the European Parliament and Council announced a provisional political agreement on the AI Act portion of the Digital Omnibus package. According to the European Parliament’s press release and the Council’s press release, the agreement aims to make compliance more workable, while maintaining its main provisions and risk-based approach. The agreed text has not yet been published, and the agreement remains provisional pending formal adoption by both institutions, which co-legislators intend to complete before 2 August 2026, the date on which the AI Act’s original high-risk system obligations were due to become applicable.

This blog post sets out what the press release describes as having been agreed, and flags the points most relevant to pharmaceutical and MedTech companies. As we noted in our earlier analysis, the Digital Omnibus on AI Proposal carries significant implications for life sciences companies. We will provide a fuller assessment once the agreed text is available and adopted.

Continue Reading EU AI Act Omnibus: Provisional Deal Announced – Initial Reflections for Life Sciences Companies

On 19 March 2026, the Court of Justice of the European Union (CJEU or Court) issued its judgment in Case C-526/24, Brillen Rottler GmbH & Co. KG v TC. The case concerned a data subject who subscribed to a German optician’s newsletter and, thirteen days later, submitted an access request under Article 15 GDPR. The company refused the request, arguing it was abusive. The data subject maintained it was legitimate and claimed at least €1.000 in non-material damages.

The CJEU’s judgment addresses three questions of broad significance: (1) when a first access request can be refused as “excessive”; (2) whether a violation of the right of access alone can give rise to a compensation claim under Article 82 GDPR; and (3) how non-material damage should be assessed in that context. While the judgment is relevant to all companies subject tot GDPR, we examine below the considerations it raises for life sciences companies specifically.

Continue Reading CJEU rules on GDPR access rights and abuse of rights: what the Brillen Rottler judgment means for life sciences companies

On 16 December 2025, the European Commission published its Proposal for a Regulation establishing a framework of measures for strengthening the EU’s biotechnology and biomanufacturing sectors, particularly in the area of health (the “European Biotech Act” or the “Proposal”). The Proposal is ambitious in scope: it amends several major pieces of EU health legislation, including the Clinical Trials Regulation (“CTR”), the Veterinary Medicines Regulation, the Food Law Regulation and the Substances of Human Origin Regulation (“SoHO”), while also introducing a new framework for EU strategic projects, AI-enabled biotechnology, and biodefence.

On 10 March 2026, the European Data Protection Board (“EDPB”) and the European Data Protection Supervisor (“EDPS”) adopted Joint Opinion 3/2026 on the Proposal (the “Joint Opinion”). While broadly supportive of the Proposal’s objectives, the EDPB and EDPS identified a number of significant data protection concerns, and issued recommendations. Although not legally binding, the Joint Opinion carries significant weight as it reflects the views of the EU’s primary data protection authorities and will directly shape the legislative debate ahead.

In this blog we examine the key data protection implications of the Proposal and the Joint Opinion for pharma and life sciences companies.

Continue Reading EDPB/EDPS Joint Opinion on the European Biotech Act Proposal: Key Data Protection Implications for Pharma and Life Sciences

On 19 November 2025, the European Commission published two legislative proposals – the Digital Omnibus on AI Regulation Proposal and the broader Digital Omnibus Regulation Proposal (“Proposals”) – as part of a wider initiative to simplify and streamline the EU’s digital regulatory framework. Together, the Proposals introduce targeted but significant amendments across a broad range of instruments, including the EU AI Act (Regulation (EU) 2024/1689), the GDPR (Regulation (EU) 2016/679), the ePrivacy Directive (2002/58/EC), the NIS2 Directive ((EU) 2022/2555), and the EU Data Act (Regulation (EU) 2023/2854).

Continue Reading EU Digital Omnibus: What the Proposed Reforms Mean for Pharma and MedTech

The Data (Use and Access) Act 2025 (“DUAA”) represents the UK’s first major reform of data protection law since leaving the EU. The Act aims to modernise the UK’s data protection framework by reducing administrative burdens on businesses, supporting innovation and maintaining high standards of data protection while enhancing the UK’s position as a competitive destination for data-driven industries.

As most of the data protection reforms introduced by the DUAA came into effect on 5 February 2026, life sciences companies should consider how the new framework reshapes their data protection compliance. While the DUAA introduces new rules, it also creates opportunities for the sector.

Continue Reading UK’s Data (Use and Access) Act: What Life Sciences Companies Need to Know