Comments on the definition of ‘scientific research’ in the Omnibus Act for the digital acquis
Evert-Ben van Veen, MedLawconsult, March 7, 2026
(in between brackets the endnotes. Don't click on them, just scroll down. Clicking on a note will lead you off this page. Apologies but this is after all a DIY site by someone not very tech savvy)
- Introduction, question discussed in this comment
On November 19 2025 the European Commission (hereinafter the EC) issued two Omnibus Acts aiming to ease the administrative burdens and complexity of the – fairly – recent digital legislation of the European Union (EU). Both draft Acts were leaked shortly before their official release and created quite a stir. After their official release they still do. While the Commission maintains that the amendments are technical and ‘the measures are calibrated to preserve the same standards for protections of fundamental rights’[1], a broad array of civil rights and data protection organisations protested against the proposed changes claiming that these would hallow out the fundamental right to data protection.[2] More criticism followed as will be discussed later in this paper.
Against that background, the focus of this comment is very modest. I will only discuss one proposed clause of the Digital Omnibus[3] amending the GDPR. That is the definition of scientific research.[4] This clause on research is new. It will have ramifications beyond the GDPR as research is mentioned in other Acts concerning data[5] as well and it can be expected that the definition of research in the GDPR will be applied to the provisions on scientific research in those other Acts. After all, all refer to the GDPR. So that definition had rather be good. I state that it is not and propose an alternative definition.
2 The proposed new clause on scientific research
2.1 Text of the new clause
The proposal reads as follows:
“scientific research” means technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’
2.2 First critical assessment of the test
Bluntly, this is a horrible text. It is a strange mix of semi factual statements about what is normally understood under scientific research, but leaving the essence out, and normative statements about what such research should achieve and how that should be achieved.
In general, definitions of a term in a legislative act should be neutral as to what the definition entails in its normative consequences. Those consequences come in the clauses about activities around the defined term. Obviously, sometimes the neutrality is relative. The definition sets the boundaries of the normative consequences and when the definition is more restricted, so will be the boundaries.
A simple example would be the regulation of ‘fatbikes’ which make the Dutch streets unsafe today, both for pedestrians and the -usually - kids who drive them. The idea was to define a fatbike as a bicycle with a small electromotor and tires from 70 mm width onwards. Those could be forbidden under certain age and/or the obligation of wearing a casket, and via municipal regulations completely banned from certain streets. In that case anything similar but with tyres till 699 mm width would escape those regulations. On a more fundamental level, the same seems to apply to the definition of personal data in the GDPR which is also addressed in the Digital Omnibus. This subject is too complicated to be discussed in a relatively concise comment.[6]
However, in the case of scientific research and the GDPR, the GDPR hardly holds normative clauses which set normative boundaries. On the contrary the GDPR holds certain exemptions to the normal regime for scientific research.[7] Those are often subject to 89.1 GDPR, and that is a normative boundary, but otherwise the normative aspects of scientific research are not spelled down in the GDPR or in any other EU act. Which is logical as the EU is not competent to directly regulate the normative aspects of scientific research as such.[8] But when balancing fundamental rights in the context of data protection with a certain narrow leeway for research[9], a certain normative element must come into the definition of the latter as well.
Yet the European Commission (EC) – or its staff - got it completely wrong here.
Take the first sentence: “scientific research” means technological development and demonstration. That would literally mean that only technological development and demonstration are considered scientific research which is obviously nonsense. Fundamental or applied sociological research into patterns in society, using (personal) data, can hardly be called technological. Research is not about technological development but about ‘the quest for knowledge obtained through systematic study, thinking, observation, and experimentation’.[10]
The results of that research make open democratic societies thrive, even if those results might be obnoxious to some or do not lead to new technologies.[11]
In that vein the second sentence, with my emphasis ‘……carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing’. I easily agree with the growth of general knowledge. But what about: and wellbeing? What is that, who decides that? Hence not research which might be confrontational, either to the public where some don’t like to hear about those results or to the powers to be who may decide about what the general public should know or should not know as it might jeopardise their ‘wellbeing’?[12] If it would have been ‘or wellbeing’ I would not oppose though I would find it rather senseless. But the combination of the two phrases via ‘and’ means that research is only research if it contributes to ‘wellbeing’. That opens the door to censorship.[13]
‘and adhere to ethical standards in the relevant research area’. This addition leads to various comments:
- It adds a normative element, which as mentioned in general should be avoided in a definition. It means that research which does not adhere to the applicable ethical standards, is not research in the sense of the GDPR and all other Acts which mention research and also refer to the GDPR.
- However, as we must have a normative element, to distinguish good science from bad science, why only ‘ethical standards’? Good scientific research should also adhere to the applicable regulations and to standards of research integrity (which also encompasses using the correct methodology for the research).
Then the last sentence: This does not exclude that the research may also aim to further a commercial interest.’. I don’t disagree and the EU also needs ‘commercial research’. But the wording is clumsy. Why would the earlier sentences exclude that?
2.3 What did others say about the new clause
I will be brief here. The NOYB foundation, an influential privacy advocacy group, made a detailed analysis of the whole Digital Omnibus.[14] As could be expected, NOYB is also very critical. On this specific clause NOYB states in sum that the definition is too broad, tilts towards technical innovation and that actual academic research in medicine, humanities or natural science may partly lose the current privileges in the GDPR. The wording leads to more confusion than clarification. Such a broad definition would also undermine data subjects rights. It might be abused by commercial entities to shield processing activities form the GDPR especially as there are no ethical standards developed for their field. NOYB’s conclusion is to reject the clause.
The EDPB and EDPS commented on the Digital Omnibus as well.[15] Their comments are more lenient about the proposed clause and in essence challenge the present definition for failing to address what scientific research is really about. The definition would include product research which might not be scientific research and might exclude research in the humanities and social sciences which are scientific research.
As shown above, I largely concur with the EDPB/EDPS analysis. The joint statement does not attempt an alternative definition. That’s then my next step.
3 Proposal for a new text
There comes a question first. Do we need a definition of scientific research? I am unaware of situations when using one of the research exemptions was challenged with a claim that the data processing was not scientific research. But that might be my ‘bubble’ of working with very responsible researchers in the life sciences. When there is room for doubt, a definition would be helpful, and I prefer that the legislator makes one instead of a body like the EDPB. In each case, it should be a good one. Without claiming a monopoly on the truth, the following definition would be much better (with between the brackets the part of which I am less sure):
‘scientific research’ means the quest for knowledge obtained through systematic study, thinking, observation, and experimentation, while adhering to applicable regulations (and ethical standards) and generally accepted standards of research integrity. Such scientific research may also further a commercial interest’
The ‘quest for knowledge etc.’ in the definition is taken from the ALLEA code on research integrity which can be seen as the European standard. It is open to any kind of type of scientific research.
But then come the normative elements as the standards by which research should adhere to as those cannot be found elsewhere in binding EU legislation[16] In that case each element should contain a concrete angle for if not ex ante supervision, ex ante accountability.
The first is applicable regulations. That research should adhere to those is obvious but, in this context, not a tautology as there is more beyond the GDPR. Applicable regulations can also refer to nationally applicable legislation. Additionally, the whole body of the European digital legislation is also covered by it. Obviously also the clinical trial regulation is encompassed when applicable.
I am less sure about ethical standards. That is also broad but by contrast rather vague. Does it give a concrete angle for supervision or accountability? If ethical review must be performed ex ante, that would already be covered by ‘applicable regulations’. For ex post accountability, we might get into difficult discussions where opinions may reasonably differ. There is an enormous body of ethical literature on research not all pointing in exactly the same direction and as this definition might become applicable across the whole range where scientific research with data is mentioned in EU legislation, outside that which refers to specific funding opportunities, too much ambiguity should be avoided.[17]
There is an alternative to ethical standards. As the standards of research integrity do give standards for ex ante supervision and ex post post accountability. According to the Allea 2023 Code (footnote 10) those standards are based on 4 fundamental principles:[18]
- Reliability in ensuring the quality of research, reflected in the design, methodology, analysis, and use of resources.
- Honesty in developing, undertaking, reviewing, reporting, and communicating research in a transparent, fair, full, and unbiased way.
- Respect for colleagues, research participants, research subjects, society, ecosystems, cultural heritage, and the environment.
- Accountability for the research from idea to publication, for its management and organisation, for training, supervision, and mentoring, and for its wider societal impacts.
The principles are elaborated in the following provisions of the Code. As the Allea Code shows, the Code is not only applicable to academic research institutions. Researchers and organisations – which can be commercial - are addressed as well. It covers general aspects of good ethical research governance. Referring to generally standards of research integrity and mentioning the Allea code in the Recital should, together with applicable regulations, be sufficient to distinguish ‘bone fide’ research as Floridi et al.[19] have called it, from research which cuts corners.[20]
4 Concluding remarks
With the above I hope to propose a definition of scientific research in the GDPR which is more concise and more practicable. I have little doubt that any new definition will still include ‘ethical standards’ as that phrase seems to have become the ubiquitous magical formula to distinguish good from bad science. So be it, though in my opinion the phrase lacks clarity, especially in harder cases, and only as long as ‘research integrity’ remains in it as a normative standard as well.
As usual, even when writing a relatively short note on a concise subject, one stumbles over related subjects which would require further exploration, such as what I mean with an open democratic society and the role of science therein. A little of the veil is lifted in the footnotes, the rest is (perhaps) to follow.
Evert-Ben van Veen
[1] At p. 3 of Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus) Brussels, 19.11.2025 COM(2025) 837 final
[2] EDRI, The EU must uphold hard-won protections for digital human rights (not dated), see https://edri.org/our-work/europe-is-dismantling-its-digital-rights-from-within/
[3] See note 1.
[4] Article 3.2. of the Digital Omnibus Act.
[5] For example, article 2.6 of the AI Act, article 53.1.c of the European Health Data Space Regulation.
[6] I hope to come back to this soon.
[7] See e.g. articles 5.1.b last sentence, 9.2.i (referring to national or EU legislation), 14.5.5,17.3.d, 21.6 (if the research is also necessary for a task performed a in the public interest), 89.2 (referring to national or EU legislation).
[8] See Title XIX of the Treaty on the Functioning of the European Union.
[9] It should be mentioned the freedom of the arts and sciences is by itself mentioned as a fundamental right in article 13 of the Charter of the European Union. A study of the protection of that right in the legislation various European countries shows that insofar as this right is protected in the legislation, the right is not unfettered and bound by adhering to legislation protecting other rights and sometime research integrity. European Commission: Directorate-General for Research and Innovation. 2025. ‘A Comprehensive Legal, Policy, and Comparative Analysis for Promoting and Protecting the Freedom of Scientific Research in Europe – Final Report Document’. Publications Office of the European Union, https://doi.org/doi/10.2777/4268123.
[10] See the definition of research in the Code of Conduct on research integrity by the European Federation of Academies of Sciences and Humanities (Allea) 2023.
[11] This is not to say that democratic countries, with a free press produce more scientific papers. At present rather on the contrary. Ionnanidis and Baas show in a recent publication that more than three quarters of the Scopus indexed papers in 2024 stem from countries without ‘full democracy’ (Ioannidis, John P. A., and Jeroen Baas. 2026. ‘Most Science Is Published from Countries Lacking in Democracy and Freedom of Press’. Research Integrity and Peer Review 11 (1): 4. https://doi.org/10.1186/s41073-026-00190-6 ). However, as acknowledged by the authors, they do not distinguish between type of papers. If distinguished for research fields, my guess is that one would find different numbers for the ‘arts and humanities’ and ‘social sciences’. One of those interesting issues one stumbles upon at a first exploration of the tenet in the text. And the tenet implies the contrary. Results of research, especially in mentioned research fields help to produce, together with other mechanisms, that open society. (their paper provides references which I still must read). It is not about the other way around.
[12] In a later publication I will delve deeper into this, also speaking from my own experience, when during the aids crisis certain interest groups considered that information about the prevalence and incidence of HIV infections, when the virus was discovered (but long before a treatment became available), should be withheld or at least be brought with utmost caution because of potential stigmatising effects. See A. Mooij, Geen Paniek! AIDS in Nederland 1982-2004, Bert Bakker, Amsterdam, 2004. But the information which slipped through, may have saved my life.
[13] Which does not mean that I am against ‘responsible research and innovation’ when certain new technologies appear on the horizon.
[14] NOYB. no date. ‘Digital Omnibus First Analysis of Select GDPR and ePrivacy Proposals by the Commission, Version 3’. https://noyb.eu/en/digital-omnibus-report-v3-analysis-select-gdpr-and-eprivacy-proposals-commission
[15] EDPB-EDPS JOINT OPINION 2/2026 On the Proposal for a Regulation as Regards the Simplification of the Digital Legislative Framework (Digital Omnibus) Adopted on 10 February 2026’. February 10. https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-22026-proposal_en.
[16] With the ‘golden cords’ of funding the EU sets normative standards but that reach is then limited to EU funded projects.
[17] Obviously, this needs more explanation. I will come back to that on another occasion. For the moment, the following. Without doubt, there is hard core of ethical standards but then those are usually embedded in regulations already. Also then, there can be discussions about difficult cases as clinical research with incompetent patients. For an example see: Timmers, Marjolein, Evert-Ben Van Veen, Andrew I. R. Maas, and Erwin J. O. Kompanje. 2019. ‘Will the Eu Data Protection Regulation 2016/679 Inhibit Critical Care Research?’ Medical Law Review 27 (1): 59–78. https://doi.org/10.1093/medlaw/fwy023. In observational research, the discussion is even more diverse with more or less strict adherents to individual consent to those who emphasise solidarity and associated mechanisms that the research will further the public good if certain conditions are met. With the potential broad application of the definition, also other research areas come into focus, such as embryo research where opinions differ even more sharply. See for example CJEU 19 December 2019, ECLI:EU:C:2019:1113.
[18] The text states ‘include’, suggesting that these 4 principles are not exhaustive.
[19] Floridi L, Luetge C, Pagallo U, Schafer B, Valcke P, Vayena E, et al. Key ethical challenges in the European medical information framework. Minds Machine 2018. https://doi.org/10.1007/s11023018-9467-4.
[20] Earlier I distinguished more criteria, see E.B. van Veen, ‘Observational Health Research in Europe: Understanding the General Data Protection Regulation and Underlying Debate’. European Journal of Cancer 104 (November 2018): 70–80. https://doi.org/10.1016/j.ejca.2018.09.032. In retrospect those are too vague to be embedded in a legislative text.