(fra kommisjonsforordningen)

(1) Regulation (EU) 2024/1938 requires the Commission to establish, manage and maintain a digital platform to facilitate efficient and effective exchange of information concerning substances of human origin (SoHO) activities in the Union (the ‘EU SoHO Platform’).

(2) Regulation (EU) 2024/1938 provides for the processing of personal data, including data concerning health, exchanged through the EU SoHO Platform, where necessary, in the interest of public health and for the purposes of helping to identify, evaluate and manage risks associated with a particular SoHO donation or SoHO donor, including pseudonymised donor identification in the case of rapid alerts, and for the processing of relevant information on clinical-outcome monitoring, including pseudonymised clinical data provided in support of SoHO preparation authorisations.

(3) As sensitive personal data, including data concerning health, may be exchanged through the EU SoHO Platform, the Platform should provide a secure channel for restricted exchange of information and data.

(4) Personal data should be stored on the EU SoHO Platform for a limited period. As some diseases can have a long incubation time and may cause symptoms after 25 to 30 years (e.g. Creutzfeldt–Jakob disease), it is necessary to apply a retention period of 30 years after donation or human application for personal data related to the safety, quality and effectiveness of SoHO.

(5) In order to ensure good administration and sufficient transparency of SoHO supervisory activities and SoHO activities, the personal data of authorised actors should be retained for up to 5 years from the date that they no longer operate as authorised actors.

(6) To ensure the ability to verify whether the SoHO Coordination Board acted in an independent and impartial manner, including in the event of complaints or litigation, the personal data of the SoHO Coordination Board members and alternates should be retained for up to 15 years from the date on which the member or alternate no longer participates in the SoHO Coordination Board.

(7) In order to ensure the safety and security of personal data processed through the EU SoHO Platform, the Commission should put in place and keep up to date state-of-the-art technical and organisational measures, including data access control.

(8) In order to facilitate efficient and effective exchange of information concerning SoHO activities in the Union through the EU SoHO Platform, its user interface should be provided in English as the commonly understood language in the field of SoHO. SoHO entities, SoHO competent authorities, Member States, the SoHO Coordination Board and the Commission should exchange information of cross-border interest through the EU SoHO Platform in that commonly understood language in the field of SoHO.

(9) As Regulation (EU) 2024/1938 applies from 7 August 2027, the application of this act should commence on the same date.

(10) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (2) and delivered an opinion on 3 June 2025.

(11) The measures provided for in this Regulation are in accordance with the opinion of the Committee established by Article 79(1) of Regulation (EU) 2024/1938,