This is a summary of public texts for policy readers. It is not legal advice, no lawyer has reviewed it, and the primary instruments should be read directly. How monitoring systems are organised is covered separately in surveillance systems.
How is genetic data classified in EU law?
As a special category. Article 9(1) of the General Data Protection Regulation prohibits the processing of genetic data, alongside biometric data used for identification and data concerning health, unless one of the exceptions in Article 9(2) applies.
Four exceptions carry most of the weight in this field. Explicit consent for specified purposes, unless Union or Member State law provides that consent cannot lift the prohibition. Preventive or occupational medicine, medical diagnosis and health care management, subject to professional secrecy conditions. Public interest in the area of public health, which must rest on Union or Member State law with specific safeguards. And scientific or historical research and archiving in the public interest, which must also rest on such law, be proportionate and include safeguards.
Article 9(4) allows Member States to maintain or introduce further conditions, including limitations, for genetic, biometric and health data. A multi-country study or registry therefore faces a common prohibition with a national layer on top, and the national layer is where the differences appear.
What does practice look like in prion disease?
Narrower than the statute, and shaped by clinical convention rather than by data law.
Release of a result is gated by consent documents at the laboratory. The United States surveillance centre requires its PRNP request form with the social and family history section completed, together with a genetic consent form, before testing, and returns results to the ordering health care provider to be shared with the patient or family rather than directly to the person tested. It does not test patients under 18.
Registries of people at risk generally do not plan individual data sharing. The PROSPECT registry, a prospective observational study of adults at risk for genetic prion disease run from University Hospitals Cleveland Medical Center with Case Western Reserve University, the CJD Foundation and Prion Alliance as collaborators, is recruiting asymptomatic adults who are United States residents, with annual assessments for up to 10 years and a target of about 2,000 participants. Saliva is collected for genetic testing and DNA retained under study procedures and consent. Its registry record states that individual participant data sharing is not planned.
That setting is worth noting for anyone designing a data policy: the largest prospective cohort of at-risk people is single-site, consent-based, and closed to individual-level sharing by default.
Why does rarity change the analysis?
Because de-identification does less work than it does in common disease. A cohort of carriers of a named PRNP variant in one country can be small enough that a variant name, an age band and a region identify a household. A genetic result is also information about relatives who never consented to anything.
Two consequences follow for policy. Aggregate publication thresholds that are adequate for common conditions can be disclosive here, and research consent needs to address relatives as well as participants. The sources opened here do not show either point being handled by a published prion-specific standard.
What is not established
No prion-specific data protection guidance was found in the sources read. The field is governed by general instruments, by national additions under Article 9(4), and by individual study and laboratory consent documents, with no published comparison of how those three interact across countries. A regulator reviewing a cross-border registry proposal in this disease would need the national conditions, not the EU text alone.
Evidence for regulators covers the therapeutic evidence base, the regulations atlas tracks the documents and surveillance centres the bodies that hold the data. Corrections with a public source are welcome at corrections@thegenerativebrain.org.