The revelation by Edward Snowden that the US National Security Agency (NSA) and the UK Government Communications Headquarters (GCHQ) have been gathering the email and mobile phone metadata of millions of European citizens, including politicians, has drawn public attention to the inherent risks of a globally connected information society. The level of public concern and outrage risks triggering a political overreaction that could be detrimental to biomedical research that crucially relies on sharing data and samples, if the balance is tipped too far in favour of strict privacy regulation. The discussion over spying has also drawn attention to the ongoing reform of the EU's legal framework to protect the private data of citizens. The law in the European Union is based on the Data Protection Directive 95/46/EC that was passed in 1995. In 2012, the European Commission presented the first draft of a Data Protection Regulation intended to supersede the former, and the latest amendments were released on October 21, 2013. The advantage of a Regulation is that it is directly applicable in its entirety by all member …