At the EU level, there are two main legislative acts regulating pharmaceuticals: Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001 on the Community code relating to medicinal products for human use (Community Code) and Regulation No 726/2004 of the European Parliament and of the Council of 31 March 2004 laying down Community procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency (Regulation 726/2004). European directives must be implemented into the EU member states’ national legislative framework, whereas European regulations are directly and immediately enforceable.
Further legislation exists for more specific topics, such as advanced therapy medicinal products, orphan medicines, medicines for paediatric use, clinical trials, etc.
The European Medicines Agency (EMA) is a decentralised agency of the EU, located in Amsterdam following Brexit. It began operating in 1995. The EMA is responsible for the scientific evaluation, supervision and safety monitoring of medicines in the EU. Several bodies assist the EMA in its work, including the Committee for Medicinal Products for Human Use (CHMP). For further information, see www.ema.europa.eu.
With regard to applications for a centralised marketing authorisation (MA) for a medicinal product, Article 9 of Regulation 726/2004 stipulates that the applicant may, within 15 days of receipt of the opinion, give written notice to the EMA that he or she wishes to request a re-examination of the CHMP opinion. The applicant shall then provide the CHMP, within 60 days of receipt of the opinion, with the detailed grounds for the request. The CHMP will re-examine its opinion within 60 days of receipt of the grounds for the request. The reasons for the conclusion reached shall be annexed to the final opinion.
Also, an action for annulment can be lodged with the General Court of the European Union (GCEU), by the applicant or any other directly and individually concerned parties, against the Commission's decision on the centralised MA for a medicinal product.
Decisions of the EMA (eg, regarding access to clinical and non-clinical information under the so-called 'Transparency Regulation' No 1049/2001) can be challenged before the GCEU as well.
An appeal against the judgements of the GCEU is then possible before the Court of Justice of the European Union (ECJ).
Article 1(2) of the Community Code defines a medicinal product as “any substance or combination of substances presented for treating or preventing disease in human beings.” The same provision adds that “[a]ny substance or combination of substances which may be administered to human beings with a view to making a medical diagnosis or to restoring, correcting or modifying physiological functions in human beings is likewise considered a medicinal product.”
Medical devices, cosmetics and nutritional products do not fall within the scope of the Community Code and the Regulation. Each is regulated through its own EU legislation.
The main legislative act at European Union level for medical devices is currently Council Directive 93/42/EEC of 14 June 1993 concerning medical devices (MDD). In the MDD, a medical device is defined as “any instrument, apparatus, appliance, material or other article, whether used alone or in combination, including the software necessary for its proper application intended by the manufacturer to be used for human beings, for the purpose of (a) diagnosis, prevention, monitoring, treatment or alleviation of disease, (b) diagnosis, monitoring, treatment, alleviation of or compensation for an injury or handicap, (c) investigation, replacement or modification of the anatomy or of a physiological process, (d) control of conception, and which does not achieve its principal intended action in or on the human body by pharmacological, immunological or metabolic means, but which may be assisted in its function by such means”.
Other legislative acts exist for active implantable medical devices (Council Directive 90/385/EEC of 20 June 1990 on the approximation of the laws of the Member States relating to active implantable medical devices) and in vitro diagnostic medical devices (Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on in vitro diagnostic medical devices).
Two European regulations concerning medical devices were adopted in 2017. These legislative acts will only enter into force in 2020 (Regulation 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation No 178/2002) and 2022 (Regulation No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC and Regulation 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission Decision 2010/227/EU).
With regard to cosmetic products, Regulation 1223/2009 of the European Parliament and of the Council of 30 November 2009 on cosmetic products is the main legislative EU act (Cosmetics Products Regulation). In the Cosmetics Products legislation, a cosmetic product is defined as “any substance or mixture intended to be placed in contact with the external parts of the human body (epidermis, hair system, nails, lips and external genital organs) or with the teeth and the mucous membranes of the oral cavity with a view exclusively or mainly to cleaning them, perfuming them, changing their appearance, protecting them, keeping them in good condition or correcting body odours.”
Directive 2002/46/EC of the European Parliament and of the Council of 10 June 2002 on the approximation of the laws of the Member States relating to food supplements (Food Supplements Directive), the main EU legislative act, defines food supplements as “foodstuffs the purpose of which is to supplement the normal diet and which are concentrated sources of nutrients or other substances with a nutritional or physiological effect, alone or in combination, marketed in dose form, namely forms such as capsules, pastilles, tablets, pills and other similar forms, sachets of powder, ampoules of liquids, drop dispensing bottles, and other similar forms of liquids and powders designed to be taken in measured small unit quantities.” Nutrients are further defined as vitamins or minerals.
Despite these definitions, it is quite often still unclear whether a product should be classified as a pharmaceutical, a medical device, a cosmetic or a nutritional product. For such products, guidelines exist, such as, for medical devices, the Manual on Borderline and Classification in the Community Regulatory Framework for Medical Devices and, for cosmetic products, the Manual of the Working Group on Cosmetic Products (Sub-Group on Borderline Products) on the Scope of Application of the Cosmetics Regulation. However, the decision on the classification of a product is taken on a case-by-case basis by the authority which is competent in the case at hand.
A coherent regulatory framework for functional food had been lacking within the EU until in December 2006 the European Parliament and the Council adopted a new Regulation No 1924/2006 on nutrition and health claims made on foods. This Regulation applies to nutrition and health claims made in commercial communications (labelling, presentation or advertising of foods) to be delivered as such to the final consumer, including foods which are placed on the market unpacked or supplied in bulk. It also applies to foods intended for supply to restaurants, hospitals, schools, canteens and similar mass caterers.
Regulation No 609/2013 of the European Parliament and of the Council of 12 June 2013 on food intended for infants and young children, food for special medical purposes, and total diet replacement for weight control and repealing Council Directive 92/52/EEC, Commission Directives 96/8/EC, 1999/21/EC, 2006/125/EC and 2006/141/EC, Directive 2009/39/EC of the European Parliament and of the Council and Commission Regulations No 41/2009 and No 953/2009 establishes compositional and information requirements for the following categories of food:
Food for special medical purposes is defined as “food specially processed or formulated and intended for the dietary management of patients, including infants, to be used under medical supervision; it is intended for the exclusive or partial feeding of patients with a limited, impaired or disturbed capacity to take, digest, absorb, metabolise or excrete ordinary food or certain nutrients contained therein, or metabolites, or with other medically determined nutrient requirements, whose dietary management cannot be achieved by modification of the normal diet alone.”
Medicinal Products Subject to Medical Prescription
Article 70 of the Community Code provides that, when an MA is granted, the competent authorities shall specify the classification of the medicinal product as either:
Pursuant to Article 71 (1) of the Community Code, medicinal products shall be subject to medical prescription where they:
Article 70 (2) of the Community Code further stipulates that the competent authorities may further fix sub-categories for medicinal products which are available on medicinal prescription, such as:
Medicinal Products Subject to Special Prescription
Article 71 (2) of the Community Code provides that, when member states provide for the sub-category of medicinal products subject to special prescription, they should take account of whether:
Medicinal Products Subject to Restricted Prescription
For the sub-category of medicinal products subject to restricted prescription, Article 71 (3) of the Community Code provides that member states shall take into account whether:
A competent authority may waive the application of the above criteria having regard to:
Article 72 of the Community Code further stipulates that medicinal products not subject to prescription shall be those which do not meet the criteria listed in Article 71 of the Community Code.
Furthermore, separate definitions exist for a number of medicinal products such as generic medicinal products, paediatric medicinal products, orphan medicinal products, advanced therapy medicinal products, traditional herbal medicinal products and immunological medicinal products.
Clinical trials are regulated in the EU by Directive 2001/20/EC of 4 April 2001 on the conduct of clinical trials on medicinal products for human use (CTD). The CTD is concretised further by Directives laying down guidelines and principles of good clinical practice (Directive 2005/28/EC) and good manufacturing practice (Directive 2003/94/EC).
The CTD will be replaced by Regulation (EU) No 536/2014 of 16 April 2014 on clinical trials on medicinal products for human use (CTR), which is currently expected to enter into force in 2020. The main goals of the CTR are to increase the attractiveness of the EU for clinical research, ensure patient safety, ensure reliable and robust clinical data, and increase transparency.
Detailed guidance on the authorisation and conduct of clinical trials can be found in EudraLex – Volume 10: Clinical Trials Guidelines.
International authoritative guidance is provided by the 'ICH Guidelines', a set of harmonised scientific and technical guidelines adopted by the International Council for Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use (ICH).
Furthermore, the 1964 Declaration of Helsinki of the World Medical Association, as last amended in 2013, sets out ethical principles for medical research involving human subjects.
A clinical trial can only start after the Ethics Committees of each EU member state where the clinical trial is intended to be performed have issued a favourable opinion, and a request for authorisation has been submitted to, and accepted by, the national competent authority (NCA) of each EU member state where the clinical trial is intended to be performed. In other words, in each EU member state concerned two applications need to be submitted: one to the Ethics Committee and another one to the NCA. Both procedures can, but should not, be run in parallel.
An Ethics Committee is an independent body, usually established within hospitals, which consists of both healthcare professionals and non-medical members. Its role is to protect the interests, rights and safety of the participants in the trial. The Ethics Committee will review certain documents relating to the trial, including the trial protocol, recruitment materials, information leaflet and informed consent form. It has a maximum of 60 days to give its reasoned opinion to the applicant and the NCA. For multi-centre trials, a single opinion is issued by one Ethics Committee per EU member state concerned.
The NCA will review the protocol, investigator’s brochure (ie, a compilation of the relevant clinical and non-clinical data on the investigational medicinal product(s)) and the investigational medicinal product dossier, which includes information on the product’s quality and manufacture and data from non-clinical studies and clinical use. The NCA will assess, within a period of at most 60 days, whether the anticipated therapeutic and public health benefits of the trial justify its risks and inconveniences. The NCA may either accept the request for the clinical trial authorisation, accept the request subject to conditions, or not accept the request, providing reasons for its decision.
The CTR streamlines the application procedure by enabling sponsors to submit a single application dossier to all EU member states concerned through an online portal (the 'EU portal'). This single application, which replaces the current double application in each EU member state concerned, will be subject to a harmonised assessment procedure, which is divided in two parts. The first part of the application (administrative and scientific aspects) is jointly assessed by all EU member states concerned, with one of them acting as the reporting member state. The second part (ethical and national aspects) is assessed separately by each member state concerned.
All ongoing or completed clinical trials falling within the scope of the CTD are included in a European database called EudraCT. Certain information contained in EudraCT is made available to the public through the EU Clinical Trials Register, which is a part of EudraPharm, a public database of medicinal products authorised in the European Economic Area (EEA). The EU Clinical Trials Register provides information on interventional clinical trials on medicines conducted in the EEA and, in limited circumstances, outside the EEA, which started after 1 May 2004.
The European Commission has issued guidelines on which data fields of the EU Clinical Trials Register are made accessible to the public. The published data include certain protocol-related information, including the design of the trial, sponsor, investigational medicinal product (trade name or active substance), therapeutic areas and status (authorised, ongoing or complete). In addition, some results-related information is published, including trial information, subject disposition, baseline characteristics, endpoints and adverse events.
Aiming to increase transparency on clinical trials data, the CTR provides for the creation of a single EU Database that contains all relevant information on clinical trials in the EU submitted through the EU Portal. All information in the EU Database will in principle be publicly accessible, unless the confidentiality of the information can be justified on the basis of any of the following grounds:
The CTD does not expressly regulate the use of online tools to support clinical trials. However, if online tools are used (eg, for recruitment purposes), they should normally be described in the clinical trial protocol, which is submitted to and reviewed by the Ethics Committee and NCA.
Importantly, as the CTD applies without prejudice to more protective national provisions on the protection of clinical trial subjects, it is possible that EU member states provide in their national laws for more stringent provisions on the use of online tools in the context of clinical trials.
Similarly to the CTD, the CTR contains no specific provisions on the use of online tools to support clinical trials.
The data resulting from clinical trials are generally regarded as personal data, unless it would be impossible to identify the data subjects (including with the help of third parties). Pseudonymous data, where the identifiers are replaced by a code and can only be linked back to an individual using a key which is kept separate, are considered to be personal data.
If this information concerns the person’s health, it will be regarded as falling into a special or 'sensitive' category of data for which stricter rules apply, and the processing of which is prohibited unless one of the conditions listed in Article 9(2) of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation or GDPR) applies. The same holds true for genetic data or biometric data which are used for the purpose of uniquely identifying a person.
If personal data are shared with third parties (including affiliated companies), the data subject will need to be informed of this transfer.
In addition, further measures may be required depending on the location of the recipient. Under the GDPR, personal data can be transferred within the European Economic Area and to third countries which have been recognised by the European Commission as providing an adequate level of protection. A list of these countries can be found on the European Commission’s website. For any transfers where the recipient is located in a third country which is not included in this list, the parties will have to adduce safeguards protecting the personal data. This could take the form of standard contractual clauses or binding corporate rules.
The creation of a database containing sensitive data is likely to constitute a large-scale processing of special categories of data (eg, health data). Under Article 35 of the GDPR, large-scale processing of special categories of data requires a prior data protection impact assessment (DPIA). The DPIA assesses the risk to the rights and freedoms of the data subjects and allows the controller to implement safeguards mitigating these risks. If the DPIA results in a high residual risk, the controller must consult the responsible data protection supervisory authority prior to the start of the database.
In what follows, only the centralised authorisation procedure will be considered as this is the only procedure governed and administered exclusively by EU law and bodies, and results in a marketing authorisation valid throughout the EU and in three non-EU member states.
For the assessment process and the related criteria for determining whether or not a product should be classified as a pharmaceutical, see 1.4 Borderlines between Pharmaceuticals and Other Life Sciences Products, above.
The European system offers several routes for the authorisation of medicinal products. While all are governed by EU law to some degree, only one is also administered by EU bodies:
Purely national authorisations are still available for medicinal products to be marketed in one member state only.
There are specific rules for the authorisation of medicinal products for paediatric use, orphan medicines, traditional herbal medicinal products and vaccines.
A marketing authorisation is valid for five years from the date of notification of the Commission's decision to the marketing authorisation-holder, subject to renewal. This rule does not apply to conditional marketing authorisations, which are valid for one year.
Once renewed and subject to exceptions, a marketing authorisation will be valid for an unlimited period, unless the European Commission decides, on justified grounds relating to pharmacovigilance (eg, exposure of an insufficient number of patients to the medicinal product concerned), to mandate one additional five-year renewal.
Following the granting of a marketing authorisation, a medicine should be placed on the market within three years. Similarly, if a product that was placed on the market later is absent from the market for three consecutive years, the marketing authorisation will cease to be valid. All of this is subject to exemptions, to be granted by the European Commission.
Variations of Type II are variations that are not an extension of the Marketing Authorisation (line extension) and may have a significant impact on the quality, safety or efficacy of a medicinal product. By contrast, Type I variations are minor in nature. Both are brought about by an application of the marketing authorisation holder, but EMA may consider that a minor variation in fact constitutes a major one and therefore direct the marketing authorisation-holder to adapt its application for variation.
The competent authorities may suspend, revoke or vary a marketing authorisation if the product proves to be harmful in the normal conditions of use, if its therapeutic efficacy is lacking, if the risk-benefit balance is not favourable, if its qualitative and quantitative composition is not as declared, or if specific conditions related to the marketing authorisation are not fulfilled. For their part, products are withdrawn from the market if the reasons for the suspension, revocation or variation of a marketing authorisation are present, if the controls of the medicinal product and/or the ingredients and the controls at an intermediate stage of manufacturing have not been carried out and, finally, if other requirements or obligations relating to the granting of the manufacturing authorisation have not been respected.
The centralised procedure is predicated on a single application to place the product on the market throughout the EU. The European Medicines Agency carries out the scientific assessment while the European Commission takes a final decision after consulting a committee of member state representatives. The application contains five modules, including administrative and prescribing information, a Common Technical Document and data of tests and trials which demonstrate the efficacy, safety and quality of the medicinal product.
Variations are discussed in response to 3.3 Period of Validity, above.
A transfer of marketing authorisation is the procedure by which the marketing authorisation is transferred from an approved marketing authorisation-holder (MAH) to a new MAH which is a different person/legal entity. Such a transfer may result from the MAH’s commercial decision to sell or dispose of the MA or be needed in anticipation of the MAH ceasing to exist as a legal entity and MA being taken over by another legal entity. A transfer of MA does not include a transfer of orphan designation, since this is subject to a different procedure.
There are several provisions to promote patients’ early access to new medicines that address public health needs and are eligible for the centralised procedure, including:
Medicines authorised pursuant to the centralised procedure are subject to an elaborate set of pharmacovigilance rules. Pharmacovigilance is the process and science of monitoring the safety of medicines and taking action to reduce the risks and increase the benefits of medicines. It includes:
The stakeholders are the users of medicines who report adverse drug reactions, healthcare professionals working with medicines, regulatory authorities (including EMA and the authorities in the member states in charge of the safety of medicines) and pharmaceutical companies, as well as importers and distributors of medicines. Reported pharmacovigilance concerns may result in a variety of measures including a change of the marketing authorisation, its suspension, withdrawal or revocation, or a decision not to renew.
The post-authorisation period can give rise to a panoply of reporting and surveillance measures. These include conditional marketing authorisations and attendant marketing renewal requests, the annual re-assessment of specific obligations resting on the marketing authorisation-holder, the requirement to draw up post-authorisation safety studies or post-authorisation efficacy studies, the requirement to observe post-authorisation measures and the requirement to abide by a risk-management plan.
Access to information held by EMA will be governed by Regulation (EC) 1049/2001 (the 'Transparency Regulation') and by a series of internal policies and guidelines, some of which are still under review. As regards unpublished information, EMA indicates that it will try and make available the widest possible body of information in the interest of public health and the patient. However, restrictions apply to protect personal data and commercially confidential information. In addition, documents may be restricted or confidential to protect the interests of EU institutions. Pending applications will in principle be restricted until a final decision has been taken. On 5 February 2018 the ECJ issued three judgments validating EMA’s approach in that the exception to disclosure based on the protection of commercial interests does not create a general presumption of confidentiality.
The rules tackling falsified medicines are contained in Directive 2011/62/EU, the Falsified Medicines Directive, which amends and complements the Community Code (see 1.1 Legislation and Regulation, above). The Falsified Medicines Directive introduces harmonised European measures to fight medicine falsifications and ensure that medicines are safe and that the trade in medicines is rigorously controlled. Measures include:
Regulation (EU) No 608/2013 concerning customs enforcement of intellectual property rights contains rules and procedures to tackle the importation of counterfeit pharmaceuticals from third countries. The rules are enforced by the customs authorities upon entry of the goods into the EU.
Pricing and reimbursement are two areas that fall outside the scope of EU legislation and are firmly the domain of member state law. A notable exception is Directive 89/105/EEC (the 'Transparency Directive'), which defines a series of procedural requirements designed to verify that national pricing and reimbursement decisions do not create obstacles to the pharmaceutical trade within the EU’s Internal Market. However, these requirements are not stringent and leave the competencies of member states regarding prices and reimbursement largely intact. Groups of member states, such as the 'Beneluxa' countries (Belgium, The Netherlands, Luxembourg, Austria and Ireland), have begun co-operation on specific access, pricing and reimbursement matters, but the practical impact of these initiatives is still uncertain.
In addition, in January 2018 the European Commission tabled proposed legislation on Health Technology Assessment, but this proposal has proven to be very controversial. Its fate is uncertain.
The promotion and advertising of pharmaceuticals is governed by the Community Code and, in particular, Articles 86 to 100 thereof. Articles 88 to 90 of the Community Code relate to advertising aimed at the general public, whilst Articles 91 to 96 relate to advertising aimed at healthcare professionals (HCPs).
At EU level, it is not legally required to obtain an authorisation or to file a notification for the promotion and advertising of pharmaceuticals. However, Article 97 of the Community Code provides the possibility for the EU member states to introduce a system of prior vetting in order to ensure effective and adequate monitoring of advertising of pharmaceuticals. Several EU member states (eg, France) have introduced such a system.
Two main self-regulatory bodies exist for the promotion of pharmaceuticals at EU level: the European Federation of Pharmaceutical Industries and Associations (EFPIA) and Medicines for Europe. EFPIA represents the research-based pharmaceutical industry operating in Europe, whereas Medicines for Europe represents pharmaceutical companies supplying generic medicines. Both self-regulatory bodies have adopted a Code of Conduct containing, inter alia, rules on promotion and advertising.
Article 97 of the Community Code obliges EU member states to have procedures in place enabling courts and authorities to order the cessation of misleading advertising and/or prohibit the publication of imminent misleading advertising, the latter on the basis of an accelerated procedure.
The Community Code also entitles the EU member states to provide for other sanctions with a view to eliminating the continuing effects of misleading advertising where the cessation of such advertising has been ordered by a court, ie, publication of the court decision in full or in part and/or publication of a corrective statement.
Advertising and promotion regulations are, in general, being enforced by competitors as well as by third parties/bodies (eg, NCAs). Competitors and other third parties such as HCPs can lodge complaints with the NCA or initiate a lawsuit before the court in the case of infringement of advertising and promotion regulations. Moreover, the Codes of Conduct of EFPIA and Medicines for Europe oblige the national member associations to establish national procedures and structures to receive and process complaints, to determine sanctions and to publish appropriate details regarding these.
As regards the self-regulatory system at EU level, EFPIA requires, in the case of a breach of its Code of Conduct, that its national member associations obtain from the offending company an immediate cessation of the offending activity and a signed undertaking by that company to prevent recurrence. That Code of Conduct also provides that member associations must impose sanctions that are proportionate to the nature of the infringement, have a deterrent effect, and take account of repeated offences of a similar nature or patterns of different offences, with a combination of publication and fines generally being considered the most effective sanction.
The Code of Conduct of Medicines for Europe provides that its members are encouraged to report violations of the Code to their national association, which will handle such complaints in accordance with their own enforcement procedure. If the national association lacks an adequate enforcement procedure, Medicines for Europe has established a specific procedure at European level pursuant to which it has the power to impose sanctions, such as the exclusion of a member company, but it does not have the power to levy fines nor to award damages.
Sanctions imposed at the state level will vary depending on the country concerned. Often, the publication of the decision, fines or prohibition/forced removal of the advertisement or other promotional material concerned are imposed.
The duration of proceedings before self-regulatory bodies will vary depending on the procedural rules adopted by the national member association. As regards the state courts, the duration of cease-and-desist proceedings against a competitor’s advertising will also differ from country to country, depending on the national procedural rules, the backlog at the court, whether the national court requests a preliminary ruling from the ECJ, etc.
Both the Community Code and the Codes of Conduct of EFPIA and Medicines for Europe provide for restrictions regarding gifts and sponsorships to HCPs. The Community Code imposes the following restrictions in this respect:
The EU member states are allowed to impose further restrictions in this regard.
The Codes of Conduct of EFPIA and Medicines for Europe contain similar restrictions.
Nothing in the EU regulatory framework provides for the mandatory disclosure of transfers of value to HCPs, but so-called 'Sunshine Acts' have been adopted by several EU member states.
The Disclosure Code of EFPIA imposes on the member companies a specific disclosure obligation as regards transfers of value made, directly or indirectly, to or for the benefit of HCPs. This obligation does not apply, inter alia, to transfers of value in relation to over-the-counter (OTC) medicines or transfers of value that are part of ordinary course purchases and sales of medicines by and between member companies and HCPs (eg, pharmacists) or Health Care Organisations (HCOs). The Code of Conduct of Medicines for Europe states that companies should adhere to all applicable disclosure rules and requirements and also provides that companies should disclose engagements and transfers of value that could potentially pose a conflict of interest, or encourage the recipients of the transfers of value to disclose them, where such disclosure is in the best interest of the patient or the public at large.
Promotional materials often contain unreferenced comparative and superlative claims, unqualified safety/security claims, unreferenced efficacy claims ('proven', etc), exaggerated/all-embracing claims, hanging comparisons, etc. Some promote off-label use of medicines, which is prohibited. As regards sponsorship, the most common issue is hospitality to HCPs that is more generous than the law allows.
Advertising of pharmaceutical products is also subject, at EU level, to the provisions of:
Medical apps and other software may qualify as a medical device (as defined in Regulation (EU) 2017/745 of European Parliament and of the Council of 5 April 2017 on Medical Devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC). The MEDDEV 2.1/6, July 2016, Guidelines on the Qualification and Classification of Stand Alone Software Used in Healthcare within the Regulatory Framework of Medical Devices contain the relevant recommendations regarding medical software and applications ('MEDDEV 2.1/6 Guidelines'), including the requirements for the qualification of stand-alone software as a medical device.
The MEDDEV 2.1/6 Guidelines provide that, in addition to the requirement of fulfilling the definition of a Medical Device in the rules cited above, stand-alone software must have a medical purpose in order to qualify as a medical device.
Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the Application of Patients’ Rights in Cross-border Healthcare establishes the conditions pursuant to which a patient in the EU may travel to another EU country to receive medical care and reimbursement. The scope of Directive 2011/24 also covers healthcare costs, as well as the (electronic) prescription and delivery of medications and medical devices.
In particular, Directive 2011/24 aims as establishing an EU-wide system of ePrescriptions, which allows patients who are citizens of one EU member state to obtain prescription medicines or medical devices in another member state. The ePrescription also allows the country of residence of the patient to be informed that the prescription has been filled. The Commission adopted Guidelines on ePrescriptions Dataset for Electronic Exchange under Directive 2011/24 (the 'ePrescriptions Guidelines') on 18 November 2014.
On the other hand, Directive 2011/24 requires that EU member state to make available patient summaries (ie, a summary of their medical records) to be consulted in another EU member state. These patient summaries contain important health-related information such as allergies, current medication, previous illness, treatment history, etc.
The first ePrescription and patient summary projects are currently being rolled out using the eHealth Digital Service Infrastructure which connects the eHealth national services, allowing them to exchange health data.
Directive 2011/24 requires the member state of affiliation to ensure that the costs incurred by an insured person who receives cross-border healthcare are reimbursed, subject to the condition that the healthcare received is amongst the benefits to which the insured person is entitled to in the member state of affiliation (article 7.1). However, member states can introduce a system of 'prior authorisation' for going to another member state for treatment.
No response provided.
See 6.4 Electronic Prescription, above.
Regarding the import of pharmaceuticals, the following directives and regulations apply at the EU level:
As far as exports of pharmaceuticals are concerned, the following regulation applies:
The European Commission is in charge – at the EU level – of ensuring and monitoring the correct application of import regulations. In addition, the NCAs are responsible for such activities in their respective territories and the EMA co-ordinates the member states' supervisory activities.
Within the EU life sciences regulatory framework, there are no specific requirements for acting as an importer of record of pharmaceuticals, apart from the conditions of being established in the EU and having the required licence (see 9.4 Prior Authorisations, below). The EU customs legislation falls outside the scope of this chapter.
Generally speaking, importers must ensure that the pharmaceuticals placed on the market are in conformity with the European requirements (ie, regarding safety, health and environment protection). More specifically, the importer has the responsibility to check whether the manufacturer has fulfilled all his or her obligations in order to be able to place the medicinal products on the market. He or she must also present the medicinal products to the relevant customs authorities and be able to produce, upon request, all the technical documentation linked to the products he or she is importing.
Finally, it is important to note that if importers put their own name on the medicinal products imported, they will take over the manufacturer's responsibilities.
Importers of medicines in the EU must be licensed before they can carry out their activities. More precisely, importation from a third country is subject to the holding of a Manufacturing and Importation Authorisation (MIA). Indeed, pursuant to Article 40(3) of the Community Code, the MIA required from manufacturers is applicable to imports coming from third countries into a member state. The NCAs are responsible for granting these MIAs for activities taking place within their respective territories.
Furthermore, Article 41 of the Community Code provides that the importer must, in order to obtain a MIA:
The authorisations granted are only applicable to the premises, the medicinal products and the pharmaceuticals forms specified in the application.
In addition, the import of active pharmaceutical ingredients is subject to specific rules. Firstly, importers of active substances are required to register their activities with the NCAs in which they operate (Article 52a of the Community Code). Such registration includes the importer’s name and permanent address, the list of the active substances which are to be imported, as well as any particulars regarding the premises and the technical equipment for the activity. Secondly, a written confirmation must be drawn up by the NCA of the exporting country in order to assess that the product has been manufactured in line with good manufacturing practices equivalent to the EU Good Manufacturing Practices (GMP) standards. However, since the EU has declared some national regulatory systems as equivalent to those of the EU, some active pharmaceuticals benefit from an exemption (ie, no written confirmation is required) depending on their exporting country. Article 46 of the Community Code lists the obligations imposed on the holder of a manufacturing authorisation. For example, the holder of a MIA must comply with the GMP and allow the agents of the NCAs to enter and inspect his or her premises at any time. He or she must also inform the NCAs of any suspicion of falsified pharmaceuticals.
The NCAs may suspend imports of medicinal products coming from third countries, or suspend or revoke the MA for a category of preparations or all preparations if the rules laid down in the Community Code are not respected.
Finally, all the importing licences granted in the EU are gathered on EudraGMDP, a public database which is under the responsibility of the EMA.
Needless to say, the above-mentioned rules are not applicable to the medicinal products which are exempted from the scope of the Community Code pursuant to Article 3 thereof.
In the interest of public health, applicants may be granted a conditional marketing authorisation for medicines where the benefit of immediate availability outweighs the risk of less comprehensive data than normally required, based on the scope and criteria defined in legislation and guidelines (see Commission Regulation (EC) No 507/2006 of 29 March 2006 on the conditional marketing authorisation for medicinal products for human use falling within the scope of Regulation (EC) No 726/2004 of the European Parliament and of the Council).The EMA may also grant an MIA in the absence of comprehensive data under exceptional circumstances. However, this authorisation route does not lead to a standard MIA. Furthermore, the European Commission may grant exemptions on public health grounds and in exceptional circumstances if duly justified.
The following exemptions might be applicable:
It will be up to the Market Authorisation holder (MAH) to justify why an exemption should apply, based on public health grounds and in exceptional circumstances. A request for an exemption, including a justification, should be notified to the Commission and each justification will be considered on a case-by-case basis. A copy of the request should also be addressed to the EMA.
The standards that must be met for imported pharmaceuticals and medical products are those required to gain marketing authorisation via the process explained below.
At the EU level, these rules can be divided into two groups. First, the imported goods themselves must meet quality standards, primarily set out in the Community Code. Second, the producer must meet the GMP set out in the Community Code and Article 13 of Directive 2001/20/EC, read in accordance with the guidelines provided in Directive 2003/94/EC. The GMP authorisations are issued as manufacturing or import authorisations for the producer concerned.
As a consequence of these two types of authorisations, the restrictions imposed are based both on a description of the characteristics of the imported good in question, as well as its manufacturing process.
Medicinal products may be either authorised at EU level by the European Commission or at national level by member states’ competent authorities. Once a medicinal product is placed on the market, its safety continues to be monitored throughout its entire lifespan through the EU system of 'pharmacovigilance', which may require the marketer to continue to submit data regarding the product’s effects. The EMA underpins the centralised authorisation procedure and supports co-ordination between the NCAs. The EMA is the hub of a European medicines network, comprising over 40 NACs and guaranteeing a constant exchange and flow of information regarding the scientific assessment of medicinal products in the EU.
To gain authorisation, the European system offers several different routes, including the centralised procedure, the mutual recognition procedure and the decentralised procedure (see 3.2 Types of Marketing Authorisations, above).
EU export controls that apply to dual-use items (see 9.7 Control of Exports of Dual-use Goods, below) are also applicable to the transfer of technology for the development, production or use of dual-use items (so-called 'intangible technology transfers'). Technical information transferred by electronic means and the transfer of knowledge and skills by natural persons also fall under the scope of the definition of intangible technology transfers. An authorisation may also be required for the export of certain dual-use items to all or certain destinations not listed in Annex I of the Council Regulation (EC) No 428/2009, for example if the purchasing country or country of destination is subject to an arms embargo or if the exporter has been informed by the competent authorities of the member state in which it is established that the items in question are or may be intended, in their entirety or in part, for use, in connection with the development, production, handling, operation, maintenance, storage, detection, identification or dissemination of chemical, biological or nuclear weapons or other nuclear explosive devices or the development, production, maintenance or storage of missiles capable of delivering such weapons.
In addition, EU restrictive measures (economic sanctions) might apply to, and therefore restrict, the exports of intangibles to specific countries.
The EU controls the exportation of dual-use items (goods, software and technology that can be used for both civilian and military applications and/or can contribute to the proliferation of weapons of mass destruction).
The definition of dual-use items also includes all goods which can be used for both non-explosive uses as well as assisting in any way in the manufacture of nuclear weapons or other nuclear explosive devices. The conditions under which dual-use items may be exported, and the types of authorisation required, are laid down in Council Regulation (EC) No 428/2009 of 5 May 2009. Exports of biological materials, biological agents (pathogens or toxins), genetically modified organisms, pathogens, chemical products and equipment fall under the scope of Annex I of the Council Regulation (EC) No 428/2009. As a result, an export authorisation is required.
EU dual-use export controls are based on international law (UN Security Council Resolution 1540(2004), the Chemical Weapons Convention and the Biological Weapons Convention) and commitments agreed upon in multilateral export control regimes.
Exports of biological materials, biological agents (pathogens or toxins), genetically modified organisms, pathogens, chemical products and equipment are covered under Annex I of the Council Regulation (EC) No 428/2009. As a result, an export authorisation is required.
The EU is a member of the World Trade Organization (WTO). It is also a party to many bilateral free-trade agreements (FTAs) and is currently negotiating several trade agreements with third states and regional integration groups (such as MERCOSUR).
Most of these agreements contain provisions on trade/regulatory facilitation. As a WTO Member, the EU is bound by a series of obligations aimed at expediting the movement, release and clearance of goods, including goods in transit, which are found in both the original 1995 agreements (such as the GATT 1994 and the Import Licensing Agreement) and the recent revised version of the Trade Facilitation Agreement. Furthermore, the EU must comply with specific WTO obligations regarding the non-discriminatory and legitimate use of standards, technical regulations and conformity assessment procedures. Although the WTO is, unlike the EU, not a harmonising or standard-setting organisation, WTO obligations in this area nonetheless have considerable effects on the regulation of trade. As a party to FTAs with third countries, the EU has accepted also additional obligations in the area of trade/regulatory facilitation, which often are based on WTO obligations.
As part of its Common Foreign and Security Policy, the EU applies economic sanctions to many countries. However, those sanctions mostly involve freezing of funds and banning importation of arms and related materials or natural resources such as oil or petroleum. Exceptionally, the EU bans the importation of all goods from certain countries or regions, although exceptions may apply for pharmaceuticals or medical products.
The fact that economic sanctions might not be applicable to pharmaceuticals or medical products does not preclude such products from being subject to dual-use export controls.
What is referred to as the European patent system currently amounts to an intricate system of supranational and national rules. The Munich-based European Patent Office grants patents on the basis of a uniform procedure and criteria provided for by the European Patent Convention and secondary rules. However, the resulting patent rights are national rights, the boundaries and enforcement of which are, to a large extent, a matter of national law.
This may change if, and when, the Unitary Patent comes into force. The Unitary Patent forms part of a system that will establish a European patent with unitary effect and a new patent court. The Unitary Patent is a legal title that will provide uniform protection across 25 EU countries in one step, providing huge cost advantages and reducing administrative burdens. The system will also create a Unified Patent Court that will offer a single and specialised patent jurisdiction with exclusive competence over European patents litigation.
Against this background, the answers below will only deal with the provisions of EU law that are relevant to patents.
There are no specific rules that apply to the patentability of pharmaceuticals. One major exception is formed by biotechnological inventions which are regulated by Directive 98/44/EC on the legal protection of biotechnological inventions. Biotechnological inventions relate to products consisting of, or containing, biological material, or processes by means of which biological material is produced, processed or used. Such inventions are patentable if they satisfy the general requirements for patentability. It should be noted, however, that human embryonic stem cells are excluded from patent protection based on morality grounds.
No response provided.
Regulation (EC) No 469/2009 concerning the supplementary protection certificate (SPC) for medicinal products currently forms the basis for a EU-regulated term extension of national patent rights that afford protection to active substances of medicinal products. SPCs aim to offset the loss of patent protection for pharmaceutical products that result from the lengthy testing and clinical trials which medicines require prior to obtaining regulatory marketing approval. An SPC can extend a patent right for a maximum of five years. A six-month additional extension is available in accordance with Regulation (EC) No 1901/2006 if the SPC relates to a medicinal product for children for which data have been submitted according to a Pediatric Investigation Plan (PIP).
SPCs can be litigated before the competent member state courts. Questions of interpretation of EU law have repeatedly ended up before the ECJ.
No response provided.
The ‘Bolar’ patent exemption aims to accelerate market entry of generic medicines by allowing early preparatory development on generics to obtain pre-market regulatory approval, even when the SPC of the reference medicine is still in force. The Bolar exemption is regulated at EU level for the pharmaceutical industry only. For human medicines this is done through Article 10.6 of the Community Code.
No response provided.
No response provided.
Regulation (EU) No 608/2013 concerning customs enforcement of intellectual property rights contains rules and procedures to tackle the importation of counterfeit pharmaceuticals from third countries. The rules are enforced by the customs authorities upon entry of the goods in the EU.
While there are no trade mark rules that are specific to the pharmaceutical industry, EMA applies a set of principles under the centralised procedure to separate legitimate from illegitimate names. This distinction is based in large part on safety grounds and public health considerations. EMA’s guidance on this matter can be found in the guideline on the acceptability of names for human medicinal products processed through the centralised procedure.
As is the case for any goods protected by national trade mark rights or a European trade mark, owners can object to the importation into the EU of original goods that carry their trade mark and were imported from outside the European Economic Area without their consent.
IP protection may be available under European design rights.
Data exclusivity is a form of product exclusivity right for medicinal products in Europe. There is also market exclusivity, which is a related form of additional protection. These two rights are in addition to any granted patent exclusivity right covering a medicinal product.
The rationale for granting data and market exclusivity is to compensate the innovator company for the investment it has put into generating the data required to obtain a marketing authorisation. Regulatory approval for medicinal products requires applicants to provide information about the efficacy and safety of their product to regulatory authorities. The first applicant for approval of a new medicinal product must provide a substantial body of data relating to the product (including the results of pre-clinical tests and clinical trials).
An innovator company enjoys a period of data exclusivity during which their pre-clinical and clinical trials data may not be referenced in the regulatory filings of another company (typically a generic company) for the same active substance.
For central marketing authorisation applications, the period of data exclusivity is eight years from the date of authorisation.
There is an additional period of two years of market exclusivity, during which a generic company must not market an equivalent generic version of the originator's pharmaceutical product (although an application for authorisation may be processed during this period).
After a period of ten years from the grant of the innovator company's marketing authorisation, the generic company can market its product, unless the innovator product qualifies for a further one year of exclusivity if the innovator company is granted a marketing authorisation for a new indication with a significant clinical benefit.
At EU level, there is no specific legal regime as regards liability for defective pharmaceuticals. Liability for pharmaceuticals is governed by general EU product liability rules, which are mainly laid down in Directive 85/374/EEC of 25 July 1985 on the approximation of the laws, regulations and administrative provisions of the member states concerning liability for defective products, as amended by Directive 1999/34/EC of 10 May 1999 (the Product Liability Directive). Between the years 2000 and 2016, pharmaceuticals were the second-most affected group of products (16.1%) to be subject to product liability claims based on the Product Liability Directive and its implementing legislations. The Product Liability Directive has been implemented by all EU member states, which are responsible for its enforcement. Some national differences exist in terms of proceedings and statutes of limitation.
Another Directive to take into account when discussing product liability is the Community Code, which is concerned with the safety of medicinal products.
Prior to their implementation of the Product Liability Directive, some EU member states (eg, Germany and Spain) had enacted national laws providing for specific legal regimes for pharmaceuticals. Therefore, differences between such national laws and the general EU rules of the Product Liability Directive may exist, and are dealt with at national level.
The Product Liability Directive provides for a strict no-fault liability. Specific national laws (see above) lay down their own prerequisites. As a result, some EU member states may have several regimes of product liability applying simultaneously.
Under the Product Liability Directive, in order to establish the liability of the producer, the victim has to demonstrate the defect in the product, the damage suffered and causality between the defect and the damage.
The damage can be either damage caused by death or personal injuries, or damage to, or destruction of, any item of property other than the defective product itself, with a lower threshold of EUR500, provided that the item of property is ordinarily intended for private use or consumption and was actually used by the victim mainly for his or her private use or consumption.
Under the Product Liability Directive, the producer of a defective product which caused damage can be held liable. The definition of ‘producer’ is relatively broad and encompasses:
Moreover, if the producer cannot be identified, each supplier of the product can be held liable unless he or she informs the victim, within a reasonable time, of the identity of the producer or of their supplier.
While the Product Liability Directive provides that the claimant must prove the causality between the defect and the damage, it does not contain any specific guidance on how to apply the test of causation. This is a matter for the national courts. Nonetheless, the product shall be deemed defective when it does not provide the safety which a person is entitled to expect, taking all circumstances into account, including the presentation of the product, the use to which it could reasonably be expected that the product would be put, and the time when the product was put into circulation.
Victims are not entitled per se to invoke presumption of causation, but a product will be considered defective when it does not meet the expected safety, ie the so-called 'reasonable safety expectations' test mentioned above. The accompanying patient leaflet will be especially important with respect to pharmaceuticals.
The producer will not be held liable if he or she is able to prove one of the following:
In addition, the manufacturer of a component can escape liability if he or she proves that the defect is attributable to the design of the product in which the component has been fitted or to the instructions given by the manufacturer of the product.
Furthermore, the producer’s liability may be reduced or disallowed if he or she can prove that the damage is partially or totally caused by the negligence of the victim or someone under their responsibility.
The Product Liability Directive does provide for an exemption when the defect is due to compliance of the product with mandatory regulations issued by public authorities.
In order to assess market share liability, it must be established which pharmaceutical taken by the claimant caused the damage. This is because the injured person shall be required to prove the damage, the defect (in the product) and causality between that defect and the damage. Nonetheless, where, as a result of the provisions of the Product Liability Directive, two or more persons are liable for the same damage, they can be held liable jointly and severally.
As regards market share liability, the Commission’s first Report on the application of the Product Liability Directive (1995) contemplated the introduction of a market-share liability into the EU framework. However, that proposal was clearly rejected in the Commission’s second Report (2001): “[t]he concept of ‘market share liability’ is rejected by nearly all the contributions. (…). In this situation it would be extremely difficult to ensure risk as underwriters would not be able to assess or quantify their exposure until after the case has been concluded. The Directive introduces the liability of the supplier under Article 3(3) [of the Product Liability Directive] in case the producer cannot be identified. This guarantees that the victim has a defendant against whom he can introduce a claim. Furthermore, Article 3 of the Directive gives a wide definition of a producer”.
Under the Product Liability Directive, claimants have three years to file a claim for damages as of the day on which they became aware of the damage, the defect (which is a national matter) and the identity of the producer. This is without prejudice to the national laws of member states regulating the suspension or interruption of the statute of limitation. The rights of claimants are extinguished ten years after the date on which the product which caused the damage was put into circulation.
Pursuant to Regulation 1049/2001 of 30 May 2001 regarding public access to European Parliament, Council and Commission documents and to Article 73 of Regulation 726/2004 laying down Community procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency (EMA), the EMA must ensure the widest possible access to the documents it has produced, received or held (including business-related documents). This obligation must, however, be balanced with the necessity to provide adequate protection of commercial confidential information and personal data.
The EMA has published, amongst others, rules for the implementation of Regulation 1049/2001 on access to EMA documents, and the EMA policy on access to documents.
Generally speaking, EMA documents are classified as public, restricted or confidential. Public documents are available on the EMA website. Should this not be the case, a request/question can be submitted to the EMA.
Requests for access to all documents which are not already publicly available must be made in writing via the web form and in a sufficiently precise manner. In reaching its decision, the EMA must respect the principle of proportionality. If access is granted, the applicant will receive the requested document via a secure electronic system called EudraLink. If access is denied, the applicant may ask the EMA to reconsider its decision by sending a written request via the web form.
Access to documents will, however, be denied in the following cases:
Partial access may, however, be granted and documents (or parts of documents) may be redacted before disclosure in the event that it is necessary to protect commercial interests and personal data. The applicants must in any case bear the costs of the disclosure.
Regarding third-party documents, the EMA must inform the originator of the documents of the request that the EMA has received, prior to disclosure, but the EMA will only consult the originator prior to taking any decision if it has a doubt on the confidential nature of the document requested. If the documents originated from a European institution or national competent authority, the EMA must first consult the authority before reaching any decision.
In any case, the EMA may also, on its own initiative (or following a request), grant access to (parts of) documents when there is an overriding interest in disclosure, regardless of any applicable exception.
The latest EMA policy on access to documents was published in October 2018. Its next review is scheduled for October 2021 at the latest.
The types of available damages are not regulated at EU level and therefore depend on the national laws of EU member states. However, please note that the national laws of most EU member states do not provide for punitive damages.
The Product Liability Directive is without prejudice to the possibility of obtaining compensation for pain and suffering, and other non-material damages payable, where appropriate, under the applicable national law.
The Product Liability Directive allows member states to fix a maximum ceiling for product liability in the case of damage to persons caused by identical items with the same defect. This ceiling is set at EUR70 million. Member states are not permitted to impose a lower maximum ceiling.
In its judgment of 21 June 2017 in the case of N.W. and Others v. Sanofi Pasteur MSD and Others (C-621/15), following a request for a preliminary ruling from the French Supreme Court, the Court of Justice of the EU (ECJ) found that, in the absence of medical consensus/certain and irrefutable evidence of the link of causation between a defective vaccine and the death of the victim, serious, specific and consistent circumstantial evidence can be invoked in order to establish such a link. This judgment has been criticised heavily both because the ECJ seems to have lowered the standard of proof, and due to the fact that accepting circumstantial evidence in product liability cases may result in scientifically incorrect decisions that will undermine vaccine development and consumer trust.
The ECJ has recently provided guidance on the definition of a defective product in joined cases Boston Scientific Medizintechnik GmbH v. AOK Sachsen-Anhalt and Others (C-503/13 and C-504/13). While both cases concerned implantable medical devices (pacemakers and cardioverter defibrillators), it is conceivable that their principles can be applied to cases concerning pharmaceuticals. The ECJ was asked by the German Federal Court of Justice to determine whether a product belonging to the same group or forming part of the same production series as potentially defective products is also to be considered as defective. The ECJ concluded that the defect of an entire batch of medical devices could indeed be deduced from the consideration that some of these products have a potential defect. In reaching its decision, the ECJ took into consideration the high safety requirements expected by patients as regards the products at hand. The ECJ also held that the costs of the surgical operation which was necessary to replace the potentially defective product are considered as damages covered by Directive 85/374. The extended notion of a defective product used by the ECJ, as well as the inclusion of the costs of the surgical operation into its definition of damages might lead to an increase in claims against producers in the coming years.
In the Novo Nordisk Pharma GmbH v. S case (C-310/13), the ECJ took a closer look at Article 13 of Directive 85/374, which allows for the existence of special liability systems, ie, existing before the Directive. In that case, Germany maintained a 1976 special liability system, but had amended it in 2002 (thus, after the adoption of Directive 85/374) in order to include a disclosure obligation on the producer regarding the adverse effects of a product. The ECJ recalled that Directive 85/374 does not consist of complete harmonisation. EU member states are thus free to regulate product liability matters which fall outside the scope of the Directive.
Whether a trial is held by a judge or a jury is a matter of national law.
Whether the parties have an obligation to disclose relevant documents before or during the trial is a matter of national law.
There have been no recent material discussions on potential changes in the legal regime for liability for pharmaceuticals. However, the Product Liability Directive mandates the Commission to carry out a periodic evaluation, present a report and make proposals to the Council.
In its 2018 Report, the Commission indicated that there were instances where costs were not equally distributed between consumers (who bear costs relating to the burden of proof, a EUR500 minimum threshold and statute of limitations) and producers (who bear costs relating to strict liability). The Commission noted that this was especially true when the burden of proof is complex, as is the case with pharmaceuticals. More generally, the Commission expressed its intention to conduct a specific analysis of pharmaceuticals which, due to their complexity, may pose a challenge to the performance of the Directive.
Patients’ fundamental right to privacy and to the protection of their health data are protected in numerous legal instruments of the EU. With respect to privacy, this right is established in Article 8 of the European Convention on Human Rights. This right is also protected by Article 7 of the Charter of Fundamental Rights of the European Union.
As regards personal data, Article 8 of the Charter of Fundamental Rights of the European Union establishes the right to protection of personal data as a fundamental right.
In addition to these provisions relating to the protection of private life and personal data, the EU adopted a new Regulation (EU) 2016/679 on the protection of personal data (GDPR) in May 2016. The GDPR provides citizens with the right to be better informed about the use made of their personal data, and gives clearer responsibilities to people and entities using personal data. Furthermore, the GDPR lays down clear principles that apply to all use of patients’ data and to all data controllers. Patients’ health data are considered as a special category of data called 'sensitive data'.
At the European level, the European Data Protection Board (EDPB) is the EU body in charge of the application of the GDPR. It is made up of the head of each national supervisory authority and of the European Data Protection Supervisor (EDPS) or their representatives and has its own secretariat. The EDPS is the supervisory authority overseeing data protection compliance at the EU institutions and advises EU institutions on matters relating to the processing of personal data.
The EDPB ensures that data protection law is applied consistently across the EU and works to ensure effective cooperation amongst national supervisory authorities. The EDPB issues guidelines on the interpretation of core concepts of the GDPR but is also called on to rule by binding decisions on disputes regarding cross-border processing (see the information below concerning the 'one-stop-shop' principle), ensuring a uniform application of EU rules.
The enforcement of the GDPR is left to national supervisory authorities, which are independent public authorities that supervise, through investigative and corrective powers, the application of the data protection law.
Under the one-stop-shop principle, in case of cross border processing, organisations deal with a single interlocutor, the lead authority, which is responsible for coordinating any investigation and will be entitled to involve other 'supervisory authorities concerned' in such investigation.
In order to identify the lead supervisory authority, the location of the 'main establishment' or 'single establishment' of the data controller or processor in the EU needs to be determined. The EDPB and EDPS oversee the coherent and harmonised application of data protection compliance by national supervisory authorities.
Pursuant to Recital 35 of the GDPR, “personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject”. This includes information about the natural person collected in the course of the registration for, or the provision of, health care services (as referred to in Directive 2011/24/EU of the European Parliament and of the Council) to that natural person.
Under the GDPR, data concerning health is regarded as being sensitive in nature. As a result, the GDPR imposes a higher standard of protection for the processing of health data, as follows:
Furthermore, the GDPR provides a margin of manoeuvre for member states to specify its rules, including for the processing of special categories of personal data (‘sensitive data’), such as health data. To this end, member state law may set out the circumstances for specific processing situations, including determining more precisely the conditions under which the processing of personal data is lawful. Under Article 9 (4), member states are allowed to maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.
In addition, Article 89(2) of the GDPR allows the EU or its member states to adopt derogations to data subjects’ rights for scientific research.
Under the GDPR, which is directly applicable in all member states, the national supervisory authorities can impose administrative fines of up to EUR20 million or 4% of the total worldwide annual turnover of the infringing undertaking, whichever is higher. In addition to the administrative fines, the supervisory authorities can take measures to correct non-compliance, ranging from issuing warnings to orders to cease specific activities or suspend transfers of data to third countries.
There are no general rules preventing health data from being stored on servers connected to the internet or in the 'cloud'. Nevertheless, the general obligations apply and controllers of data should take account of the increased risk of data being unrightfully accessed when these are stored in the cloud. In addition, cloud storage may imply that health data will be transferred to third countries. Therefore, cloud services should offer increased security and organisations should conduct detailed impact assessments and selection procedures for cloud providers hosting health-related personal data.