Standards of quality and safety for substances of human origin intended for human application

07 September 2022

Opinion 19/2022

on the Proposal for a Regulation on standards of quality and safety for substances of human origin intended for human application and repealing Directives 2002/98/EC and 2004/23/EC

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall, ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to a Proposal for Regulation of the European Parliament and of the Council on standards of quality and safety for substances of human origin intended for human application and repealing Directives 2002/98/EC and 2004/23/EC. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 14 July 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on standards of quality and safety for substances of human origin intended for human application and repealing Directives 2002/98/EC and 2004/23/EC.

The Proposal aims to regulate the standards of quality and safety for substances of human origin intended for human application (‘SoHO’) by ensuring safety and quality for patients treated with Substances of Human Origin therapies and fully protect them from avoidable risks linked to SoHOs, ensuring safety and quality for SoHO donors and for children born from donated eggs, sperm or embryos, strengthening and allowing for harmonisation of oversight practices among Member States, facilitating the development of safe and effective innovative SoHO therapies and improving the resilience of the sector, mitigating risk of shortages.

The EDPS welcomes that the Proposal aims to bring positive impact on fundamental rights of citizens such as health protection, non-discrimination, privacy and informed consent, while also positively notes that programmes promoting the donation of SoHOs should be founded on the principle of voluntary and unpaid donation, altruism of the donor and solidarity between donor and recipient. In this regard, the EDPS welcomes the references to specific principles of data protection in the context of the SoHO Platform, in particular the provisions that give effect to the principles of purpose limitation, data minimisation, as well as the requirements of necessity and proportionality.

The EDPS welcomes that the Proposal would require that informed consent for donation is freely given and donors or their representatives are informed with regards to the intended use of the donated material. At the same time, the EDPS recalls that the donor’s informed consent to the donation of material under the SoHO Regulation, while being an essential ethical and legal requirement, is not the same as consent referred to in the GDPR as one of the legal basis for the processing of personal data.

On the reuse of data, while the EDPS welcomes the explicit identification of all the categories of personal data listed in the Proposal and the specific purpose for which these will be processed, he also considers that the specific purpose for which data would be reused should be clearly identified in the enacting terms of the Proposal.

Lastly, the EDPS recommends that the co-legislator clearly define in the Proposal the maximum duration for which personal data may be stored.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 14 July 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on standards of quality and safety for substances of human origin intended for human application and repealing Directives 2002/98/EC and 2004/23/EC (‘the Proposal’).

2. The Proposal includes measures that aim to: - ensure safety and quality for patients treated with Substances of Human Origin (‘SoHO’) therapies and fully protect them from avoidable risks linked to SoHOs; - ensure safety and quality for SoHO donors and for children born from donated eggs, sperm or embryos; - strengthen and allow for harmonisation of oversight practices among Member States; - facilitate the development of safe and effective innovative SoHO therapies; - improve the resilience of the sector, mitigating risk of shortages .

3. The Proposal is part of the EU’s ambition to build a stronger European Health Union, in order to: (1) better protect the health of our citizens (including patients, donors and offspring); (2) equip the EU and its Member States to better prevent and address future pandemics (surveillance, data analysis, risk assessment, early warning and response) and (3) improve the resilience of EU health systems .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 July 2022, pursuant to Article 42(1) EUDPR. The EDPS welcomes the reference to this consultation in Recital 51 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. According to the Explanatory Memorandum to the Proposal , the Blood Directive 2022/98/EC and the Tissues and Cells Directive 2004/23/EC (‘BTC legislation’) sets out quality and safety requirements for all steps from donation to human application (unless the donations are used to manufacture medicinal products or medical devices, in which case the legislation only applies to donation, collection and testing).

6. The aim of the Proposal is to address shortcomings of the BTC legislation in order to ensure a better level of health protection, together with the possibility for such framework to be effectively implemented and resistant to new risks and trends, while ensuring at the same time appropriate safety and quality requirements .

7. The EDPS welcomes that the Proposal aims to bring positive impact on some fundamental rights of citizens (such as health protection, non-discrimination, privacy and informed consent), particularly by strengthening the provisions relating to donors’ and recipients’ protection and vigilance and the reporting of genetic conditions in children born from medically assisted reproduction with third party donation, and by ensuring that requirements for safety and quality are based on scientific evidence. The EDPS also positively notes that, in line with the Proposal, programmes promoting the donation of SoHOs should be founded on the principle of voluntary and unpaid donation, altruism of the donor and solidarity between donor and recipient.

8. The EDPS considers that the protection of the fundamental rights to privacy and to the protection of personal data in the context of the Proposal go hand in hand with the protection of human dignity, of the integrity of the person, and non-discrimination (that could follow undue disclosure of personal data related to the individuals concerned).

9. The EDPS takes note that an EU SoHO Platform must be established, managed and maintained by the Commission in order to facilitate the exchange of information concerning SoHO activities in the Union, namely the submission, retrieval, storage, management, handling, exchange, analysis, publication and deletion of such data and documents. The EDPS also notes that, in line with the Proposal, the processing of personal data by competent authorities must only be carried out for the purpose of performing SoHO related activities in accordance with the Regulation and in compliance with the applicable data protection legislation . The EDPS notes that the SoHO Platform will also be processing special categories of personal data .

10. The impact assessment accompanying the Proposal states that “[a] single IT system will bring important benefits as it can host flexible solutions, allowing Member States and establishments to maintain and connect with their own system or re-use existing components. It could become an important node in the EU digital ecosystem, and in particular in the future European Health Data Space (EHDS), which aims at opening opportunities and removing barriers to the use and reuse of health data, for the provision of healthcare, personalised medicine, research and innovation, policy making and regulatory activities.” To this end, the EDPS would like to point out that that the storage and processing of a variety of data categories in a single integrated IT system may create risks. To minimise such risks, due consideration must be given to the requirements of data minimisation, data protection by design and security.

11. The EDPS welcomes Recital 42 of the Proposal, which emphasises that the processing of personal data under the Proposal must be subject to strong guarantees of confidentiality and comply with the EUDPR and with Regulation (EU) 2016/679 (‘the GDPR’).

12. Moreover, the EDPS welcomes the specific references to the principles of data protection as regards the processing of personal data in the context of the SoHO Platform , in particular the provisions that give effect to the principles of purpose limitation , data minimisation (and related pseudonymisation of personal data) as well as the requirements of necessity and proportionality .

13. The EDPS notes that, according to Recital 45, the Proposal should provide a legal basis under Article 6 GDPR and, where relevant, fulfil the conditions under Article 9(2), point (i) GDPR, for the processing of such personal data. Additionally, the same Recital also states that, with respect to personal data processed by the Commission, the Proposal should provide a legal basis under Article 5 EUDPR and, where relevant, fulfil the conditions under Article 10(2), point (i) EUDPR.

14. The EDPS welcomes that the Proposal would require that consent for donation is freely given and donors or their representatives are informed with regards to the intended use of the donated material. In this regard, the EDPS recalls that the donor’s informed consent to the donation of material under the SoHO Regulation, while being an essential ethical and legal requirement, similarly to clinical trials , is not the same as consent referred to in the GDPR as one of the legal basis for the processing of personal data. The EDPS therefore recommends to include such a clarification in the Proposal.

15. Finally, the EDPS welcomes the specification in the last sentence of Recital 45 of the Proposal, according to which donors, recipients and offsprings should be informed of the processing of personal data in line with the GDPR and the EUDPR.

3. Specific remarks

3.1. Roles and responsibilities of the actors involved

16. The EDPS welcomes that Article 76(6) of the Proposal provides that, in relation to their responsibilities to process personal data to comply with the obligations of the Proposal, the SoHO entities, meaning the competent authority or authorities of the Member States that are conferred responsibility for the SoHO supervisory activities, shall be regarded as ‘controllers’ as defined in Article 4(7) GDPR.

17. Moreover, the EDPS welcomes that Article 76(7) of the Proposal provides that, in relation to its responsibility to establish and manage the EU SoHO Platform, the Commission shall be regarded as controller as defined in Article 3(8) EUDPR.

18. In this regard, the EDPS also notes that, as reflected in the Explanatory Memorandum to the Proposal, the Proposal establishes links with the European Centre for Disease Prevention and Control (‘ECDC’), for which the mandate has been proposed to be strengthened , also in the field of SoHOs. To this end, the EDPS considers that further clarity as to whether ECDC will be processing personal data within the SoHO Platform is needed. Should this be the case, the EDPS considers that the ECDC would likely (also) be acting as a controller within the meaning of data protection law. The EDPS therefore invites the co-legislator to clarify further in the Proposal whether the ECDC would be processing personal data within the SoHO Platform and, if so, to identify explicitly its role within the meaning of data protection law.

3.2. Categories of personal data and purpose limitation

19. The EDPS welcomes Article 76 point (1), (2) and (3) of the Proposal, which explicitly identifies all the categories of personal data listed in the Proposal and the specific purpose for which these will be processed in line with the Proposal.

20. Indeed, the EDPS notes that the need to protect the dignity and integrity of donors, recipients and offsprings born from medically assisted reproduction, referred to in Recital 44 of the Proposal, calls for the highest possible data protection safeguards, as well as strict purpose limitation. The EDPS highlights that the right of dignity of the individuals concerned must always be taken into account, particularly by ensuring that consent for donation of SoHO, as an ethical and legal requirement, is freely given and that donors and their representatives are fully informed in particular with regards to any processing of their personal data.

21. Against this background, the EDPS notes that Recital 46 of the Proposal provides that entrusted competent authorities as data controllers within the meaning of the GDPR will have powers to take decisions on the access to and re-use of data.

22. In this regard, the EDPS understands that, as outlined throughout the Proposal, the purpose for the reuse of such data, if any, would be purely health-related. Therefore, the EDPS recommends that the co-legislator clearly identify in the enacting terms of the Proposal the specific purpose for which such data would be reused, particularly taking into account the high risks for the persons concerned and the key data protection principle of purpose limitation in line with Article 5(1)(b) GDPR.

23. The EDPS also notes that Articles 44, 45 and 47 of the Proposal provide that SoHO entities will be obliged to perform activities of data collection and reporting, traceability and coding and vigilance and reporting respectively. In this regard, the EDPS, while considering that processing of personal data may possibly occur in this context, also notes that Article 76 of the Proposal on data protection does not refer to the processing operations listed in the aforementioned Articles. For the sake of legal clarity, the EDPS recommends to clarify in the aforementioned Articles whether any processing of personal data would be taking place and, if so, to specify the purpose of such processing in Article 76 of the Proposal itself.

3.3. Storage duration

24. The EDPS notes that Article 74(3) of the Proposal provides that “[t]he Commission shall adopt implementing acts laying down technical specifications for the EU SoHO Platform, (...), the retention periods for personal data and the technical and organisational measures to ensure the safety and security of personal data processed”, while Article 76(8) of the Proposal provides that “(...) the Commission is empowered to adopt delegated acts in accordance with Article 77 supplementing this Regulation by laying down the retention periods for personal data as appropriate to their purpose (...)”.

25. In this regard, in line with the storage limitation principle, the EDPS underlines that personal data should be kept in a form which permits the identification of data subjects for no longer than necessary for the purposes for which personal data are processed. The EDPS recalls that the period of time should be as short as possible in relation to the purpose pursued and must be justified in order to ensure that the storage is limited to what is necessary for the purpose(s) pursued. As limiting the retention of personal data constitutes an important safeguard to protect individuals against misuse of their personal data, the EDPS recommends that the co-legislator clearly define in the Proposal itself the maximum duration for which personal data may be stored.

3.4. Other specific comments

26. The EDPS welcomes Article 53(1)(d) of the Proposal on donors’ protection and Article 55(3)(g) of the Proposal on the recording and protection of donors’ personal data, in Chapter VI. However, the EDPS notes that similar provisions are missing in Chapter VII of the Proposal, related to the protection of SoHO recipients and offsprings. 8

27. Additionally, in order to ensure a high level of protection of personal data, the EDPS recommends inserting a reference to the risks stemming from the processing of personal data in Article 52 of the Proposal, on the objectives regarding SoHO donor protection, as well as in Article 57 of the Proposal, on the objectives regarding SoHO recipient and offspring protection.

28. The EDPS also notes that Article 55(g) of the Proposal provides that, in addition to other information to be provided prior to consent or authorisation, “[i]n case of living donors, SoHO entities shall provide information regarding (...) the recording and protection of donor personal and health data and medical confidentiality, including any potential sharing of data in the interest of donor health monitoring and of public health, as necessary and proportionate (...)”. In this regard, the EDPS considers that, as drafted, the aforementioned Article is unclear both as to the exact information that would be processed ‘in the interest of the donor’, and as to the necessity and proportionality assessment in this context. Therefore, the EDPS recommends to explicitly clarify the information to be processed in this context, as well as how would the necessity and proportionality assessment take place.

29. Lastly, the EDPS notes that Article 14(2) of Directive 20004/23/EC on setting standards of quality and safety for the donation, procurement, testing, processing, preservation, storage and distribution of human tissues and cells currently provides that Member States must “(...) ensure that: (a) data security measures are in place, as well as safeguards against any unauthorised data additions, deletions or modifications to donor files or deferral records, and transfer of information; (b) procedures are in place to resolve data discrepancies; and (c) no unauthorised disclosure of information occurs, whilst guaranteeing the traceability of donations.” The EDPS considers that such more detailed provisions could be usefully reinstated in the Proposal, in its proposed form of a Regulation, in order to strengthen protection for donors and recipients and offsprings of SoHO.

4. Conclusions

30. In light of the above, the EDPS makes the following recommendations: (1) to clarify that informed consent to the donation of material under the SoHO Regulation is not the same as consent referred to in the GDPR as one of the legal basis for the processing of personal data; (2) to clarify for which specific purposes reuse of personal data, if any, related to donors and recipients, and offsprings, of SoHO is envisaged, taking into account the ethical and legal principle of informed consent laid down under Article 3(2) of the Charter, and the high risks for the persons concerned. (3) to clarify in the Proposal whether the ECDC would be processing personal data within the SoHO Platform and, if so, to explicitly identify its role within the meaning of data protection law; (4) to clearly identify in the enacting terms of the Proposal the specific purpose for which such data would be reused, particularly taking into account the high risks for the persons concerned and the key data protection principle of purpose limitation; 9 (5) to clarify in Articles 44, 45 and 47 of the Proposal whether any processing of personal data would be taking place and, if so, to specify the purpose of such processing in Article 76 of the Proposal itself; (6) to clearly define in the Proposal itself the maximum duration for which personal data may be stored; (7) to insert a reference to risks stemming from the processing of personal data both in Article 52 of the Proposal, on the objectives regarding SoHO donor protection, as well as Article 57 of the Proposal, on the objectives regarding SoHO recipient and offspring protection; (8) to explicitly clarify in Article 55(g) of the Proposal the information to be processed in this context, as well as how would the necessity and proportionality assessment take place. Brussels, 07 September 2022 Wojciech Rafał WIEWIÓROWSKI [e-signed] 10