In vitro diagnostic medical devices

Opinion of the European Data Protection Supervisor

on the Commission proposals for a Regulation on medical devices, and amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and a Regulation on in vitro diagnostic medical devices

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article 28(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 26 September 2012, the Commission adopted two proposals for Regulations on medical devices (‘the proposed MD Regulation’) , and a Regulation on in vitro diagnostic medical devices (‘the proposed IVD Regulation’) . These proposals were sent to the EDPS for consultation on 2 October 2012.

2. The EDPS welcomes the fact that he is consulted by the Commission and recommends that a reference to the consultation be included in the preambles of the proposed Regulations. 1.2. Objectives and scope of the proposed Regulation

3. The proposed Regulations aim at ensuring the safety of medical devices (‘MDs’) and in vitro diagnostic medical devices (‘IVDs’) and their free circulation within the internal market. They amend and clarify the scope of the existing legislation, to take into account scientific and technological progress. The proposed Regulations contain legal frameworks to utilize an existing electronic database (Eudamed database) at EU level to facilitate coordination between authorities to ensure rapid and consistent responses to safety issues, to increase devices traceability throughout the supply chain and to clarify the obligations and responsibilities of manufacturers, importers and distributors. They furthermore strengthen the different levels of supervision by clarifying and enhancing the position and powers of public authorities vis-à-vis economic actors. 1.3. Aim of the EDPS Opinion

4. The proposed Regulations will affect the rights of individuals related to the processing of their personal data. Amongst other issues, they deal with the processing of sensitive data (health data), a central EU-level database which 8 includes personal data, market surveillance and record keeping.

5. The EDPS welcomes that the Commission has made an effort to guarantee the correct application of EU rules concerning the protection of personal data in the proposed Regulations. However, the EDPS sees a need for some clarifications with particular regards to sensitive data, especially when this category of personal data comes to the processing and storage in the database suggested by the proposed Regulations. Indeed the EDPS has identified certain ambiguities and inconsistencies in the way the proposed Regulations deal with the issue of whether and what categories of personal data will be processed, in particular where sensitive data regarding health might be processed and stored.

2. ANALYSIS OF THE PROPOSAL 2.1. Applicability of data protection legislation

6. Several Recitals and provisions of the proposed Regulations mention Articles 7 and 8 of the Charter of Fundamental Rights, Directive 95/46/EC and Regulation (EC) No 45/2001 .

7. In particular, Article 85 of the proposed MD Regulation and Article 81 of the proposed IVD Regulation state that Member States shall apply Directive 95/46/EC to the processing of personal data pursuant to the proposed Regulations and that Regulation (EC) No 45/2001 shall apply to the processing of personal data carried out by the Commission pursuant to the proposed Regulations.

8. The EDPS welcomes these provisions and only recommends that both Articles clarify the reference to Directive 95/46/EC by specifying that the provisions will apply in accordance with the national rules which implement Directive 95/46/EC.

9. The references to data protection law are relevant, for example, in relation to the various provisions concerning exchanges of personal data between national authorities and the Commission (to and from the Eudamed database). These provisions need to be applied in a way which is consistent with data protection legislation, in particular by allowing a selective and proportionate exchange of personal information, where necessary, on a basis of more precise provisions which cannot be construed as a blanket authorisation to exchange all kind of personal data . 2.2. Processing of personal data concerning health

10. Clinical investigations and reporting of incidents involving MDs and IVDs (vigilance) activities as well as market surveillance activities regarding MDs and IVDs are by nature dependent on the processing and storage of data at different levels (local, national and European). Personal data of identified or identifiable patients participating in clinical investigations and vigilance can be considered as data relating to health (‘health data’) of the persons concerned since they reveal information about medical procedures and associated health problems.

11. Processing of such data is subject to strict data protection rules as laid down in Article 8 of Directive 95/46/EC (and its implementing national laws) and Article 10 of Regulation (EC) No 45/2001. Among the grounds which allow for processing of personal data relating to health, Article 8(3) of Directive 95/46/EC and Article 10(3) of Regulation (EC) No 45/2001 are applicable in this case. These provisions lift the prohibition of processing health related data if the processing is ‘required for the purpose of preventive medicine [...]’. The EDPS wishes to underline that this sets a high standard.

12. The importance of protecting such data has repeatedly been emphasised by the European Court of Human Rights in the context of Article 8 of the European Convention of Human Rights. The Court has stated: ‘The protection of personal data, in particular medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention’ .

13. The EDPS therefore recommends inserting in Article 85 of the proposed MD Regulation and in Article 81 of the proposed IVD Regulation explicit reference to Article 8 of Directive 95/46/EC and Article 10 of Regulation (EC) No 45/2001. 2.3. The Eudamed database

14. The Eudamed database is regulated in Article 27 of the proposed MD Regulation and Article 25 of the proposed IVD Regulation.

15. The purposes of the Eudamed database are listed in Article 27 of the proposed MD Regulation as: (a) to enable the public to be adequately informed about devices placed on the market, about the corresponding certificates issued by notified bodies and about the relevant economic operators; (b) to enable traceability of devices within the internal market; (c) to enable the public to be adequately informed about clinical investigations and to enable sponsors of clinical investigations to be conducted in more than one Member State to comply with information obligations; (d) to enable manufacturers to comply with information obligations... [regarding vigilance and market surveillance]; (e) to enable the competent authorities of the Member States and the Commission to carry out their tasks relating to this Regulation on a well informed basis and to enhance the cooperation between them.

16. According to Article 27(2) of the proposed MD Regulation and Article 25 of the proposed IVD Regulation, the Eudamed database shall include the following "modules" as integral parts: (a) the electronic system on Unique Device Identification; (b) the electronic system on registration of devices and economic operators; (c) the electronic system on information on certificates; (d) the electronic system on clinical investigations ; (e) the electronic system on vigilance; (f) the electronic system on market surveillance.

17. As seen above, this central database is intended to serve a multitude of purposes and contains several integrated parts. The EDPS welcomes the attention given to the protection of personal data in the wording of these Articles, especially Article 27(5) of the proposed MD Regulation, which states that the Eudamed database shall contain personal data only insofar as it is necessary to process information in accordance with the proposed Regulations. Article 27(5) also clarifies -through reference to Article 8(4)- the retention period . The EDPS welcomes that the right of access for data subjects and the rights to correction and deletion of their personal data are addressed in the proposed MD Regulation in Article 27(6). He also welcomes that the last sentence of Article 27(6) states that corrections and deletions shall be carried out as soon as possible, but no later than within 60 days. However, the right of the data subject to block his or her personal data has not been addressed and should be included.

18. The EDPS notes, however, that Article 25 of the proposed IVD Regulation simply makes reference to the proposed MD Regulation regarding the conditions and modalities of the database, such as purposes, data subject rights and data retention periods. In the view of the EDPS, the inclusion of these elements of the database also in the proposed IVD Regulation would increase the clarity of the legal instrument in a very beneficial way.

19. The EDPS therefore recommends inserting similar paragraphs regarding purposes, data subject rights and data retention periods as in Article 27 of the proposed MD Regulation into Article 25 of the proposed IVD Regulation, subject to the modifications suggested in this Opinion.

20. The EDPS recognises that the multiple purposes listed in Article 27 of the proposed MD Regulation are legitimate within the framework of the regulation of MDs and IVDs in the EU and that it is necessary to process certain kinds of personal data to achieve the goals that the proposed Regulations aim for. However, the processing of such data, and in particular of health data, must be strictly limited to the minimum necessary to allow the attainment of such purposes. While it seems necessary that certain health data is processed for the purpose of clinical investigation, vigilance and market surveillance by the health practitioners, local competent authorities and economic operators, in the EDPS view a potential systematic transfer of directly identified personal health data to the centralized Eudamed database seems disproportionate.

21. In this respect, currently only the provisions related to clinical investigations include a reference to the exclusion of patient health data from the centralised database.

22. In the EDPS' view, the exclusion of directly identified patient health data from the database should be introduced as a rule for the Eudamed database. The EDPS therefore recommends that the explicit exclusion of directly identified personal data of patients from the Eudamed database be incorporated in Article 27 of the proposed MD Regulation and Article 25 of the proposed IVD Regulation.

23. Moreover, the EDPS recommends including, in a Recital of both proposed Regulations, that any implementing measures to be adopted under the proposed Regulations should specify in detail the data protection implications of the functional and technical characteristics of the Eudamed database and the EDPS should be consulted. 2.4. Clinical investigations and clinical performance studies

24. The issue of clinical investigations and clinical performance studies is closely connected to the issue of clinical trials on medicinal products for human use, an issue where the EDPS has recently published an Opinion .

25. Recital 48 of the proposed MD Regulation and Recital 44 of the proposed IVD Regulation state that no personal data of individuals participating in the clinical investigation (patients) will be collected in the "electronic system" (i.e. the Eudamed database). This statement suggests that indeed the clinical investigations module of the Eudamed database should not include patient health data. Nevertheless, Article 52 of the proposed MD Regulation ('Registration of clinical investigations') and Article 50 of the proposed IVD Regulation ('Registration of interventional clinical performance studies [...]') state that information in the electronic system shall be accessible to the public unless confidentiality is justified, inter alia, on grounds of protection of personal data pursuant to Regulation (EC) No 45/2001 . This wording suggests that personal data of individuals participating in the clinical investigations may indeed be collected in the electronic system, but would not be made available to the public on grounds of protection of personal data. This inconsistency in the texts must be rectified. The proposed Regulations should unambiguously prevent the inclusion of patients' personal data on health in the Eudamed database as regards clinical investigations and clinical performance studies.

26. Furthermore, according to Article 52(4) of the proposed MD Regulation and Article 50(4) of the proposed IVD Regulation no personal data of 'subjects' (patients) participating in the clinical investigations shall be publicly available. The term 'subject' is not defined in either the proposed MD Regulation or the proposed IVD Regulation, but the EDPS assumes that the definition is meant to be in line with the Commission proposal on clinical trials in medicinal products, i.e. 'an individual who participates in a clinical trial, either as recipient of an investigational medicinal product or as a control'. As the term 'subject' has a very different meaning in the data protection context, it is of utmost importance that the definition of the term is included in both proposed Regulations. 2.5. Vigilance

27. The system of reporting of incidents relating to MDs and IVDs (Vigilance) has been divided into two different sets of provisions in the proposed Regulations. The reporting during the pre-market phase is governed by the provisions regarding clinical investigations and the reporting that occurs after the putting on the market is governed by the provisions regarding vigilance and market surveillance.

28. The issue of vigilance is closely connected to the issue of pharmacovigilance, an issue where the EDPS has commented upon a number of occasions. In 2009, the EDPS published an Opinion on the amendments to Regulation (EU) No 1345/2010 and Directive 2010/84/EU . The EDPS also published an Opinion on a notification for prior checking regarding the EudraVigilance database and provided informal comments to the Commission before the publication of the implementing regulation on the performance of pharmacovigilance activities (the Implementing Regulation) .

29. A general issue the EDPS wishes to raise in this respect is the actual necessity of processing health data about directly identified patients at EU level.

30. It may be necessary to include information identifying patients in the primary reports collected and maintained by the manufacturer or the national competent authority. However, the EDPS does not see the need for this information to be preserved in a central database like the Eudamed database. It would be sufficient to provide for a traceability mechanism (e.g. through pseudonymisation of the data). Personal data concerning health should be submitted to the Eudamed database only in pseudonymised form (i.e. substituting direct identification elements like the name with a code). This would still enable the traceability of the data along the whole system by authorised users, whereas at the same time this would render direct identification in the Eudamed database by external actors impossible. Duplication of reporting can be avoided through the application of well structured data reporting procedures and traceability mechanisms.

31. The EDPS therefore recommends inserting provisions in the proposed MD Regulation and the proposed IVD Regulation that clearly define in which situations and subject to which safeguards information containing patient health data will be processed and stored in the Eudamed database regarding vigilance. In particular, the proposed Regulations should require that a risk assessment be carried out by the Commission before the processing and storage of any patient health data in the Eudamed database.

32. In relation to the periodic reports mentioned in Article 61 of the proposed MD Regulation and in Article 59 of the proposed IVD Regulation, the EDPS recommends that it should be explicitly mentioned that these reports should only be using truly anonymous data. 2.6. Market surveillance

33. The market surveillance provisions envisaged by the proposed MD Regulation and by the proposed IVD Regulation refer to two separate activities: on the one hand, the post-market surveillance plan to be put in place by manufacturers (Article 8(6) of both Proposals) and, on the other hand, the surveillance by competent authorities (Article 65 et seqq. of the proposed IVD Regulation and Article 67 et seqq. of the proposed MD Regulation).

34. As regards the market surveillance plan, manufacturers are required to institute and keep up to date a systematic procedure to collect and review experience gained from devices placed on the market. This would entail the collection, recording and investigation of complaints and reports from healthcare professionals, patients or users on suspected incidents related to devices. As mentioned above, processing of personal data related to health is in principle prohibited by Article 8(1) of Directive 95/46/EC. In this case, therefore, manufacturers must base their processing of health data of data subjects on one of the grounds for processing mentioned in Article 8(2) as an exception to the prohibition. In the EDPS´ view, the most appropriate ground for processing in case of post market surveillance should be explicit consent (Article 8(2)(a)). Given that the Proposals are directly applicable Regulations, to the text of Article 8(6) of both texts should be modified by adding the following sentence: "Before any processing of data concerning health of patients takes place, manufacturers shall obtain explicit consent from the data subject pursuant to Article 8(2)(a) of Directive 95/46/EC".

35. As regards the surveillance by competent authorities, the proposed Regulations do not specify if the latter would need to process personal data and/or health data of patients in order to carry out their duties. However, in view of the intense exchange of information between authorities, Member States and the Commission resulting from the system of post market surveillance, a provision regulating how personal data should be managed should be inserted. In this respect, the same observations as those mentioned in paragraphs 30 and 31 apply. 2.7. Record keeping

36. Article 8(4) of the proposed MD Regulation and Article 8(4) of the proposed IVD Regulation concern record keeping. References to these Articles are made in the Articles that concern the different aspects of the systems governing MDs and IVDs. These provisions oblige the manufacturers to archive certain information for at least 5 years after the last device covered by the declaration of conformity has been placed on the market. In case of implantable devices under the proposed MD Regulation, the period shall be at least 15 years after the last device has been placed on the market. Hence, no maximum retention period for personal data is foreseen.

37. According to Article 27(5) personal data in the Eudamed database shall be kept in a form which permits identification of the data subjects for no longer than the periods referred to in Article 8(4). There is, however, no reference to Article 8(4) in Article 25 of the proposed IVD Regulation . It is therefore unclear which retention period applies to personal data stored in the Eudamed database regarding IVDs. As this is an essential element, a specific paragraph on the retention of personal data should therefore be inserted in Article 25 of the proposed IVD Regulation.

38. Article 4(1)(e) of Regulation (EC) No 45/2001 and 6(1)(e) of Directive 95/46/EC require that personal data are not kept for longer than is necessary for the purposes for which the data were collected or for which they are further processed. In order to comply with this requirement, the EDPS suggests inserting a maximum retention period for personal data under the proposed Regulations. The chosen period should be necessary and proportionate for the purposes for which personal data are collected and processed. 2.8. Delegated and Implementing acts

39. The proposed Regulations introduce the possibility for the Commission to adopt a large number of delegated and implementing acts. In the EDPS' opinion, the substantial provisions related to the fundamental right to the protection of personal data should be included in the primary legislative acts (namely, the two proposed Regulations). The suggestions made throughout the present Opinion aim at addressing all the issues related to processing of personal data in the text of the proposed MD Regulation and the proposed IVD Regulation. However, the EDPS encourages the Commission to consult the EDPS in relation to any delegated or implementing act adopted pursuant to the proposed Regulations which might have an impact on the processing of personal data.

3. CONCLUSIONS

40. The EDPS welcomes the attention paid specifically to data protection in the proposed Regulations, but identified some scope for further improvement.

41. The EDPS recommends that:  Article 85 of the proposed MD Regulation and Article 81 of the proposed IVD Regulation clarify the reference to Directive 95/46/EC by specifying that the provisions will apply in accordance with the national rules which implement Directive 95/46/EC.  inserting in Article 85 of the proposed MD Regulation and in Article 81 of the proposed IVD Regulation explicit reference to Article 8 of Directive 95/46/EC and Article 10 of Regulation (EC) No 45/2001.  inserting similar paragraphs regarding purposes for data processing, data subject rights and data retention periods as in Article 27 of the proposed MD Regulation into Article 25 of the proposed IVD Regulation, subject to the modifications suggested in this Opinion.  including a definition of the term 'subject' in the proposed Regulations.  unambiguously preventing the inclusion of all patients´ health data in the clinical investigations module of the Eudamed database.  inserting provisions in the proposed MD Regulation and the proposed IVD Regulation that clearly define in which situations and subject to which safeguards information containing patient health data will be processed and stored in the Eudamed database concerning vigilance and post market surveillance. In particular, the proposed Regulation should require that a risk assessment be carried out by the Commission before the processing and storage of any patient health data in the Eudamed database.  including, in a Recital of both proposed Regulations, that any implementing measures to be adopted under the proposed Regulations should specify in detail the data protection implications of the functional and technical characteristics of the Eudamed database and the EDPS should be consulted.  explicitly mentioning that periodic reports in Article 61 of the proposed MD Regulation and Article 59 of the proposed IVD Regulation should only be using anonymous data.  adding the following sentence to Article 8(6) of both proposed Regulations: "Before any processing of data concerning health of patients takes place, manufacturers shall obtain explicit consent from the data subject pursuant to Article 8(2)(a) of Directive 95/46/EC".  inserting provisions regulating how personal data should be managed as regards the surveillance by competent authorities in the proposed Regulations.  inserting a maximum retention period for personal data under the proposed Regulations. The chosen period should be necessary and proportionate for the purposes for which personal data are collected and processed.  consulting the EDPS in relation to any delegated or implementing act adopted pursuant to the proposed Regulations which might have an impact on the processing of personal data. Done in Brussels, 8 February 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor