EDPS Opinion 24/2023 on the Proposal for a Regulation laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the EMA

19 June 2023

Opinion 24/2023

on the Proposal for a Regulation laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency, amending Regulation (EC) No 1394/2007 and Regulation (EU) No 536/2014 and repealing Regulation (EC) No 726/2004, Regulation (EC) No 141/2000 and Regulation (EC) No 1901/2006 .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 26 April 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency, amending Regulation (EC) No 1394/2007 and Regulation (EU) No 536/2014 and repealing Regulation (EC) No 726/2004, Regulation (EC) No 141/2000 and Regulation (EC) No 1901/2006.

The Proposal aims at achieving an internal market as regards medicinal products for human use and, at the same time, setting high standards of quality and safety for medicinal products in order to meet common safety concerns with regard to such products. In this regard, the EDPS welcomes that the Proposal aims to provide a clear legal basis for the processing of personal data, including health data, by the European Medicines Agency (EMA).

Exceptions to the prohibition on processing of personal data concerning health may be provided for by Union law where it is necessary for reasons of public interest in the area of public health and/or for scientific research purposes. When doing so, however, the legal basis provided by Union law must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The EDPS therefore considers that the Proposal should at least specify all relevant sources of personal health data, together with other relevant safeguards, such as pseudonymisation.

On the processing of personal data within the Eudravigilance database, the EDPS considers that the Proposal should define what categories of personal data would be processed when sharing information on suspected adverse reactions in human beings arising from use of the medicinal products. In addition, the EDPS also recommends to specify EMA’s role and responsibilities (and of Member States where applicable) within the meaning of data protection law.

The EDPS also understands that personal data would be processed in the context of the register of orphan medicinal products. Since the register will be set up and managed by EMA, the EDPS recommends explicitly designating EMA as the controller of the processing.

Lastly, the EDPS understands that personal data would be processed in the context of the webportal created for the purpose of disseminating information on authorised or to be authorised medicinal products. Again, the EDPS considers it necessary to clarify the EMA’s role and responsibilities within the meaning of data protection law, as also the role of Member States and the Commission.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 26 April 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency, amending Regulation (EC) No 1394/2007 and Regulation (EU) No 536/2014 and repealing Regulation (EC) No 726/2004, Regulation (EC) No 141/2000 and Regulation (EC) No 1901/2006 (‘the Proposal’).

2. According to its Explanatory Memorandum , the main objectives of the Proposal are to: • guarantee a high level of public health by ensuring the quality, safety and efficacy of medicinal products for EU patients, including for paediatric patients and patients suffering from rare diseases throughout the Union and; • harmonise the internal market for the supervision and control of medicinal products and the rights and duties incumbent upon the competent authorities of the Member States.

3. The specific objectives of the Proposal are to : • ensure that all patients across the EU have timely and equitable access to safe, effective, and affordable medicines; • enhance security of supply and ensure medicines are always available to patients, regardless of where they live in the EU; • offer an attractive innovation-and competitiveness friendly environment for research, development, and production of medicines in Europe; • make medicines more environmentally sustainable.

4. As explained in the Explanatory Memorandum , the Proposal builds on the pharmaceutical strategy for Europe . This strategy aims to provide a holistic answer to the current challenges of the pharmaceutical policy to ensure EU’s supply of safe and affordable medicinal products and supporting the EU pharmaceutical industry’s innovation efforts through a combination of legislative and non-legislative measures .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 26 April 2023, pursuant to Article 42(1) EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 EUDPR.

2. General remarks

6. The EDPS welcomes the objectives of the Proposal, namely achieving an internal market as regards medicinal products for human use and, at the same time, setting high standards of quality and safety for medicinal products in order to meet common safety concerns with regard to such products.

8. The EDPS welcomes the provisions of the Proposal, recalling that the EUDPR and the General Data Protection Regulation (‘GDPR’) will apply to the various processing of personal data taking place under the Proposal . In this regard, the EDPS highlights that the protection of the fundamental rights to the protection of personal data and privacy in the context of the Proposal are inextricably linked with the protection of human dignity and the integrity of the person, particularly where special categories of personal data within the meaning of Article 9 GDPR and 10 EUDPR are involved.

9. In the chapters below, the Opinion provides specific comments and recommendations on the processing of personal health data by the European Medicines Agency (‘EMA’) as set out in Articles 166 and 169 of the Proposal. It will also make specific recommendations on the processing of personal data and the roles and responsibilities within the meaning of data protection law in the context of the various databases and registers set out and provided for in the Proposal.

10. Lastly, the EDPS notes that the Proposal does not contain any Recital referring to this consultation. Therefore, the EDPS calls for a Recital to be added to the Proposal containing specific reference to the consultation of the EDPS under Article 42(1) EUDPR.

3. Processing of personal data by EMA

11. Chapter XI of the Proposal lays down EMA’s tasks , structure and operations , financial 15 16 provisions and the general provisions applying to EMA . The EDPS welcomes that Articles 166 and 169 of the Proposal deal specifically with ‘Personal health data’ and ‘Processing of personal data’, respectively, and aim to provide a clear legal basis for the processing of such data.

3.1. Personal health data

12. Article 166(1) of the Proposal provides that EMA may process personal health data, from sources other than clinical trials, for the purpose of improving the robustness of its scientific assessment or verifying claims of the applicant or marketing authorisation holder in the context of the evaluation or supervision of medicinal product. Such processing should support EMA’s public health tasks and in particular the evaluation and monitoring of medicinal products or the preparation of regulatory decisions and scientific opinions.

13. In line with Article 9 GDPR and 10 EUDPR, processing of personal data concerning health shall be prohibited, unless one of the exceptions under Article 9(2) GDPR and 10(2) EUDPR applies. Reasons of substantial public interest in the area of public health and scientific research can justify the processing of personal data concerning health provided that appropriate safeguards for the fundamental rights and interests of the data subject are identified on the basis of Union or Member State law .

14. The EDPS notes that, while Article 166 of the Proposal outlines the purposes for which personal health data would be processed (namely EMA’s public health tasks and in particular the evaluation and monitoring medicinal products or the preparation of regulatory decisions and scientific opinions), it does not specify the categories of personal health data to be processed and the sources from which such personal health data would be collected.

15. As regards the categories of data to be processed, the EDPS understands that providing further details in the legislative act of each specific category of personal health data to be processed by EMA could be complex to achieve in practice. Article 166(1) of the Proposal makes clear, however, that only personal health data which is necessary to support EMA’s public health tasks and in particular the evaluation and monitoring medicinal products or the preparation of regulatory decisions and scientific opinions will be processed.

16. As regards the sources from which such personal health data would be collected, the EDPS notes that Article 166(1) of the Proposal indicates that personal health data to be processed by EMA would be collected “(...) from sources other than clinical trials (...)”, without providing any limitation. Recital (60) of the Proposal clarifies that EMA should be able to use personal health data including via the Data Analysis and Real World Interrogation Network (DARWIN) and the European Health Data Space interoperable infrastructure.

17. In accordance with Article 10(2) EUDPR, the prohibition on processing of personal data concerning health shall not apply in the cases of Article 10(2)(i) (public health) and Article 10(2)(g) (scientific research). Both these provisions require, however, that relevant legal basis provided by Union law ‘must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject’.

18. The EDPS understands that, in cases of use of health data by EMA via the forthcoming European Health Data Space (‘EHDS’), the safeguards required by Articles 9 GDPR and 10 EUDPR are those included in the forthcoming EHDS Regulation. In all other cases, however, in line with Articles 9 GDPR and 10 EUDPR, safeguards would need to be specified in another instrument of Union or Member State law. In the light of the considerations, the EDPS considers it necessary that at least the sources of personal health data be identified in the enacting terms of the Proposal, together with any other relevant safeguards, such as pseudonymisation.

3.2. Processing of personal data

19. Article 169(2) of the Proposal states that “[f]or the purpose of this Article, ‘regulatory science activities’ shall mean scientific projects to complement available scientific evidence with regard to diseases or horizontal questions related to medicinal products, to fill evidence gaps that cannot be fully addressed through data in the possession of the Agency, or to support horizon scanning activities. (...)”.

20. The EDPS considers that Article 169(2) of the Proposal (and in particular the underlined part) does not specify the purposes of the processing in a manner that would provide sufficient clarity and foreseeability for the individuals affected. For example, the EDPS notes that the term ‘horizon scanning activities’ lacks clarity on its meaning as well as whether the aim of filling ‘evidence gaps’ that cannot be fully addressed through data in the possession of EMA is considered as a purpose of its own or rather as a qualification of the preceding purpose. Therefore, the EDPS recommends to clarify, insofar possible, such aspects.

21. Article 169(3) of the Proposal states that “[t]he processing of personal data by the Agency in the context of this Article shall be guided by the principles of transparency, explainability, fairness, and accountability.” In this regard, the EDPS notes that, as the EUDPR as a whole would apply to any processing to personal health data performed by EMA (as explicitly confirmed by Article 169(1) of the Proposal), the EDPS suggests the deletion of Article 169(3) of the Proposal.

22. Article 169(4) of the Proposal provides that “[t]he Management Board shall establish the general scope for the regulatory science activities in consultation with the Commission and the European Data Protection Supervisor.” In this regard, the EDPS considers that Article 169(4) lacks clarity as to the elements that should be addressed by the Management Board’s 7 decision when establishing the general scope of the regulatory science activities or which criteria shall be taken into account. The EDPS recommends to clarify such aspects as much as possible. Moreover, he also suggests to clarify whether the consultation of the EDPS would take place under Article 41 EUDPR, or whether such consultation would take another form.

4. The Eudravigilance database

23. Article 101(1) of the Proposal requires EMA to set up, in collaboration with the Member States and the Commission, a ‘Eudravigilance database’ to collate pharmacovigilance information regarding medicinal products authorised in the Union and to allow competent authorities to access that information simultaneously and to share it. In addition, Article 101(3) of the Proposal requires EMA to ensure that healthcare professionals and the public have appropriate levels of access to the Eudravigilance database, and that personal data is protected. EMA is required to work together with all stakeholders, including research institutions, healthcare professionals, and patient and consumer organisations, in order to define the ‘appropriate level of access’ for healthcare professionals and the public to the Eudravigilance database.

24. The EDPS understands that the setting up and maintaining of the Eudravigilance database would entail the processing of personal data (including health data), including their transfer to third countries and relevant international organisations. In this regard, the EDPS first notes that the Article of the Proposal does not clearly define what categories of personal data would be processed when sharing information on suspected adverse reactions in human beings arising from use of the medicinal products. In addition to specifying the categories of personal data involved , the EDPS also recommends to specify EMA’s role and responsibilities (and of Member States where applicable) within the meaning of data protection law in relation the processing operations carried out in the context of the Eudravigilance database.

5. Orphan medicinal products

25. Article 64(2) of the Proposal states that, among the particulars and documentation to be provided, the application of the orphan medicine sponsor shall also include the “name or corporate name and permanent address of the orphan medicine sponsor”. Moreover, the EDPS notes that, according to Article 67(1) of the Proposal, “[t]he register of designated orphan medicinal products shall list all designated orphan medicinal products. It shall be set up and managed by the Agency and be publicly available.” In this regard, Article 67(3) of the Proposal adds that “[t]he information on the designated orphan medicinal product entered in the register of designated orphan medicinal products (...)” shall include, among others, “(b) the name and address of the orphan medicine sponsor (...)”.

26. The EDPS understands that personal data would be processed both in the context of the application and within the register of orphan medicinal products. While orphan medicine sponsors will be predominantly legal persons, it cannot be excluded that the information concerning orphan medicine sponsors relates to an identifiable natural person . As the register will be set up and managed by EMA, the EDPS recommends explicitly defining EMA’s role within the meaning of data protection law by designating EMA as the controller of the processing.

6. European medicines web-portal and register of studies for environmental risk assessment

27. Article 104(1) of the Proposal states that EMA “(...) shall, in collaboration with the Member States and the Commission, set up and maintain a European medicines web-portal for the dissemination of information on medicinal products authorised or to be authorised in the Union.” In addition, the same Article clarifies that, by means of such portal, “(...) the Agency shall make public the following: (a) the names of members of the Committees referred to in Article 142, (...) and the members of the coordination group, together with their professional qualifications and with the declarations (...)”.

28. The EDPS understands that personal data would be processed in the web-portal for the purpose of dissemination of information on medicinal products already authorised or to be authorised in the EU. Since EMA, in collaboration with Member States and the Commission, would be responsible to set up and maintain the web-portal, the EDPS considers it necessary to clarify the EMA’s role within the meaning of data protection law, as also the role of Member States and the Commission.

7. Conclusions

29. In light of the above, the EDPS makes the following recommendations: (1) to clarify in Article 166 of the Proposal at least the sources from which personal health data would be collected by EMA, together with other relevant safeguards, such as pseudonymisation; (2) to modify Article 169(2) of the Proposal in a way that it specifies the purposes of the processing in a manner that would provide sufficient clarity and foreseeability for the individuals affected; (4) to clarify in Article 169(4) of the Proposal the elements that should be addressed by the Management Board’s decision when establishing the general scope of the regulatory science activities, the criteria shall be taken into account, as well as the manner in which the EDPS shall be consulted; (5) to clarify the categories of personal data to be processed within the Eudravigilance database when sharing information on suspected adverse reactions in human beings arising from use of the medicinal products; (6) to specify EMA’s role and responsibilities (and of Member States where applicable) within the meaning of data protection law in relation the processing operations carried out in the context of the Eudravigilance database; (7) to designate EMA as the controller of the processing in relation to the register of orphan medicinal products; (8) to clarify the EMA’s role within the meaning of data protection law, as also the role of Member States and the Commission, in relation to the web-portal created for the purpose of disseminating information on authorised or to be authorised medicinal products. Brussels, 19 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10