EDPS Opinion 25/2023 on the Proposal for a Directive on the Union code relating to medicinal products for human use and repealing Directive 2001/83/EC and Directive 2009/35/EC

19 June 2023

Opinion 25/2023

on the Proposal for a Directive on the Union code relating to medicinal products for human use

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on the Union code relating to medicinal products for human use and repealing Directive 2001/83/EC and Directive 2009/35/EC .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 26 April 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on the Union code relating to medicinal products for human use and repealing Directive 2001/83/EC and Directive 2009/35/EC.

The Proposal aims to promote innovation, in particular for unmet medical needs, while reducing regulatory burden and the environmental impact of medicines. It also aims to ensure access to innovative and established medicines for patients, with special attention to enhancing security of supply and addressing risks of shortages.

Exceptions to the prohibition on processing of personal data concerning health may be provided for by Union law where it is necessary for reasons of public interest in the area of public health and/or for scientific research purposes. When doing so, however, the legal basis provided by Union law must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The EDPS therefore considers that the Proposal should at least specify all relevant sources of personal health data, together with other relevant safeguards, such as pseudonymisation.

On the repository of active substance master files, the EDPS acknowledges that its establishment will also involve processing of personal data (and possibly personal health data). In this regard, the EDPS considers that the Proposal should clarify the respective roles and responsibilities of EMA and the Member States within the meaning of data protection law.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 26 April 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on the Union code relating to medicinal products for human use and repealing Directive 2001/83/EC and Directive 2009/35/EC (‘the Proposal’).

2. According to its Explanatory Memorandum , the main objectives of the Proposal are to: • guarantee a high level of public health by ensuring the quality, safety and efficacy of medicinal products for EU patients, including for paediatric patients and patients suffering from rare diseases throughout the Union and; • harmonise the internal market for the supervision and control of medicinal products and the rights and duties incumbent upon the competent authorities of the Member States.

3. The specific objectives of the Proposal are to : • ensure that all patients across the EU have timely and equitable access to safe, effective, and affordable medicines; • enhance security of supply and ensure medicines are always available to patients, regardless of where they live in the EU; • offer an attractive innovation-and competitiveness friendly environment for research, development, and production of medicines in Europe; • make medicines more environmentally sustainable.

4. As explained in recital 3, the Proposal is part of the implementation of the Pharmaceutical strategy for Europe. The Proposal aims to promote innovation, in particular for unmet medical needs, while reducing regulatory burden and the environmental impact of medicines. It also aims to ensure access to innovative and established medicines for patients, with special attention to enhancing security of supply and addressing risks of shortages.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 27 April 2023, pursuant to Article 42(1) of EUDPR.

2. General remarks

6. The EDPS welcomes the objectives of the Proposal, namely achieving an internal market as regards medicinal products for human use and, at the same time, setting high standards of quality and safety for medicinal products in order to meet common safety concerns with regard to such products.

7. The EDPS considers that both the Explanatory Memorandum and the Preamble to the Proposal clearly set out its objectives, in support of the necessity of the foreseen processing of personal data, including special categories of personal data (in particular health data).

8. The EDPS welcomes the provisions of the Proposal recalling that the EUDPR and the Regulation (EU) 2016/679 (‘GDPR’) will apply to the various processing of personal data taking place under the Proposal . In this regard, the EDPS highlights that the protection of the fundamental rights, and the protection of personal data and privacy, in the context of the Proposal are inextricably linked with the protection of human dignity and integrity of the person, particularly where special categories of personal data within the meaning of Article 9 GDPR and 10 EUDPR are involved.

9. In the chapters below, the Opinion provides specific comments and recommendations on the processing and use of health data by the competent authorities as set out in recital 30 and Article 200 of the Proposal. It will also make specific recommendations on the processing of personal data and the roles and responsibilities within the meaning of data protection law in the context of the repository of active substance master files, which is provided for in the Proposal.

10. Lastly, the EDPS notes that the Proposal does not contain any recital referring to this consultation. Therefore, the EDPS recommends that a recital be added to the Proposal containing specific reference to the consultation of the EDPS under Article 42(1) EUDPR.

3. Processing and use of personal health data by competent authorities

11. The EDPS notes that Article 200(4) of the Proposal states that “[t]he competent authority of the Member State may process personal health data from sources other than clinical studies to support their public health tasks and, in particular, the evaluation and monitoring to medicinal products, for the purpose of improving the robustness of the scientific assessment or verifying claims of the applicant or marketing authorisation holder” and that “[p]rocessing of personal data under this Directive shall be subject to Regulations (EU) 2016/679 and (EU) 2018/1725, as applicable.”

12. In line with Article 9 GDPR, processing of personal data concerning health shall be prohibited, unless one of the exceptions under Article 9(2) GDPR applies. Reasons of substantial public interest in the area of public health and scientific research can justify the processing of personal data concerning health provided that appropriate safeguards for the fundamental rights and interests of the data subject are identified on the basis of Union or Member State law .

13. In this regard, the EDPS notes that, while the Proposal outlines the purposes for which processing of personal data would be carried out, it does not specify the categories of personal health data to be processed or the sources from which such personal health data would be collected.

14. As regards the categories of data to be processed, the EDPS understands that providing further details in the legislative act of each specific category to be processed by Member States could be complex to achieve in practice. Article 200(4) of the Proposal makes clear, however, that competent authorities may only personal health data which is necessary to support to support the public health tasks and, in particular, the evaluation and monitoring to medicinal products, for the purpose of improving the robustness of the scientific assessment or verifying claims of the applicant or marketing authorisation holder.

15. As regards the sources from which such personal health data would be collected, the EDPS notes that Article 200(4) of the Proposal indicates that personal health data to be processed by Member States could be health data generated outside of clinical studies. Recital 30 of the Proposal indicates that competent authorities should be able to use such data, including via the European Health Data Space interoperable infrastructure.

16. In accordance with Article 9(2) GDPR, the prohibition on processing of personal data concerning health shall not apply in the cases of Article 9(2)(i) (public health) and Article 9(2)(g) (scientific research). Both these provisions require, however, that the relevant legal basis provided by Union or Member State law “provides for suitable and specific measures” to safeguard the rights of the data subject.

17. The EDPS understands that, in cases of use of health data via the forthcoming European Health Data Space (‘EHDS’), the safeguards required by Articles 9 GDPR will be those included in the forthcoming EHDS Regulation. In all other cases, however, in line with Articles 9 GDPR, safeguards would need to be specified in another instrument of Union or Member State law. In the light of the considerations, the EDPS considers it necessary that at least the sources from which personal health data would be collected be identified in the enacting terms of the Proposal, together with any other relevant safeguards, such as pseudonymisation.

4. Repository of active substance master files

18. The EDPS notes that Article 4(1)(36) of the Proposal defines 'active substance master file’ as “(...) a document that contains a detailed description of the manufacturing process, quality control during manufacture and process validation prepared in a separate document by the manufacturer of the active substance;”. Moreover, Article 25(2) of the Proposal adds that “[t]he Agency shall establish a repository of active substance master files, their assessments reports and their certificates and ensure that personal data is protected. The Agency shall ensure that the competent authorities of the Member State have access to this repository”.

19. Given the wording of Article 25(2) of the Proposal, the EDPS understands that the establishment of the repository of active substance master files will also involve processing of personal data. In this regard, the EDPS notes that the Proposal does not specify the respective roles and responsibilities of EMA and the Member States within the meaning of data protection legislation. A clear allocation of roles and responsibilities between EU institutions and the national authorities is important, however, in particular with a view of ensuring transparency and the exercise of data subject rights. The EDPS therefore recommends specifying the roles and responsibilities of EMA and the Member States within the meaning of data protection law in relation to the processing operations carried out within the repository.

5. Conclusions

20. In light of the above, the EDPS makes the following recommendations: (2) to clarify in Article 200(4) of the Proposal at least the sources from which personal health data would be collected by Member States, together with other relevant safeguards, such as pseudonymisation; (3) to specify the roles and responsibilities of EMA and the Member States within the meaning of data protection law in relation to the processing operations carried out within the repository of active substance master files. Brussels, 19 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI