EDPS Opinion 28/2023 on the Proposals for Regulations on supplementary protection certificates for medicinal products

21 June 2023

Opinion 28/2023

on the Proposals for Regulations on supplementary protection certificates for medicinal products

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for medicinal products (recast) and to the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for medicinal products, and amending Regulation (EU) 2017/1001, Regulation (EC) No 1901/2006 as well as Regulation (EU) No 608/2013 . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 27 April 2023 the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for medicinal products (recast) and the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for medicinal products, and amending Regulation (EU) 2017/1001, Regulation (EC) No 1901/2006 as well as Regulation (EU) No 608/2013. The objective of the Proposals is to simplify the EU’s Supplementary Protection Certificates (SPCs) system as regards national SPCs for medicinal products, as well as improve its transparency and efficiency, and to create a unitary certificate for medicinal products, complementing the unitary patent system.

The Proposals provide for (a notification of) an application for a certificate, including personal data such as the applicant’s address, to be published in a Register. As the publication of personal data constitutes an interference with the right to data protection, the Proposal should clearly articulate the specific purposes for which personal data may be made available. In addition, the EDPS recommends to consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives.

The EDPS notes the Proposals provide for unlimited retention of all entries in the Register and in an administrative database. At the same time, the Proposals provide that the party concerned may request removal of personal data from the database 18 months after expiry of the certificate or the closure of an inter partes procedure. As personal data should not be kept for longer than is necessary to achieve the purposes of the processing, the EDPS considers that personal data in the Register and database should not be kept indefinitely. The EDPS invites the legislature to consider whether an 18-month retention period could be prescribed as a rule for personal data regardless of the submission of a request, both for the Register and the database, with the possibility to extend the retention period, where necessary, to safeguard the rights of individuals (e.g., in the context of possible exercise of legal claims).

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 27 April 2023, the European Commission issued • the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for medicinal products (recast) (‘the national SPC Proposal’) and • the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for medicinal products, and amending Regulation (EU) 2017/1001, Regulation (EC) No 1901/2006 as well as Regulation (EU) No 608/2013 (‘the unitary SPC Proposal’) (together ‘the Proposals’).

2. The Proposals are part of a larger package of new EU rules on patents. Four Proposals deal with Supplementary Protection Certificates (SPC), two of which are the subject of this Opinion.

3. An SPC is an intellectual property right sui generis that extends the 20-year term of patents for medicinal or plant protection products by up to 5 years. However, SPC protection so far is only available at national level. As a result, according to the Commission, the current system suffers from fragmentation, which leads to complex and costly procedures, as well as legal uncertainty .

4. The objective of the national SPC Proposal is to simplify the EU’s SPCs system as regards national SPCs for medicinal products, as well as improve its transparency and efficiency. The Proposal is a Recast of Regulation (EC) No 469/2009 , which provides for SPCs for plant medicinal products. The Proposal also aims to introduce a centralised procedure for granting SPCs for medicinal products. This would allow applicants to obtain SPCs in the respective designated Member States by filing a single ‘centralised SPC application’ that would undergo a single centralised examination procedure by the European Union Intellectual Property Office (‘the Office’), supported by national offices.

5. The main objectives of the unitary SPC Proposal are to simplify the EU’s SPC system, as well as improve its transparency and efficiency, by creating a unitary certificate for medicinal products, and to complement the unitary patent system (‘European patent with unitary effect’). Under the Proposal, the unitary SPC can be requested by filing an application that would then be subjected to the same centralised examination procedure by the European Union Intellectual Property Office (‘the Office’) as applicable to ‘centralised SPC applications’ mentioned in the previous paragraph.

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 27 April 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the 8 9 reference to this consultation in Recitals 71 and 45 respectively of the two Proposals.

2. General remarks

7. The EDPS takes note of the fact that the emphasis of these Proposals is not on the processing of personal data. However, launching an application for a certificate or unitary certificate will involve the processing of certain personal data, even if the applicant is a legal and not a natural person. Against this background, this Opinion will focus on the provisions requiring publication of personal data, as well as the proposed storage duration.

8. The EDPS notes that both Proposals make reference to Regulation (EC) No 45/2001 . As this legal act has been repealed by the EUDPR, the EDPS recommends making reference to the EUDPR instead.

3. Publication of personal data of applicants and representatives

9. Both Proposals require (notification of) an application for a certificate to be published in a public register . The Proposals diverge, however, as to when information relating to the representatives of the applicant, if any, should be published. While the unitary SPC Proposal would require publication of the name and address of the representative by the Office in a Register , the national SPC Proposal would not require the competent industrial property office of the relevant Member State to publish such information .

10. The reason for this difference in treatment of personal data concerning representatives is not immediately apparent. If the publication of such data is not necessary to achieve the purposes of the processing, it should not be provided for.

11. The EDPS recognizes that the applicant does not need to be the inventor, but instead will often be a company. Even then, however, the natural persons authorised to represent the company are regularly named as well. Company names may also contain the name of the natural person who is the owner of the company .

12. The Proposals mention transparency and legal certainty, especially a reduced risk of subsequent challenges of a granted SPC, as objectives of the publication . However, the EDPS recalls that transparency can only justify the processing of personal data to the extent it is necessary and proportionate. In the view of the EDPS, this does not seem to be the case in relation to the publication of the address of natural person applicants.

13. The EDPS also has doubts as to whether the objective to allow for speedy intervention by interested parties would justify to publish the addresses of natural persons as applicants prior to the issuance of a certificate. The publication of applications under the Proposals prior to a decision on the applications would enable for observations by third parties to be submitted during the examination phase conducted by the European Union Intellectual Property Office, which is also maintaining the Register, allowing for the early assertion of any objections . As the Office receiving the observations is also competent to examine the applications, it is not apparent why a third party coming forward with an observation would need to obtain the full address of the applicant from the public entry in the Register.

14. Against this background, the EDPS invites the co-legislators to consider whether the publication of personal data envisaged by the Proposal is necessary to achieve its objectives. As the publication of personal data constitutes an interference with the right to data protection, the Proposal should clearly articulate the specific purposes for which personal data may be made available . In addition, the EDPS recommends to consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives. A clear specification of the purposes and conditions under which access may be granted would constitute an important safeguard to ensure that access to and use of these personal data would be limited to the purposes for which they are made available.

4. Roles and Responsibilities

15. The Proposals determine the purposes and means of the processing of personal data in the Register as well as in the additional electronic database. In line with Article 3(8) of the EUDPR, the EDPS recommends to designate EUIPO as controller for the personal data processing .

5. Retention period

16. According to Article 35(10) of the national SPC Proposal, Article 35(8) of the unitary SPC Proposal respectively, all entries in the Register shall be kept for an indefinite period of time ‘for reasons of legal certainty’. Likewise, according to Article 36(5) of both Proposals, all data in the ‘database’ shall be kept indefinitely. However, the party concerned may request the removal of any personal data from the database after 18 months from the expiry of the certificate or, the case being, the closure of the relevant inter partes procedure.

17. According to Article 4(1)(e) of the EUDPR, personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Therefore, personal data is to be removed ex officio once its processing is no longer necessary. In this regard, the EDPS invites the legislature to consider whether an 18-month retention period could be prescribed as a rule for personal data regardless of the submission of a request, both for the Register and the database, with the possibility to extend the retention period, where necessary, to safeguard the rights of individuals (e.g., in the context of possible exercise of legal claims).

6. Conclusions

18. In light of the above, the EDPS makes the following recommendations: (1) to replace the references to Regulation (EC) No 45/2001 with a references to Regulation (EU) 2018/1725; (2) to clearly articulate the specific purposes for which personal data may be made available and consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives (3) to designate EUIPO as controller within the meaning of the EUDPR for processing of personal data in the Register as well as in the additional electronic database; (4) to align the provisions on the deletion of personal data from the Register and the database with Article 4(1)(e) of the EUDPR by providing a maximum storage duration. Brussels, 21 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7