text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2012) 369 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: See Articles

text: and

text: and Recitals 52, 59 and 65. 5 A 'Subject' is defined in Article 2 (15) of the proposed Regulation as 'an individual who participates in a clinical trial, either as recipient of an investigational medicinal product or as a control'.

text: A 'Sponsor' is defined in Article 2 (13) of the proposed Regulation as 'an individual, company, institution or organisation which takes responsibility for the initiation and management of a clinical trial'. 7 The proposed Regulation contains provisions allowing or requiring national authorities to exchange information between them and the Commission or with the EMA. In particular, the Articles concerning the EU Portal and database (Articles

text: ) and the articles concerning the EMA database (

text: Articles 36

text: - 43) clearly imply that exchanges of personal data will take place under the proposed Regulation. 8 For a more in-depth analysis of the notion of consent in data protection law, see

text: Article 29

text: Data Protection Working Party Opinion 15/2011 of 13 July 2011 on the definition of consent, 01197/11/EN,

text: WP 187

text: See ECHR 17 July 2008, I v Finland (appl. No 20511/03), paragraph 38 and ECHR 25 November 2008, Armonas v Lithuania (appl. No 36919/02), paragraph 40. 10 See Section 3.4. of the explanatory memorandum to the proposed Regulation. 11 An 'Investigator' is defined in Article 2 (14) of the proposed Regulation as 'an individual responsible for the conduct of a clinical trial at a clinical trial site'.

text: See Section 3.5. on p. 7 of the proposed Regulation. 13 EDPS Opinion of 22 April 2009, http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2009/09- 04-22_pharmacovigilance_EN.pdf. 14 EDPS Opinion of 7 September 2009, http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Supervision/Priorchecks/Opinions/ 2009/09-09-07_EMEA_EudraVigilance_EN.pdf. 15 Commission Implementing Regulation on the performance of pharmacovigilance activities,

text: (EU) No 520/2012

text: of 19 June 2012.

text: This is based on the exception to erasure of data for historical, statistical and scientific research purposes provided for in

text: Article 17.3

text: (c) of the proposed Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (general data protection regulation), COM (2012) 11 final.

amnesord:
Health
Clinical Trials

title: Clinical trials on medicinal products

text: Opinion of the European Data Protection Supervisor

text: on the Commission proposal for a Regulation on clinical trials on medicinal products for human use, and repealing Directive

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free 2 movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 17 July 2012, the Commission adopted a proposal for a Regulation on clinical trials on medicinal products for human use (‘the proposed Regulation’) , and repealing Directive

text: . This Proposal was sent to the EDPS for consultation on 19 July 2012.

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and recommends that a reference to the consultation be included in the preambles of the proposed Regulation.

text: 3. Before the adoption of the proposed Regulation, the EDPS was given the possibility to provide informal comments to the Commission. Some of these comments have been taken into account. As a result, the data protections safeguards in the proposed Regulation have been strengthened. 1.2. Objectives and scope of the proposed Regulation

text: 4. The proposed Regulation aims at facilitating the application process for clinical trials on medicinal products for human use, especially for multinational trials. It contains a legal framework for establishing an EU-wide central database (EU database), controlled by the Commission, as the single application platform for clinical trials in the EU. The proposed Regulation also introduces an electronic database (EMA database), controlled by the European Medicines Agency (EMA), for reporting of suspected unexpected serious adverse reactions. 1.3. Aim of the EDPS Opinion

text: 5. The proposed Regulation may affect the rights of individuals related to the processing of their personal data. Amongst other issues, it deals with the processing of sensitive data (health data), databases and record keeping.

text: 6. Although the EDPS welcomes that the Commission has made an effort to guarantee the correct application of EU rules concerning the protection of personal data in the proposed Regulation, the EDPS has identified certain unclarities and inconsistencies in the way the proposed Regulation deals with the issue of whether and what categories of personal data will be processed under the proposed Regulation, in particular where sensitive data regarding health might be processed and stored. The EDPS therefore sees a need for clarification in relation to this category of personal data, both regarding the authorisation procedure in the EU Portal and database and the reporting of adverse effects in the EMA database.

text: 2. ANALYSIS OF THE PROPOSAL 2.1. Applicability of data protection legislation

text: 7. Recitals and provisions of the proposed Regulation mention Articles 7 and 8 of the Charter of Fundamental Rights, Directive

text: and Regulation (EC) No 4 45/2001 .

text: 8. In particular,

text: Article 28(1)

text: (e) states that a clinical trial may only be conducted if data concerning the subject is protected in accordance with Directive

text: . Article 89 of the proposed Regulation states that Member States shall apply Directive

text: to the processing of personal data pursuant to the proposed Regulation and that

text: Regulation (EC) No 45/2001

text: shall apply to the processing of personal data carried out by the Commission and the EMA in the context of the proposed Regulation.

text: 9. The EDPS welcomes these provisions but recommends that

text: Article 89

text: clarifies the reference to Directive

text: by specifying that the provisions will apply in accordance with the national rules which implement Directive

text: 10. These references to data protection law are relevant, for example, in relation to the various provisions concerning exchanges of personal data between national authorities/sponsors of clinical trials on the one side and the Commission/EMA on the other. These provisions are legitimate but need to be applied in a way which is consistent with data protection legislation. The risk is to be avoided in particular that they could be construed as a blanket authorisation to exchange all kind of personal data . 2.2. Consent

text: 11. The proposed Regulation deals extensively with the issue of informed consent in Articles

text: . Furthermore, Recital 22 of the proposed Regulation states that the Charter of Fundamental Rights of the European Union requires that any intervention in the field of medicine has to be performed with free and informed consent of the person concerned.

text: 12. The notion of informed consent is central in data protection law. However, the EDPS understands that consent, even if it is the basis for a patient's participation in the clinical trial, is not the basis for processing and storage of personal data under the proposed Regulation. He will therefore not comment on the specific provisions concerning informed consent in the proposed Regulation . 2.3. Processing of personal data concerning health

text: 13. Clinical trials are by nature dependent on the processing and storage of personal data of patients at different levels (local, national and European). Personal data of patients participating in clinical trails can be considered as data relating to health (‘health data’) of the persons concerned since they reveal information about medicine use and associated health problems.

text: 14. Processing of such data is subject to strict data protection rules as laid down in

text: Article 10 of Regulation (EC) No 45/2001

text: and

text: Article 8 of Directive 95/46/EC

text: and its implementing national laws. Among the grounds, which allow for processing of personal data relating to health,

text: Article 10(3) of Regulation (EC) No 45/2001

text: and Article 8(3) of Directive 95/46 are applicable in this case. These provisions lift the prohibition of processing health related data if the processing is ‘required for the purpose of preventive medicine...’. The EDPS wishes to underline that this sets a high standard.

text: 15. The importance of protecting such data has repeatedly been emphasised by the European Court of Human Rights in the context of Article 8 of the European Convention of Human Rights. The Court has stated: ‘The protection of personal data, in particular medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention’ . The EDPS therefore recommends inserting in Article 89 of the proposed Regulation an explicit reference to

text: and

text: Article 8 of Directive 95/46/EC

text: . 2.4. Other data than patient health data

text: 16. Personal data other than health data will be processed and retained under the proposed Regulation. For example, the explanatory memorandum states that personal data of Investigators will be kept in the EU database in order to aid the detection of misconduct. The EMA database might also contain personal information about the (employees of) Sponsors when they are providing information to the database. The EDPS wishes to underline that once identifiable data are processed, the party responsible for such processing (the Commission or the EMA) must comply with all the requirements of EU data protection legislation. 2.5. Processing of personal data concerning health in the central databases 2.5.1. EU Portal and database

text: 17. The EU Portal and database are regulated in Articles 77 and 78 of the proposed Regulation. The EDPS welcomes the attention given to the protection of personal data in the wording of

text: Article 78

text: about the EU database. Article

text: and

text: state that the EU database shall contain personal data if it is necessary to enable the co-operation between the competent authorities of the Member States. The EDPS understands that this purpose is legitimate within the framework of multinational clinical trials and that it is necessary to process certain kinds of personal data to achieve the simplification and harmonisation that the proposed Regulation aims for.

text: 18. According to Recital 52, no personal data of individuals participating in the clinical trial (patients) will be collected in the EU database. This is a statement of intent that indeed the EU database will not include patient health data. Nevertheless, the attention given to the protection of personal data in the wording of

text: Article 78

text: , and especially the fact that no personal data of patients shall be publicly accessible might suggest that processing of patient health data cannot be avoided. This unclarity in the proposed Regulation must be rectified. The EDPS recommends that the exclusion of personal data of patients in the EU database be incorporated in

text: Article 78

text: instead of in a recital.

text: 19. The EDPS welcomes that the right of access for data subjects and the rights to correction and deletion of their personal data are addressed in the proposed Regulation in

text: Article 78(7)

text: . He also welcomes that the last sentence of

text: Article 78(7)

text: states that corrections and deletions shall be carried out as soon as possible, but no later than within 60 days. However, the right of the data subject to block their personal data has not been addressed and should be included.

text: 20. Moreover, any implementing measures to be adopted under the proposed Regulation should specify in detail the data protection implications of the functional and technical characteristics of the EU database and the EDPS should be consulted. 2.5.2. European Medicines Agency Database

text: 21. According to Articles 36, 38 and 39 of the proposed Regulation, the EMA shall set up and maintain an electronic database for the reporting of suspected unexpected serious adverse reactions to medicines and the annual reporting by the Sponsor and in some cases the national authorities to the EMA. Annex III to the proposed Regulation specifies the requirements for this reporting. Neither these Articles nor the Annex prohibit the processing of personal data of patients. Hence, processing of personal data of patients is allowed in the EMA database.

text: 22. The Commission states in the explanatory memorandum to the proposed Regulation that the direct reporting of suspected unexpected serious adverse reactions to the European database EudraVigilance that is in place under Directive

text: shall remain unchanged.

text: 23. The issue of the reporting of adverse reactions to medicines (pharmacovigilance) has been a subject on which EDPS has commented on a number of occasions. In 2009, the EDPS published an Opinion on the amendments to

text: Regulation (EU) No 1345/2010

text: and Directive

text: . The EDPS also published an Opinion on a notification for prior checking regarding the EudraVigilance database and provided informal comments to the Commission before the publication of the implementing regulation on the performance of pharmacovigilance activities (the 15 Implementing Regulation) .

text: 24. A large quantity of patient data concerning health is, at the moment, being recorded and kept in the EudraVigilance database concerning clinical trials. A general issue the EDPS wishes to raise is the actual necessity of processing directly identifiable patient health data at EU level.

text: 25. Article 28(1) of the Implementing Regulation provides that in certain cases the individual case safety report shall include information identifying the patient. Indeed, even in case the patient is not mentioned by name, it is possible by putting the different pieces of information together (e.g. hospital, birth date, initials) and/or under specific conditions (e.g. in closed communities or small places) to identify him or her. Therefore, information processed in the context of safety reporting falls in principle within the scope of data protection law. This fact is also recognised in the Guidelines on the EudraVigilance database where it is stated that ‘the information should be as complete as possible, taking into account EU legislation on data protection’.

text: 26. It may be necessary to include information identifying patients in the primary reports collected and maintained by the sponsor or the national authority. However, the EDPS does not see the need for this information to be preserved in a central database like the EMA database. It would be sufficient to provide for a traceability mechanism (e.g. through pseudonymisation of the data). Sponsors should submit their reports to the EMA database only after having pseudonymised the data (i.e. substituting direct identification elements like the name with a code). This would still enable the traceability of the data along the whole system, whereas at the same time this would render direct identifiability in the central EMA database impossible. Duplication of reporting can be avoided through the application of well structured data reporting procedures.

text: 27. The EDPS recommends inserting a provision in the proposed Regulation that clearly defines in which situations and subject to what safeguards information containing patient health data will be processed and stored in the EMA database. In particular, the proposed Regulation should require that a risk assessment be carried out by the EMA before the processing and storage of any patient health data in the EMA database.

text: 28. When referring to periodic safety reports (annual reports) from the sponsor to the EMA in Article 39 of the proposed Regulation, the EDPS recommends that it should be explicitly mentioned that the annual reports should only be using anonymous data.

text: 29. As stated above regarding the EU database, any implementing measures to be adopted under the proposed Regulation should specify in detail the data protection implications of the functional and technical characteristics of the EMA database and the EDPS should be consulted. 2.6. Record keeping under the proposed Regulation

text: 30. The only provision of the proposed Regulation that concerns record keeping is

text: Article 55

text: in relation to archiving of the clinical trial master file. This provision obliges the sponsor and the investigator to archive the content of the clinical trial master file for at least 5 years unless other Union legislation requires archiving for a longer period. There is no such obligation foreseen in the proposed Regulation regarding the EU and EMA databases. The explanatory memorandum explains that it is important to keep the personal data of investigators for several years after the conclusion of the clinical trial, to be able to retroactively detect cases of misuse .

text: Article 6(1)

text: (e) of Directive

text: requires that personal data are not kept for longer than is necessary for the purposes for which the data were collected or for which they are further processed. In order to comply with this requirement, the EDPS suggests inserting a maximum retention period for personal data under the proposed Regulation. The chosen period should be necessary and proportionate for the purposes for which personal data are collected and processed.

text: 3. CONCLUSIONS

text: 32. The EDPS welcomes the attention paid specifically to data protection in the proposed Regulation, but identified some scope for further improvement.

text: 33. The EDPS recommends that:  Article 89 of the proposed Regulation clarifies the reference to Directive

text: ;  the proposed Regulation explicitly refers to

text: Article 8 of Directive 95/46/EC

text: and

text: regarding the processing of personal data concerning health in

text: Article 89

text: Article 78

text: clarifies whether personal data concerning health will be processed in the EU database, and if so, for what purpose; 

text: Article 78

text: refers to the right of the data subjects to block their personal data;  the proposed Regulation inserts, for the EMA database, a provision which more clearly defines in what situations and subject to what safeguards information containing patient data will be processed and stored;  it should be explicitly mentioned in Article 39 of the proposed Regulation that the annual reports should only be using anonymous data;  implementing measures to be adopted under the proposed Regulation specify in detail the data protection implications of the functional and technical characteristics of the EU database and the EMA database and that the EDPS be consulted on these measures; and  Article 55 of the proposed Regulation replaces or complements the minimum retention period of 5 years by a maximum retention period. Done in Brussels, 19 December 2012 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3

text: Regulation (EC) No 273/2004

text: on drug precursors, OJ L 47, 18.02.2004, p. 1. 4

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors, OJ L 22, 26.01.2005, p. 1.

text: Convention against illicit drug trafficking (hereinafter: “the UN Convention”) . Article 12 of the UN Convention requires the Parties to control the trade of the substances used to illicitly manufacture narcotic drugs and psychotropic substances (hereinafter "drug precursors"). The control of these substances aims at fighting against illicit drug trafficking by reducing their supply . However, as drug precursors also have licit industrial uses , their trade cannot be prohibited.

text: United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances, adopted in Vienna on 19 December 1988. 6 This is combined with measures aimed at reducing the demand of illicit drugs. See the EU Drug Strategy 2005- 2012, endorsed by the European Council of November 2004 (15074/04 CORDROGUE 77 SAN 187 ENFOPOL 187 RELEX 564 and the EU Drugs Action Plan 2009-2012 (2008/C 326/09). 7 E.g., in the synthesis of plastics, pharmaceuticals, cosmetics, perfumes, detergents and aromas. 8

text: Commission Regulation (EC) No 1277/2005 of 27 July 2005

text: laying down implementing rules for

text: Regulation (EC) No 273/2004

text: on drug precursors and for

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors, OJ L 202, 3.8.2005, p. 7. 9 Report from the Commission to the Council and the European Parliament pursuant to

text: Article 16 of Regulation (EC) No 273/2004

text: and to

text: Article 32 of Council Regulation (EC) No 111/2005

text: on the implementation and functioning of the existing EU legislation on drug precursors (COM(2009)709 final). 10 Acetic anhydride (AA) is the main drug precursor for heroin. The registration requirement related to AA currently applies only to operators placing AA on the market, not to users of the substance.

text: Most of these actors are defined in Article 2 of both the external trade regulation and the intra-EU trade regulation, and in

text: Article 1

text: (b) of the intra-EU trade proposal. 13 See European Court of Justice, 9 November 2010, Volker und Markus Schecke,

text: and

text: , para. 53. 14 Ibid., para. 87. 15 Ibid. 16 See section II.2.4.

text: See

text: Article 3(1)

text: the intra-EU trade regulation and Article 3 of the implementing regulation. 18 See Article 3 of the intra-EU trade regulation, amended by

text: Article 1(2)

text: (a) of the intra-EU trade proposal, and Article 6(1) of the external trade regulation. 19 See Article 5(1) of the implementing regulation. 20 See Article 7(1) of the external trade regulation and

text: Article 1(2)

text: (c) of the intra-EU trade proposal. 21 See Article 3(4) of the intra-EU trade regulation, second paragraph of

text: Article 1(2)

text: (d) of the intra-EU trade proposal, Article 6(1) of the external trade regulation,

text: Article 1(3)

text: (a) of the external trade proposal and

text: Article 8(1)

text: 1 of the implementing regulation. 22 See Article 3(4) of the intra-EU trade regulation, second paragraph of

text: Article 1(2)

text: (d) of the intra-EU trade proposal, Article 6(2) of the external trade regulation and

text: Article 1(3)

text: (c) of the external trade proposal. 23 See

text: Article 11(1)

text: (b) of the implementing regulation as regards suspension and revocation of licences.

text: See also Sections II.2.4 and II.2.8. 25 See

text: Article 1(3)

text: (a) of the intra-EU trade proposal. 26 See point 1 of Annex III of the intra-EU trade regulation. 27 See Article 8(1) of the external trade regulation. 28 See Article 3 of the external trade regulation and Article 5 of the intra-EU trade regulation, which require similar categories of data. 29 See Article 5(3) of the intra-EU trade regulation. 30 See

text: Article 1(3)

text: (4) of the intra-EU trade proposal.

text: See Article 11(1) of the external trade regulation. 32 See Article 12(10) of the UN Convention. 33 See Sections 4 and 5 of the external trade regulation. 34 See Articles

text: and

text: the external trade regulation. 35 See Annexes V-VII of the implementing regulation. 36 See

text: Article 15

text: (b) and (d) and

text: Article 23

text: (b) and (c) of the external trade regulation.

text: See Section II.2.4. 38 See

text: Article 1(3)

text: (4) of the intra-EU trade proposal and Article 9(1) of the external trade regulation. See also section II.2.7 as regards transfers to third countries.

text: preventing the diversion of scheduled substances . He recommends adding a similar provision in the intra-EU trade proposal.

text: See

text: Article 1(5)

text: (a) of the external trade proposal. 40 See

text: Article 1(5)

text: (a) of the external trade proposal. 41 See

text: Article 8(1) of Directive 95/46/EC

text: See for example Article 5(5) of the intra-EU trade proposal. 43 See

text: Article 6(1)

text: (e) of Directive

text: . 44 See Article 5(5) of the intra-EU trade proposal. 45 See

text: Article 12(9)

text: (d). 46 See Articles

text: and

text: of Directive 95/46/EC. 47 See Article 11 of the Regulation.

text: See Sections 4 and 5 of the external trade regulation. 49 See

text: Article 15

text: (b) and (d) and

text: Article 23

text: (b) and (c) of the external trade regulation. 50 See

text: Article 25

text: . 51 A third country can be considered as "adequate" on the basis of a decision by the Commission according to Article 25(6) of the Directive

text: . Most of the countries listed in Annex IV of

text: Regulation (EC) No 1277/2005

text: do not have this status. 52 See

text: Article 26(1)

text: (d) of Directive

text: . 53 See

text: Article 29

text: Working Party, Working document on a common interpretation of

text: Article 26(1) of Directive 95/46/EC of 24 October 1995

text: WP 114

text: , available at http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp114_en.pdf. 54 See

text: Article 26(2) of Directive 95/46/EC

text: , according to which Member States may authorize a trasnfer or a set of transfers of personal data to third countries which do not ensure an adequate level of protection (...) where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights (...)". 55 See Commission Decision of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive

text: (Appendix 2), available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32001D0497:EN:NOT.

text: See http://www.unodc.org/unodc/en/global-it-products/pen.html. 57 See https://eportal.unvienna.org/production/its/WebAccountRequest.nsf/AccountRequest?OpenForm&Account=PE N&AccountShowAll=0&GeneralText=0#TopDescription. 58 Data protection and security safeguards for the PEN online system could be based in international texts such as the International Standards on the Protection of Personal Data and Privacy ("the Madrid resolution") adopted by International Conference of Data Protection and Privacy Commissioners on 5 November 2009 (available on http://www.privacyconference2009.org/dpas_space/space_reserved/documentos_adoptados/common/2009_Mad rid/estandares_resolucion_madrid_en.pdf), the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (23.09.1980, available on http://www.oecd.org/internet/interneteconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofper sonaldata.htm); the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No:108; Strasbourg, 28.01.1981, available on http://conventions.coe.int/Treaty/en/Treaties/Html/108.htm). 59 See Article 1(9) of the intra-EU trade Proposal. 60 In accordance with Article 13(1) and 13(2) of the intra-EU trade regulation, Article 29 of the implementing regulation and 12(12) of the UN Convention. 61 Pursuant to Articles 3(2) and 3(6) of the intra-EU trade regulation. 62 In accordance with Articles

text: and

text: the intra-EU trade regulation and Articles 17 and 19 of the external trade regulation.

text: See

text: Article 21 of Regulation (EU) No 1024/2012 of 25 October 2012

text: on administrative cooperation through the Internal Market Information System and repealing

text: Commission Decision 2008/49/EC

text: (‘the IMI Regulation’), OJ L 316, 14.11.2012, p 1.

text: Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with these purposes (See

text: Article 6(1)

text: (b) of Directive

text: ). 65 See

text: Article 1(6)

text: , second paragraph, of the intra-EU trade proposal and

text: Article 1(5)

text: (b) of the external trade proposal.

identifier: EDPS yttrande (2013)

amnesord:
Rights of the Individual
International Agreements
Transfers of data
Police Cooperation

publisher: Europeiska datatillsynsmannen

sprak: en

title: Drug precursors

serie: yttranden

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

type: stycke

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: I. INTRODUCTION

text: I.1. Context of the Proposals

text:  On 27 September 2012 the Commission adopted the Proposal for a Regulation amending

text: Regulation (EC) No 273/2004

text: on drug precursors and the Proposal for a Regulation amending

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors (hereinafter: “the Proposals”). The EDPS was consulted on the same day.

text:  The Proposals amend

text: Regulation (EC) No 273/2004

text: and Regulation (EC) No 4 111/2005 (hereinafter: "the Regulations"), which implement the 1988 UN

text:  The UN Convention and the Regulations aim at recognising and protecting legal trade of drug precursors while, at the same time, discouraging their diversion for illicit purposes. Currently,

text: Regulation (EC) No 273/2004

text: governs the monitoring of intra- EU trade, while the control of external trade is governed by Regulation (EC) No 8 111/2005. Both are implemented by

text: Commission Regulation (EC) No 1277/2005

text:  Measures to control intra-EU trade imply the processing of data of operators since they include the obligation for certain industry operators to appoint a responsible officer and notify his contact details to the competent authorities, obtain a licence or registration, ask customers to declare the uses of the drug precursors provided to them and immediately notify the competent authorities in case they suspect an order or transaction might be aimed at diverting drug precursors for illicit purposes.

text:  As regards the control of external trade, the processing of data of operators is also necessary, as operators are obliged, for example, to apply to competent authorities for authorisation before importing or exporting drug precursors. Obligations for EU competent authorities include notifying certain third countries before an export of drug precursors takes place, and communicating to the Commission the result of their monitoring measures.

text:  Following criticisms by the UN International Narcotics Control Board (hereinafter: "the UN INCB") and by the 2010 Commission report on specific weaknesses of the current measures, the new Proposals include, among others, the following amendments to the Regulations:  the creation of a European Database on Drug Precursors ("hereinafter: the European Database);  the reinforcement of the harmonised registration provisions;  the extension of the registration requirement to users of acetic anhydride .

text: I.2. Aim of the Opinion

text:  Most of the measures required, such as the obligation for operators to report suspect transactions or the cooperation with third countries, imply the processing of data relating to operators which are usually companies and/or legal persons. However, in many cases natural persons will be also identifiable. The aim of the present Opinion is to analyse the impact of these control measures in the protection of privacy and personal data of such persons. As many of these measures are already currently laid down by the Regulations, the Opinion will not only refer to the new texts but also to parts of the current Regulations that are not being amended by the Proposals.

text:  Therefore, the present Opinion will address the following legislative texts:  Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EC) No 273/2004

text: on drug precursors (hereinafter: "the intra-EU trade proposal"); 

text: Regulation (EC) No 273/2004

text: on drug precursors (hereinafter: "the intra-EU trade regulation");  Proposal for a Regulation of the European Parliament and of the Council amending

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors (hereinafter: "the external trade proposal"); 

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors (hereinafter: "the external trade regulation"); 

text: Commission Regulation (EC) No 1277/2005

text: (hereinafter "the implementing regulation"), which will be progressively replaced by the implementing and delegated acts to be adopted pursuant to the Proposals. Where needed, the Opinion will also refer to the UN Convention on which the Regulations are based.

text: II. ANALYSIS OF THE PROPOSALS

text: II.1. General remarks

text:  The EDPS welcomes the general references to the applicability of EU data protection legislation, the fact that most of the categories of data to be processed are defined and the inclusion, in one of the Proposals, of the principle of purpose limitation .

text:  However, the EDPS is concerned about the processing of data relating to suspicious offences, the international transfers of personal data, the inadequate definition of the categories of data in some cases and the lack of specific data protection provisions in the Proposals.

text: 2. Specific remarks

text: II.2.1. References to the applicability of EU data protection laws are welcomed

text:  The Regulations require the processing of data of EU industry operators, importers and exporters, users, customers, persons involved in intermediary activities and ultimate consignees of drug precursors, which can be natural or legal persons . The processing of data relating to legal persons is in principle not covered by EU data protection legislation. However, these data might also identify natural persons, for example, if the official name of the legal person includes the name of a natural person . In these cases, the data protection legislation also applies.

text:  Examining whether the name of every legal person identifies natural persons could cause an unreasonable administrative burden to competent authorities . Therefore, the EDPS recommends applying the same data protection rules to data relating to natural and legal persons. In any event, the data protection rules should apply at least where natural persons are identifiable .

text:  Taking into account that not only Member States but also the Commission will process personal data, both Directive

text: and

text: Regulation (EC) 45/2001

text: are applicable. The EDPS therefore welcomes the new

text: Article 33

text: inserted in the external trade regulation and the new

text: Article 13

text: (b) inserted in the intra-EU trade regulation. Both articles specify that the processing of personal data by the competent authorities in the Member States will be subject to Directive

text: while the processing of personal data by the Commission, including for the purpose of the European Database, will be subject to

text: Regulation (EC) No 45/2001

text: . The EDPS recommends further specifying that "the processing of personal data by the competent authorities in the Member States shall be carried out in accordance with national legislation implementing Directive

text:  Recitals 11 of both Proposals also recognise that the data processed may include personal data, which should be processed in accordance with EU law. The EDPS also welcomes these references.

text: II.2.2 All the categories of data to be processed should be specified

text:  The EDPS welcomes the fact that most of the categories of personal data to be processed by operators and competent authorities are specified. As a general rule the EDPS recommends laying down in the main legislative texts the essential elements of the processing operations. Therefore, the categories of data to be processed should preferably be laid down in the Proposals. However, in case this is not possible, he recommends at least specifying in the Proposals that the processing of sensitive data is excluded and subsequently detail the categories of data to be processed by delegated

text: acts. Below the EDPS gives a description of the categories of personal data to be processed and, where relevant, recommendations on how to better specify them.

text: a) Details of appointed officers

text:  According to the intra-EU trade regulation and the implementing regulation, operators have to appoint an officer for trade in drug precursors and notify competent authorities of the name and contact details of that officer . The EDPS welcomes the specification of the categories of data to be processed for this purpose.

text: b) Licensing and registration of operators

text:  The intra-EU trade regulation, the intra-EU trade proposal and the external trade regulation require certain operators and users to obtain a licence . The implementing regulation further specifies that licence applications shall include the full name and address of the applicant; the full name of the responsible officer; a description of the position and tasks of the responsible officer; the full addresses of the business premises; and a certificate of good conduct of the applicant and the responsible officer or a document showing that they offer the necessary guarantee for the proper conduct of the operations, as appropriate . The EDPS welcomes the specification of this information in the implementing regulation but recommends, if possible, specifying in the Proposals themselves the categories of personal data to be processed.

text:  Operators and users of certain substances are only required to register . The EDPS understands that this process is simpler than obtaining a licence. However, he recommends specifying the data to be provided to competent authorities for this purpose preferably in the text of the Proposal or at least by delegated acts.

text:  When considering whether to grant a licence or a registration, competent authorities shall in particular take into account "the competence and integrity of the applicant" . Registrations and licenses can also be refused, suspended or revoked if there are reasonable grounds "for doubting the suitability and reliability” of the applicant or of the responsible officer, "for believing that the holder is no longer a suitable and fit person" or "for suspecting that the scheduled substances are intended for the illicit manufacture of narcotic drugs (...)" .

text:  It is not clear on the basis of which information competent authorities will evaluate "the competence and integrity" of the applicant to decide whether to grant him a licence. The same comment is valid for the evaluation of the reasonable grounds "for doubting of the suitability and reliability of the applicant or of the responsible officer",

text: "for believing that the holder is no longer a fit and proper person" or for suspecting that there might be a diversion. According to the EDPS, the categories of personal data to be processed for these purposes should also be laid down in the Proposals or in delegated acts. In addition, the processing of sensitive data should be explicitly excluded .

text: c) Customer declarations

text:  Customers have to provide operators with a declaration showing the specific use or uses of scheduled substances . The declaration, as specified in Annex III of the intra- EU trade regulation, should include the name and address of the customer, the name and position of the person signing on behalf of the customer and the purposes for which the drug precursors will be used . The EDPS welcomes the specification of the categories of personal data to be provided.

text: d) Demonstration of the licit purpose of the transaction

text:  Operators may be required to demonstrate the licit purposes of drug precursors entering the EU territory . The information to be provided to competent authorities for this purpose is currently listed in Annex III of the implementing regulation and includes the name, and contact details of the operator, as well as information on the substances to be imported and a signed declaration that these have been exported in accordance with the UN Convention. It may also include a copy of the export authorisation or of the licence or registration. The EDPS welcomes the specification of the categories of personal data to be provided but recommends trying to insert the specifications in the Proposals themselves.

text: e) Documentation

text:  The Regulations also require operators to document all imports, exports and intermediary activities by way of customs and commercial documents. These documents should include the names and addresses of the supplier or the exporter, the distributor or the importer, the consignee and, where applicable, of the person 28 involved in intermediary activities or of other operators directly involved . The intra- EU trade regulation also requires including the customer declaration referred to above in the documentation . As regards mixtures of certain scheduled substances, the requirements and conditions for the documentation may be specified by delegated acts . The EDPS recommends specifying in the Proposals all the categories of personal data to be included in the documentation.

text: f) Summaries of transactions

text:  Operators have to provide competent authorities with a summary of their export, import or intermediary activities. According to Article 17 of the implementing regulation, the summaries required by the intra-EU trade regulation currently contain “the quantities of scheduled substances used or supplied and, in the case of supply, of the quantity supplied to each third party”. Article 18 of the implementing regulation also requires operators to inform competent authorities of their exports, imports and intermediary activities. This information should be organised by third countries, quantities exported and the export authorisations' reference numbers.

text:  The summaries may therefore contain personal data, as the information will be related to operators and third parties. If this is the case, the categories of personal data to be processed should be specified, preferably in the Proposals, or at least by delegated acts (see also section II.2.8(b)).

text: g) Pre-export notifications, export authorisations and import authorisations

text:  Exports of certain drug precursors to specific countries of destination shall be preceded by a pre-export notification sent from EU competent authorities to the competent authorities of the country of destination . The UN Convention requires including in the notification the name and addresses of the exporter, the importer and, when available, the consignee, as well as “any other information". Article 21(2) of the implementing regulation states that the information to be supplied (only for simplified pre-export notifications) is specified in Article 13(1) of the external trade regulation, which requires at least, among other information, the names and addresses of the exporter, the importer in the third country, any other operator involved in the export operation or shipment, and the ultimate consignee. The EDPS welcomes these lists but recommends specifying what other categories of personal data might be processed for this purpose and to avoid an open-ended description of categories.

text:  Exporters and EU importers may have to apply for export or import authorisations to the competent authorities of the country where they are established. These applications shall also include at least the names and addresses of the exporter, the importer country, any other operator involved and the ultimate consignee . The complete lists of required information are specified in the forms included in the Annexes of the implementing regulation . The EDPS welcomes this specification but would recommend specifying the categories of personal data to be processed in the Proposals themselves.

text:  Competent authorities can refuse the granting of export and import authorisations if “there are reasonable grounds for suspecting that the details provided (…) are false or incorrect” or “for suspecting that the substances in question are intended for the illicit manufacture of narcotic drugs or psychotropic substances” . The Proposals should

text: specify the categories of personal data to be processed for this purpose or at least explicitly exclude the processing of sensitive data and subsequently specify the categories of personal to be processed by delegated acts.

text: h) Reporting of seizures and stopped shipments

text:  Article 32 (1) of the external trade regulation and Article 29 of the implementing regulation require Member States to communicate to the Commission all information on the implementation of the measures required by this regulation to monitor trade in drug precursors. This information includes in particular the type of substances and methods frequently used for illicit manufacture and diversion of narcotic drugs and psychotropic substances. The implementing regulation further specifies that Member States shall submit a list of the cases where the release of scheduled substances was suspended or the scheduled substances were detained. The list shall include the name of the scheduled substances, the quantity of the scheduled substances, their customs status and means of transport used and, if known, their origin, provenance and destination.

text:  Subsequently, the Commission shall communicate this information to all Member States and submit a summary to the UN International Narcotic Board, in accordance with the UN Convention. The information required includes the amounts seized of certain substances and their origin, as well as the methods used for illicit manufacture and diversion. According to the Proposals, these exchanges of information will be done through the European Database.

text:  The EDPS understands that the processing of personal data is not needed for this purpose. Therefore, he recommends specifying in the text of the Proposals that the reporting of seizures and stopped shipments by Member States to the Commission and by the Commission to Member States and the UN INCB will only include aggregated and anonymised data.

text: II.2.3 Personal data on suspect offences should be subject to specific safeguards

text:  The Regulations require EU operators to immediately report suspect transactions to competent authorities . Personal data contained in these reports on suspect transactions can thus be related to offences.

text:  According to

text: Article 8 of Directive 95/46/EC

text: , the processing of data relating to offences is restricted and subject to special protection. It should only be carried out under the control of an official authority or if suitable specific safeguards are provided by law.

text:  The data will not only be processed under the control of official authorities, as it will be initially controlled by operators. Therefore, the Proposals should require specific safeguards. In this regard, the EDPS welcomes the fact that the external trade proposal states that the data on suspicious transactions will only be used for the purpose of

text:  The EDPS also recommends specifying in the Proposals that operators have to delete data on suspicious transactions as soon as the suspicion is cleared by competent authorities, unless they need them for specific reasons, e.g. to demonstrate the correct fulfilment of their obligations. In addition, the Proposals should specify that operators should not disclose personal data to recipients other than the competent authorities. Operators should also, in accordance with national data protection laws, implement additional safeguards for the processing of these data.

text: II.2.4. The processing of sensitive data should be excluded

text:  The EDPS welcomes the minimum list of categories of data that operators shall provide to competent authorities for the reporting of suspect transactions, which is included in the external trade proposal . The EDPS recommends adding a similar provision to the intra-EU trade proposal. However, as the list is not exhaustive, the EDPS is concerned about the possibility of discriminatory practices by operators or competent authorities in determining suspect transactions, such as profiling according to ethnic origin or other categories of sensitive data.

text:  The EDPS reminds that the processing of sensitive data (i.e., personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, tradeunion membership, or concerning health or sex life) is in principle prohibited by EU data protection law . In the present situation the processing could only be allowed in case of substantial public interest if it is laid down by a law (or by decision of supervisory authorities) providing suitable safeguards. As sensitive data are not included in the list of minimum data to be reported, their processing does not seem necessary for a substantial public interest and should thus be excluded.

text:  The EDPS recommends listing all the categories of data to be processed for this purpose in the Proposals. In case it is not possible to establish an exhaustive list, it should at least be specified in the Proposals that the data reported by operators or processed by competent authorities for this purpose should not include special categories of data as defined by

text: Article 8(1) of Directive 95/46/EC

text: . The complete list of categories of personal data to be processed should be at least laid down by delegated acts.

text:  Article 10 of the external trade regulation and Article 1(7) of the intra-EU trade proposal foresee the adoption of guidelines explaining "how to identify and notify suspect transactions". These guidelines should also explain that the processing of sensitive data is excluded.

text: II.2.5. Retention periods should be specified

text:  The EDPS notes that the Regulations specify minimum retention periods for certain operations . He understands that these are the periods during which the retention is necessary. Personal data should thus not be retained after these periods, unless this is justified .

text:  Taking into account that competent authorities and operators have been implementing the Regulations for years with retention periods established at national level, the EDPS acknowledges that in some cases it might be difficult to completely harmonise these periods at EU level. However, the EDPS recommends laying down in the Proposals at least maximum retention periods for each processing operation. Moreover, the necessity of every specific retention period should be justified in the Preambles of the Regulations.

text:  The EDPS also questions the necessity of keeping the documentation for three years , since the UN Convention on which this obligation is based only requires keeping it for two years . He therefore recommends considering reducing the period referred to in Article 4 of the external trade regulation.

text: II.2.6. Data subjects should be informed

text:  In accordance with Directive

text: , competent authorities should inform operators and users, that their personal data will be collected and retained for the purposes of monitoring, licensing and registering trade of drug precursors. This information should include the categories of data that will be processed, including for the European Database, the identity of the controller, the recipients of the data, specifying where they are located in third countries, and information about how to exercise the rights of access and rectification . A new Article could be added to the Proposals in this regard.

text:  In addition, operators and users should be informed that orders relating to them might be reported as suspicious to competent authorities. All this information should be provided at the time of the collection of the data, for example, by means of a privacy notice included in the forms used to collect the data which are contained in the annexes of the Regulations. In addition, it could be made available on the websites of the competent authorities. This should also be specified in the Proposals.

text: II.2.7. International transfers should be subject to adequate data protection safeguards

text:  According to the UN Convention, if a Party has suspicions on a transaction, it should notify the competent authorities of the Parties concerned. The external trade regulation also requires determined categories of exports to be preceded by a preexport notification from the competent authorities in the EU to the competent

text: authorities in the country of destination. According to Article 12(10) of the UN Convention, these notifications should include the name and address of the exporter and importer and, when available, the consignee, as well as any other information which is mutually agreed by the parties.

text:  In addition, the external trade regulation requires certain exporters and importers to apply for export or import authorisations to the competent authorities of the country where they are established. If competent authorities consider that “there are reasonable grounds for suspecting that the details provided (…) are false or incorrect” or “for suspecting that the substances in question are intended for the illicit manufacture of narcotic drugs or psychotropic substances” , they can refuse the granting of export or import authorisations. Especially in the case of import authorisations, this might entail communicating data on a suspicious EU operator to third countries' competent authorities.

text:  Therefore, the implementation of the UN Convention and the external trade regulation involves transfers of personal data from the EU to third countries. In principle Directive

text: only allows transfers of personal data to third countries which do ensure an adequate level of protection . But most of the countries concerned are not considered to offer an adequate level of protection for personal data .

text:  Although under Directive

text: some exceptions apply, for example if the transfer is necessary or legally required on important public interest grounds , these exceptions cannot be the legal basis for repeated and structured transfers as the ones foreseen in the external trade regulation .

text:  However, in the present case, the transfers could take place in accordance with EU data protection law if it is ensured that adequate safeguards are in place . These safeguards could be based on the data protection principles contained in the Standard Contractual Clauses for the transfers of personal data to third countries adopted by the Commission . They should include the possibility for data subjects to seek administrative and judicial redress, as well as an independent oversight mechanism to ensure compliance with the safeguards.

text:  These adequate safeguards should be mentioned in the text of the external trade regulation and should also be included in binding agreements to be negotiated between the EU and the competent authorities of the relevant third countries. Alternatively and on longer term, whenever the UN Convention is renegotiated, the EU could propose adequate data protection safeguards to be included in a binding UN instrument.

text:  The EDPS understands that since 2006 most of these data have been exchanged via the Pre-Export Notification (PEN) Online System, developed and managed by the UN Office on Drugs and Crime (UNODC) and the UN INCB, and that neither the European Commission nor EU Member States have the capacity to impose data protection safeguards in the system.

text:  According to the UNODC, the PEN Online System "enables easy on-line exchange of information between Member States on shipments (export and import) of [drug precursors]. (...) The system facilitates full electronic reply to acknowledge receipt and notify the exporting country of clearance to export. An electronic copy is sent to UN 56 INCB by default. (...)" . Rights of access to the system can only be granted to government officials after approval by the relevant Member State's Mission Representative to the UN office in Vienna .

text:  The EDPS welcomes these specifications. However, additional data protection and security safeguards should be laid down, at least for personal data relating to EU operators, such as maximum retention periods for data stored in the system, the granting of access and correction rights to data subjects and the possibility to obtain 58 redress in case of misuse .

text: II.2.8. The European Database on drug precursors

text:  The European Database to be created by the intra-EU trade proposal aims at facilitating the reporting of seizures and stopped shipments ; creating a European register of operators and users holding a licence or a registration ; and enabling operators to provide competent authorities with information about their transactions .

text: The two last functions will be analysed below, as they will entail the processing of personal data.

text: II.2.8.1. General comments

text:  As regards the principle of purpose limitation, the EDPS would like to remind that the interconnection and exchange or correlation of data with other databases managed by the Commission or by other entities for different purposes would in principle not be allowed.

text:  As regards the supervision of the processing operations carried out through the European Database, the EDPS welcomes Article 1(16) of the intra-EU trade proposal and Article 1(10) of the external trade proposal which state that the processing of personal data by the competent authorities in the Member States will be supervised by national Data Protection Authorities; while the processing of personal data by the Commission, including for the purpose of the European Database, will be supervised by the EDPS.

text:  In addition, as regards the European Database, the EDPS recommends including a provision in the Proposal providing for coordinated supervision between the EDPS and national Data Protection Authorities. The Proposals could specify that national Data Protection Authorities and the EDPS, each acting within the scope of their competences, 'shall cooperate actively' and 'shall ensure coordinated supervision of the European Database'. The system of coordinated supervision could be similar to the one laid down with regards to the Internal Market Information System (IMI) .

text: II.2.8.1. Specific recommendations

text: a) European register of operators

text: Article 1(2)

text: (f) of the intra-EU trade proposal and Article 1(15) of the external trade proposal require competent authorities to enter operators which have obtained a licence or a registration in accordance with the intra-EU regulation in the European Database. Access by operators to the European Database is not allowed by the Proposals. However, the legislative financial statement of the intra-EU trade Proposals seems to suggest that it could be granted in the future. In case access by operators is envisaged, this should be clarified in the substantive part of the Proposals.

text: Article 1(11)

text: empowers the Commission to adopt delegated acts concerning the requirements and conditions for listing registered or licensed operators and users. According to the EDPS, this Article should also specify (or, if not possible, at least empower the Commission to lay down rules specifying) the following:  the rights of access to personal data contained in the European Database and how they will be controlled;  the procedures to grant operators and users the rights of access, rectification and, where appropriate, objection and blocking; how operators and users will be

text:  If the data on operators and responsible officers are to be cross-checked with other databases, this should be clarified in the Proposals. In any case, and in order to respect the principle of purpose limitation , it should be specified that only databases created for the same purpose (preventing illegal trade in drug precursors) should be used. In addition, checking against other databases should not be done in a systematic way, but only on a case by case basis where necessary.

text: b) Summaries of transactions

text:  Article 1(9) of the intra-EU trade proposal states that one of the purposes of the European Database is enabling operators to provide competent authorities with information about their transactions. The Commission is empowered to adopt delegated acts to determine how to provide this information in electronic form to the European Database .

text:  The EDPS welcomes Article 19 of the implementing regulation which states that this information has to be treated as confidential. However, in case it includes personal data, the following safeguards should also be specified, preferably in the Proposals or at least by delegated acts:

text:  the categories of personal data that will be processed in the Database;  the purposes for which these data can be used;  which entities will have access to personal data contained in the European Database and how access rights will be controlled;  the procedures to grant operators the rights of access, rectification and, where appropriate, objection and blocking;  how operators will be informed about the processing of their data in the European Database and about their rights;  the maximum retention period for personal data contained in the database, which should be limited to the minimum necessary to fulfil its purposes;  a procedure to delete or update data where necessary, e.g., when an operator ceases its activities;  the role of the Commission, e.g., as responsible for controlling and managing the database and for ensuring its security.

text:  Article 1(11) of the intra-EU trade proposal empowers the Commission to adopt implementing acts on how to provide customer declarations in electronic form, but does not provide for their processing through the European Database. The EDPS recommends clarifying this. If the European Database is to be used for purposes other than those stated in Article 1(9) of the intra-EU trade proposal, such as for the processing of customer declarations, this should be specified in the Proposals.

text: III. CONCLUSIONS

text:  The EDPS welcomes the general references to the applicability of EU data protection legislation, the fact that many of the categories of data to be processed are specified and the fact that the principle of purpose limitation is mentioned in the external trade proposal.

text:  However, he recommends laying down in the main legislative texts the essential elements of the processing operations such as the exclusion of the processing of sensitive data. All the categories of data to be processed should also be specified preferably in the Proposals, and at least by delegated acts.

text:  He also recommends:

text:  adding to the intra-EU trade proposal that personal data on suspicious transactions may only be used for the purpose of preventing the diversion of scheduled substances;  laying down maximum retention periods in the Proposals for all processing operations and specifying in the Proposals that data on suspicious transactions has to be deleted as soon as they are not necessary any more;  justifying in the Preambles of the Regulations the necessity of every specific retention period;  adding a new Article to the Proposals on how information on the processing operations should be provided to data subjects;  as regards international transfers of personal data, including data protection safeguards in the text of the external trade regulation and in an international binding text or in binding agreements with the recipient third countries;  as regards the European Database, if operators need to have access to it or it is to be used for additional purposes, this should be specified in the substantive part of the Proposals;  ensuring the supervision of the European database by a system of coordinated supervision between the EDPS and national Data Protection Authorities, similar to what is foreseen for the Internal Market Information System;  as regards the register of European operators and the processing of summaries of transactions through the European database, specific data protection and security safeguards should be added, preferably to the Proposals and at least by delegated or implementing acts;  if the European Database is to be used for purposes other than those stated in Article 1(9) of the intra-EU trade proposal (e.g., for the processing of customs declarations), this should be specified in the substantive part of the Proposals.

text:  As regards the principle of purpose limitation, the EDPS would like to remind that the interconnection and exchange or correlation of data of the European database with other databases managed by the Commission or by other entities for different purposes should in principle not be allowed.

text: Done in Brussels, 18 January 2013

text: (signed)

text: Giovanni Buttarelli Assistant European Data Protection Supervisor


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2012) 542 final. 4 COM (2012) 541 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Medical devices include products such as sticking plasters, contact lenses, dental filling materials, xray machines, pacemakers, breast implants or hip replacements. 6 In vitro diagnostic medical devices include products such as devices used to ensure the safety of blood transfusion (e.g. blood grouping), detect infectious diseases (e.g. HIV), monitor diseases (e.g. diabetes) and perform blood chemistry (e.g. cholesterol measurement). 7 Established by

text: Commission Decision 2010/227/EU

text: , OJ L 102, 23.4.2010, p. 45. 8 For example regarding the market surveillance plan, where manufacturers are required to institute and keep up to date a systematic procedure to collect and review experience gained from devices placed on the market. This would entail the collection, recording and investigation of complaints and reports from healthcare professionals, patients or users on suspected incidents related to devices. 9 See for example Articles

text: and Recitals 38, 48 and 63 in the proposed MD Regulation, and see for example Articles

text: and

text: and Recitals 31, 44, and 59 in the proposed IVD Regulation.

text: The proposed Regulations contain provisions allowing or requiring national authorities to exchange information between them and the Commission. In particular, the Articles concerning the Eudamed database and the information to be included in this database. 11 Called clinical investigations under the proposed MD Regulation, defined in

text: Article 2(33)

text: as ‘any systematic investigation in one or more human subjects, undertaken to assess the safety or performance of a device´ and called clinical performance studies under the proposed IVD Regulation, defined in

text: Article 2(33)

text: as `a study undertaken to establish or confirm the clinical performance of a device´.

text: See ECHR 17 July 2008, I v Finland (appl. No 20511/03), paragraph 38 and ECHR 25 November 2008, Armonas v Lithuania (appl. No 36919/02), paragraph 40. 13 The electronic system on interventional clinical performance studies and clinical performance studies involving risks for the subjects for IVDs.

text: See below Section 2.6 on Record keeping.

text: For MDs. 16 For IVDs. 17 EDPS Opinion of 19 December 2012, http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/ 2012/12-12-19_Clinical_Trials_EN.pdf. 18 Also the protection of commercially sensitive information and the effective supervision of the conduct of the study by the Member States are mentioned as grounds to justify confidentiality. 19 Article 2(15) of the proposed Clinical Trials Regulation, COM 2012 (369) final.

text: EDPS Opinion of 22 April 2009, http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2009/09- 04-22_pharmacovigilance_EN.pdf. 21 EDPS Opinion of 7 September 2009, http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Supervision/Priorchecks/Opinions/ 2009/09-09-07_EMEA_EudraVigilance_EN.pdf. 22 Commission Implementing Regulation on the performance of pharmacovigilance activities,

text: (EU) No 520/2012

text: of 19 June 2012.

text: See above Section 2.3.

title: In vitro diagnostic medical devices

text: Opinion of the European Data Protection Supervisor

text: on the Commission proposals for a Regulation on medical devices, and amending Directive

text: Regulation (EC) No 178/2002

text: and

text: Regulation (EC) No 1223/2009

text: and a Regulation on in vitro diagnostic medical devices

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 26 September 2012, the Commission adopted two proposals for Regulations on medical devices (‘the proposed MD Regulation’) , and a Regulation on in vitro diagnostic medical devices (‘the proposed IVD Regulation’) . These proposals were sent to the EDPS for consultation on 2 October 2012.

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and recommends that a reference to the consultation be included in the preambles of the proposed Regulations. 1.2. Objectives and scope of the proposed Regulation

text: 3. The proposed Regulations aim at ensuring the safety of medical devices (‘MDs’) and in vitro diagnostic medical devices (‘IVDs’) and their free circulation within the internal market. They amend and clarify the scope of the existing legislation, to take into account scientific and technological progress. The proposed Regulations contain legal frameworks to utilize an existing electronic database (Eudamed database) at EU level to facilitate coordination between authorities to ensure rapid and consistent responses to safety issues, to increase devices traceability throughout the supply chain and to clarify the obligations and responsibilities of manufacturers, importers and distributors. They furthermore strengthen the different levels of supervision by clarifying and enhancing the position and powers of public authorities vis-à-vis economic actors. 1.3. Aim of the EDPS Opinion

text: 4. The proposed Regulations will affect the rights of individuals related to the processing of their personal data. Amongst other issues, they deal with the processing of sensitive data (health data), a central EU-level database which 8 includes personal data, market surveillance and record keeping.

text: 5. The EDPS welcomes that the Commission has made an effort to guarantee the correct application of EU rules concerning the protection of personal data in the proposed Regulations. However, the EDPS sees a need for some clarifications with particular regards to sensitive data, especially when this category of personal data comes to the processing and storage in the database suggested by the proposed Regulations. Indeed the EDPS has identified certain ambiguities and inconsistencies in the way the proposed Regulations deal with the issue of whether and what categories of personal data will be processed, in particular where sensitive data regarding health might be processed and stored.

text: 2. ANALYSIS OF THE PROPOSAL 2.1. Applicability of data protection legislation

text: 6. Several Recitals and provisions of the proposed Regulations mention Articles 7 and 8 of the Charter of Fundamental Rights, Directive

text: and

text: Regulation (EC) No 45/2001

text: 7. In particular, Article 85 of the proposed MD Regulation and Article 81 of the proposed IVD Regulation state that Member States shall apply Directive

text: to the processing of personal data pursuant to the proposed Regulations and that

text: Regulation (EC) No 45/2001

text: shall apply to the processing of personal data carried out by the Commission pursuant to the proposed Regulations.

text: 8. The EDPS welcomes these provisions and only recommends that both Articles clarify the reference to Directive

text: by specifying that the provisions will apply in accordance with the national rules which implement Directive

text: 9. The references to data protection law are relevant, for example, in relation to the various provisions concerning exchanges of personal data between national authorities and the Commission (to and from the Eudamed database). These provisions need to be applied in a way which is consistent with data protection legislation, in particular by allowing a selective and proportionate exchange of personal information, where necessary, on a basis of more precise provisions which cannot be construed as a blanket authorisation to exchange all kind of personal data . 2.2. Processing of personal data concerning health

text: 10. Clinical investigations and reporting of incidents involving MDs and IVDs (vigilance) activities as well as market surveillance activities regarding MDs and IVDs are by nature dependent on the processing and storage of data at different levels (local, national and European). Personal data of identified or identifiable patients participating in clinical investigations and vigilance can be considered as data relating to health (‘health data’) of the persons concerned since they reveal information about medical procedures and associated health problems.

text: 11. Processing of such data is subject to strict data protection rules as laid down in

text: Article 8 of Directive 95/46/EC

text: (and its implementing national laws) and

text: Article 10 of Regulation (EC) No 45/2001

text: . Among the grounds which allow for processing of personal data relating to health,

text: Article 8(3) of Directive 95/46/EC

text: and

text: Article 10(3) of Regulation (EC) No 45/2001

text: are applicable in this case. These provisions lift the prohibition of processing health related data if the processing is ‘required for the purpose of preventive medicine [...]’. The EDPS wishes to underline that this sets a high standard.

text: 12. The importance of protecting such data has repeatedly been emphasised by the European Court of Human Rights in the context of Article 8 of the European Convention of Human Rights. The Court has stated: ‘The protection of personal data, in particular medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention’ .

text: 13. The EDPS therefore recommends inserting in Article 85 of the proposed MD Regulation and in Article 81 of the proposed IVD Regulation explicit reference to

text: Article 8 of Directive 95/46/EC

text: and

text: . 2.3. The Eudamed database

text: 14. The Eudamed database is regulated in Article 27 of the proposed MD Regulation and Article 25 of the proposed IVD Regulation.

text: 15. The purposes of the Eudamed database are listed in Article 27 of the proposed MD Regulation as: (a) to enable the public to be adequately informed about devices placed on the market, about the corresponding certificates issued by notified bodies and about the relevant economic operators; (b) to enable traceability of devices within the internal market; (c) to enable the public to be adequately informed about clinical investigations and to enable sponsors of clinical investigations to be conducted in more than one Member State to comply with information obligations; (d) to enable manufacturers to comply with information obligations... [regarding vigilance and market surveillance]; (e) to enable the competent authorities of the Member States and the Commission to carry out their tasks relating to this Regulation on a well informed basis and to enhance the cooperation between them.

text: 16. According to Article 27(2) of the proposed MD Regulation and Article 25 of the proposed IVD Regulation, the Eudamed database shall include the following "modules" as integral parts: (a) the electronic system on Unique Device Identification; (b) the electronic system on registration of devices and economic operators; (c) the electronic system on information on certificates; (d) the electronic system on clinical investigations ; (e) the electronic system on vigilance; (f) the electronic system on market surveillance.

text: 17. As seen above, this central database is intended to serve a multitude of purposes and contains several integrated parts. The EDPS welcomes the attention given to the protection of personal data in the wording of these Articles, especially Article 27(5) of the proposed MD Regulation, which states that the Eudamed database shall contain personal data only insofar as it is necessary to process information in accordance with the proposed Regulations.

text: Article 27(5)

text: also clarifies -through reference to

text: Article 8(4)

text: - the retention period . The EDPS welcomes that the right of access for data subjects and the rights to correction and deletion of their personal data are addressed in the proposed MD Regulation in

text: Article 27(6)

text: . He also welcomes that the last sentence of

text: Article 27(6)

text: states that corrections and deletions shall be carried out as soon as possible, but no later than within 60 days. However, the right of the data subject to block his or her personal data has not been addressed and should be included.

text: 18. The EDPS notes, however, that Article 25 of the proposed IVD Regulation simply makes reference to the proposed MD Regulation regarding the conditions and modalities of the database, such as purposes, data subject rights and data retention periods. In the view of the EDPS, the inclusion of these elements of the database also in the proposed IVD Regulation would increase the clarity of the legal instrument in a very beneficial way.

text: 19. The EDPS therefore recommends inserting similar paragraphs regarding purposes, data subject rights and data retention periods as in Article 27 of the proposed MD Regulation into Article 25 of the proposed IVD Regulation, subject to the modifications suggested in this Opinion.

text: 20. The EDPS recognises that the multiple purposes listed in Article 27 of the proposed MD Regulation are legitimate within the framework of the regulation of MDs and IVDs in the EU and that it is necessary to process certain kinds of personal data to achieve the goals that the proposed Regulations aim for. However, the processing of such data, and in particular of health data, must be strictly limited to the minimum necessary to allow the attainment of such purposes. While it seems necessary that certain health data is processed for the purpose of clinical investigation, vigilance and market surveillance by the health practitioners, local competent authorities and economic operators, in the EDPS view a potential systematic transfer of directly identified personal health data to the centralized Eudamed database seems disproportionate.

text: 21. In this respect, currently only the provisions related to clinical investigations include a reference to the exclusion of patient health data from the centralised database.

text: 22. In the EDPS' view, the exclusion of directly identified patient health data from the database should be introduced as a rule for the Eudamed database. The EDPS therefore recommends that the explicit exclusion of directly identified personal data of patients from the Eudamed database be incorporated in Article 27 of the proposed MD Regulation and Article 25 of the proposed IVD Regulation.

text: 23. Moreover, the EDPS recommends including, in a Recital of both proposed Regulations, that any implementing measures to be adopted under the proposed Regulations should specify in detail the data protection implications of the functional and technical characteristics of the Eudamed database and the EDPS should be consulted. 2.4. Clinical investigations and clinical performance studies

text: 24. The issue of clinical investigations and clinical performance studies is closely connected to the issue of clinical trials on medicinal products for human use, an issue where the EDPS has recently published an Opinion .

text: 25. Recital 48 of the proposed MD Regulation and Recital 44 of the proposed IVD Regulation state that no personal data of individuals participating in the clinical investigation (patients) will be collected in the "electronic system" (i.e. the Eudamed database). This statement suggests that indeed the clinical investigations module of the Eudamed database should not include patient health data. Nevertheless, Article 52 of the proposed MD Regulation ('Registration of clinical investigations') and Article 50 of the proposed IVD Regulation ('Registration of interventional clinical performance studies [...]') state that information in the electronic system shall be accessible to the public unless confidentiality is justified, inter alia, on grounds of protection of personal data pursuant to

text: Regulation (EC) No 45/2001

text: . This wording suggests that personal data of individuals participating in the clinical investigations may indeed be collected in the electronic system, but would not be made available to the public on grounds of protection of personal data. This inconsistency in the texts must be rectified. The proposed Regulations should unambiguously prevent the inclusion of patients' personal data on health in the Eudamed database as regards clinical investigations and clinical performance studies.

text: 26. Furthermore, according to Article 52(4) of the proposed MD Regulation and Article 50(4) of the proposed IVD Regulation no personal data of 'subjects' (patients) participating in the clinical investigations shall be publicly available. The term 'subject' is not defined in either the proposed MD Regulation or the proposed IVD Regulation, but the EDPS assumes that the definition is meant to be in line with the Commission proposal on clinical trials in medicinal products, i.e. 'an individual who participates in a clinical trial, either as recipient of an investigational medicinal product or as a control'. As the term 'subject' has a very different meaning in the data protection context, it is of utmost importance that the definition of the term is included in both proposed Regulations. 2.5. Vigilance

text: 27. The system of reporting of incidents relating to MDs and IVDs (Vigilance) has been divided into two different sets of provisions in the proposed Regulations. The reporting during the pre-market phase is governed by the provisions regarding clinical investigations and the reporting that occurs after the putting on the market is governed by the provisions regarding vigilance and market surveillance.

text: 28. The issue of vigilance is closely connected to the issue of pharmacovigilance, an issue where the EDPS has commented upon a number of occasions. In 2009, the EDPS published an Opinion on the amendments to

text: Regulation (EU) No 1345/2010

text: and Directive

text: . The EDPS also published an Opinion on a notification for prior checking regarding the EudraVigilance database and provided informal comments to the Commission before the publication of the implementing regulation on the performance of pharmacovigilance activities (the Implementing Regulation) .

text: 29. A general issue the EDPS wishes to raise in this respect is the actual necessity of processing health data about directly identified patients at EU level.

text: 30. It may be necessary to include information identifying patients in the primary reports collected and maintained by the manufacturer or the national competent authority. However, the EDPS does not see the need for this information to be preserved in a central database like the Eudamed database. It would be sufficient to provide for a traceability mechanism (e.g. through pseudonymisation of the data). Personal data concerning health should be submitted to the Eudamed database only in pseudonymised form (i.e. substituting direct identification elements like the name with a code). This would still enable the traceability of the data along the whole system by authorised users, whereas at the same time this would render direct identification in the Eudamed database by external actors impossible. Duplication of reporting can be avoided through the application of well structured data reporting procedures and traceability mechanisms.

text: 31. The EDPS therefore recommends inserting provisions in the proposed MD Regulation and the proposed IVD Regulation that clearly define in which situations and subject to which safeguards information containing patient health data will be processed and stored in the Eudamed database regarding vigilance. In particular, the proposed Regulations should require that a risk assessment be carried out by the Commission before the processing and storage of any patient health data in the Eudamed database.

text: 32. In relation to the periodic reports mentioned in Article 61 of the proposed MD Regulation and in Article 59 of the proposed IVD Regulation, the EDPS recommends that it should be explicitly mentioned that these reports should only be using truly anonymous data. 2.6. Market surveillance

text: 33. The market surveillance provisions envisaged by the proposed MD Regulation and by the proposed IVD Regulation refer to two separate activities: on the one hand, the post-market surveillance plan to be put in place by manufacturers (Article 8(6) of both Proposals) and, on the other hand, the surveillance by competent authorities (

text: Article 65

text: et seqq. of the proposed IVD Regulation and

text: Article 67

text: et seqq. of the proposed MD Regulation).

text: 34. As regards the market surveillance plan, manufacturers are required to institute and keep up to date a systematic procedure to collect and review experience gained from devices placed on the market. This would entail the collection, recording and investigation of complaints and reports from healthcare professionals, patients or users on suspected incidents related to devices. As mentioned above, processing of personal data related to health is in principle prohibited by

text: Article 8(1) of Directive 95/46/EC

text: . In this case, therefore, manufacturers must base their processing of health data of data subjects on one of the grounds for processing mentioned in

text: Article 8(2)

text: as an exception to the prohibition. In the EDPS´ view, the most appropriate ground for processing in case of post market surveillance should be explicit consent (

text: Article 8(2)

text: (a)). Given that the Proposals are directly applicable Regulations, to the text of Article 8(6) of both texts should be modified by adding the following sentence: "Before any processing of data concerning health of patients takes place, manufacturers shall obtain explicit consent from the data subject pursuant to

text: Article 8(2)

text: (a) of Directive

text: 35. As regards the surveillance by competent authorities, the proposed Regulations do not specify if the latter would need to process personal data and/or health data of patients in order to carry out their duties. However, in view of the intense exchange of information between authorities, Member States and the Commission resulting from the system of post market surveillance, a provision regulating how personal data should be managed should be inserted. In this respect, the same observations as those mentioned in paragraphs 30 and 31 apply. 2.7. Record keeping

text: 36. Article 8(4) of the proposed MD Regulation and Article 8(4) of the proposed IVD Regulation concern record keeping. References to these Articles are made in the Articles that concern the different aspects of the systems governing MDs and IVDs. These provisions oblige the manufacturers to archive certain information for at least 5 years after the last device covered by the declaration of conformity has been placed on the market. In case of implantable devices under the proposed MD Regulation, the period shall be at least 15 years after the last device has been placed on the market. Hence, no maximum retention period for personal data is foreseen.

text: 37. According to

text: Article 27(5)

text: personal data in the Eudamed database shall be kept in a form which permits identification of the data subjects for no longer than the periods referred to in

text: Article 8(4)

text: . There is, however, no reference to

text: Article 8(4)

text: in Article 25 of the proposed IVD Regulation . It is therefore unclear which retention period applies to personal data stored in the Eudamed database regarding IVDs. As this is an essential element, a specific paragraph on the retention of personal data should therefore be inserted in Article 25 of the proposed IVD Regulation.

text: Article 4(1)

text: (e) of

text: Regulation (EC) No 45/2001

text: and 6(1)(e) of Directive

text: require that personal data are not kept for longer than is necessary for the purposes for which the data were collected or for which they are further processed. In order to comply with this requirement, the EDPS suggests inserting a maximum retention period for personal data under the proposed Regulations. The chosen period should be necessary and proportionate for the purposes for which personal data are collected and processed. 2.8. Delegated and Implementing acts

text: 39. The proposed Regulations introduce the possibility for the Commission to adopt a large number of delegated and implementing acts. In the EDPS' opinion, the substantial provisions related to the fundamental right to the protection of personal data should be included in the primary legislative acts (namely, the two proposed Regulations). The suggestions made throughout the present Opinion aim at addressing all the issues related to processing of personal data in the text of the proposed MD Regulation and the proposed IVD Regulation. However, the EDPS encourages the Commission to consult the EDPS in relation to any delegated or implementing act adopted pursuant to the proposed Regulations which might have an impact on the processing of personal data.

text: 3. CONCLUSIONS

text: 40. The EDPS welcomes the attention paid specifically to data protection in the proposed Regulations, but identified some scope for further improvement.

text: 41. The EDPS recommends that:  Article 85 of the proposed MD Regulation and Article 81 of the proposed IVD Regulation clarify the reference to Directive

text: .  inserting in Article 85 of the proposed MD Regulation and in Article 81 of the proposed IVD Regulation explicit reference to

text: Article 8 of Directive 95/46/EC

text: and

text: .  inserting similar paragraphs regarding purposes for data processing, data subject rights and data retention periods as in Article 27 of the proposed MD Regulation into Article 25 of the proposed IVD Regulation, subject to the modifications suggested in this Opinion.  including a definition of the term 'subject' in the proposed Regulations.  unambiguously preventing the inclusion of all patients´ health data in the clinical investigations module of the Eudamed database.  inserting provisions in the proposed MD Regulation and the proposed IVD Regulation that clearly define in which situations and subject to which safeguards information containing patient health data will be processed and stored in the Eudamed database concerning vigilance and post market surveillance. In particular, the proposed Regulation should require that a risk assessment be carried out by the Commission before the processing and storage of any patient health data in the Eudamed database.  including, in a Recital of both proposed Regulations, that any implementing measures to be adopted under the proposed Regulations should specify in detail the data protection implications of the functional and technical characteristics of the Eudamed database and the EDPS should be consulted.  explicitly mentioning that periodic reports in Article 61 of the proposed MD Regulation and Article 59 of the proposed IVD Regulation should only be using anonymous data.  adding the following sentence to Article 8(6) of both proposed Regulations: "Before any processing of data concerning health of patients takes place, manufacturers shall obtain explicit consent from the data subject pursuant to

text: Article 8(2)

text: (a) of Directive

text: ".  inserting provisions regulating how personal data should be managed as regards the surveillance by competent authorities in the proposed Regulations.  inserting a maximum retention period for personal data under the proposed Regulations. The chosen period should be necessary and proportionate for the purposes for which personal data are collected and processed.  consulting the EDPS in relation to any delegated or implementing act adopted pursuant to the proposed Regulations which might have an impact on the processing of personal data. Done in Brussels, 8 February 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor

type: vagledning

utgivare: edps