text: OJ L281, 23.11.1995, p. 31. 2 OJ L8, 12.1.2001, p. 1. 3 COM(2013) 75 final.

text: Proposal for a Regulation of the European Parliament and of the Council on consumer product safety and repealing

text: Council Directive 87/357/EEC

text: and Directive

text: (COM(2013) 78 final). 5

text: Regulation (EC) No 765/2008

text: of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing

text: Regulation (EEC) No 339/93

text: , OJ L 218, 13.8.2008, p. 30. 6 http://ec.europa.eu/consumers/safety/rapex/index_en.htm. 7 https://www.icsms.org/icsms/App/index.jsp.

text: Article 2

text: (a) of Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.95, p. 31. 9 OJ L 281, 23.11.95, p. 31. 10 OJ L 8, 12.1.2001, p. 1.

text: Commission Decision of 16 December 2009 laying down guidelines for the management of the Community Rapid Information System ‘RAPEX’ established under

text: Article 12

text: and of the notification procedure established under

text: Article 11 of Directive 2001/95/EC

text: (the General Product Safety Directive) (notified under document C(2009) 9843), OJ L 22, 26.1.2010, p. 1. 12 For the latter, see judgment of the CJEU in Schecke (

text: and

text: ), [2010] ECR I-11063, paras. 52-53. 13 See e.g. Articles

text: and

text: of Directive 95/46/EC.

text: See RAPEX notifications available at: http://ec.europa.eu/consumers/dyna/rapex/rapex_archives_en.cfm. 17 CJEU, Schecke (

text: and

text: ), [2010] ECR I-11063, para. 81.

text: Article 25 of Directive 95/46/EC

text: and

text: Article 9 of Regulation (EC) No 45/2001

text: . 19 Andorra, Argentina, Australia, Canada, Switzerland, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, and Uruguay (as well as the USA in respect of Passenger Name Records and the ‘Safe Harbor’ regime which, however, do not seem of particular relevance in the context of the Proposal). An updated list can be found at: http://ec.europa.eu/justice/dataprotection/document/international-transfers/adequacy/index_en.htm.

text: CJEU, Schecke (

text: and

text: ), [2010] ECR I-11063.

amnesord:
Transfers of data
Consumers

title: Market surveillance

text: Opinion of the European Data Protection Supervisor on the Commission Proposal for a Regulation of the European Parliament and the Council on market surveillance of products and amending various legislative instruments of the European Parliament and of the Council

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular

text: Article 28 (2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1. On 13 February 2013, the Commission adopted its Product Safety and Market Surveillance Package, including a proposal for a Regulation of the European Parliament and of the Council on market surveillance of products and amending Council Directives

text: and

text: , and Directives

text: Regulation (EU) No 305/2011

text: Regulation (EC) No 764/2008

text: and

text: Regulation (EC) No 765/2008

text: of the European Parliament and of the Council (hereinafter: 'the Proposal'). On the same day, the Proposal was sent to the EDPS for consultation. 1.1. Consultation of the EDPS

text: 2. Before the adoption of the Proposal, the EDPS was given the opportunity to provide informal comments. The EDPS welcomes the reference to the present consultation in the preamble of the Proposal.

text: 3. In the present Opinion, the EDPS wishes to highlight those elements of the Proposal which have personal data processing implications and to reiterate some of his earlier comments which, if taken on board, would further improve the text from a data protection perspective. 1.2. General background

text: 4. The Proposal is part of the “Product Safety and Market Surveillance Package” which also includes a proposal for a Regulation on consumer product safety (replacing the General Product Safety Directive

text: , the ‘GPSD’) and a multi-annual action plan for market surveillance covering the period 2013-2015. The overall objective is to clarify the regulatory framework for market surveillance in the field of non-food products (both for harmonised and nonharmonised products, whether intended for consumers or for professionals) and consolidate it in a single instrument. To this end, the Proposal merges the rules on market surveillance of the GPSD,

text: Regulation (EC) No 765/2008

text: and several sector-specific instruments of EU harmonisation legislation.

text: 5. In particular, the provisions regarding the functioning of the EU Rapid Information System (RAPEX) that are currently contained in the GPSD have been transferred to the Proposal, according to which RAPEX would become the single alert system regarding products presenting a risk to EU consumers.

text: 6. The Proposal will also formally establish the Information and Communication System for Market Surveillance (ICSMS) which will serve as a database of market surveillance information as well as a communication channel for market surveillance authorities.

text: 2. ANALYSIS OF THE PROPOSAL 2.1. General comments

text: 7. At first sight, the Proposal does not deal with the processing of personal data, as understood under EU law as any information related to an identified or identifiable individual, i.e. a natural person . It focuses instead on the measures to be taken in order to recognise unsafe or otherwise harmful products and keep or take them off the market (and punish the responsible market operators), including the use of RAPEX, ICSMS and the publication of certain information. Nevertheless, since the Proposal may require the processing of personal data there is a personal data protection component.

text: 8. Whenever the exchange of information through RAPEX or ICSMS involves the processing of personal data –as explained below- national rules transposing Directive

text: on the one hand, and

text: Regulation (EC) No 45/2001

text: on the other hand become applicable, with specific consequences. The EDPS therefore welcomes the reference in recital 30 to the EU data protection legislation in force, i.e. (national rules implementing) Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (although the precise drafting of that recital could be improved, as set out below). 2.2. Specific comments Personal data processing in the context of market surveillance

text: 9. In order for market surveillance to be effective in the single EU market, information about unsafe products must be exchanged among competent authorities of the Member States and between the Member States and the Commission. According to Articles 19 and 20 of the Proposal, the EU rapid information system RAPEX (which is used for such purposes today) will continue to be used for alert notifications relating to products presenting a risk. In addition, a clear legal basis (

text: Article 21

text: ) is provided for the functioning of the information and communication system for market surveillance ICSMS which will store information related to market surveillance and serve as a communication channel for market surveillance authorities.

text: 10. Pursuant to Article 20(2) of the Proposal, information provided through RAPEX must include inter alia: (i) the data necessary to identify the product’, and (ii) 'the origin and the supply chain of the product’.

text: 11. The information is to be transmitted using a ‘standard notification form made available by the Commission in the RAPEX system’. While this standard form is not part of the Proposal, the RAPEX operational guidelines provide useful insights into the precise contents of a typical notification, which includes inter alia contact details of the manufacturer or his representative, as well as those of the exporter(s), importer(s), distributor(s) and/or retailer(s) of the product in question.

text: 12. Pursuant to Article 3 of the Proposal, ‘manufacturer’, ‘authorised representative’, ‘importer’, and ‘distributor’ (collectively, the ‘economic operators’) can be either legal or natural persons. The EDPS wishes to reiterate that where contact details of natural persons (i.e. personal data) are processed in RAPEX, such processing will trigger the application of national rules transposing Directive

text: (at Member State level) and of

text: Regulation (EC) No 45/2001

text: (with respect to the Commission). This will also be the case where personal data of natural persons connected to economic operators (e.g. contact details of a legal representative or of an employee) are processed or if the official title of the legal person identifies one or more natural persons .

text: 13. Given that these data protection-related aspects of market surveillance are not necessarily self-evident, the EDPS recommends clarifying that the proposal is not meant to provide for general derogations from data protection principles and that relevant personal data processing legislation remains fully applicable in the market surveillance context. This should be done in a substantive provision in the operative part of the text, possibly supplemented by a dedicated recital.

text: 14. In this context, the EDPS considers unfortunate that recital 30 as proposed by the Commission may appear (in particular to the non-expert) to reduce personal data to only one of the elements of the necessary balance to be struck between transparency and the need to maintain confidentiality of certain information (e.g. commercial secrets). In fact, the need to respect confidentiality of information exchanged (whether or not such information includes personal data) or to balance confidentiality and the need for transparency and legal obligations to grant access to certain documents are separate issues, that are not equivalent to personal data protection. The EDPS wishes to stress that the data protection principles encompass a far broader range of issues than confidential handling of personal data, such as inter alia the requirement to process data fairly and lawfully, for specific purpose(s), while ensuring their quality and allowing the individuals concerned to exercise their rights . He recommends redrafting recital 30 so as to make it clear that data protection implications of the proposal are not limited to the issue of a balance between confidentiality and transparency.

text: 15. Similar issues are likely to arise in connection with ICSMS. The ICSMS will contain ‘a record of references’ to the notifications made under RAPEX in accordance with

text: Article 20

text: , but also information about ‘complaints or reports about issues relating to risks arising from products’ which at first sight seem likely to contain at least contact details of either the complainants or the economic operators concerned. In addition, pursuant to

text: Article 21(2)

text: , Member States will be under obligation to register in the ICSMS ‘any information at their disposal […] about products presenting a risk regarding, in particular […] contacts with economic operators concerned’.

text: 16. The EDPS draws attention to the fact that, whenever personal data are processed in the context of market surveillance, whether in RAPEX, the ICSMS or by any other means on the basis of the Proposal, data protection legislation in force will become applicable. Practical consequences of this will include, for example, the requirement that the personal information is relevant and not excessive in relation to the market surveillance purposes .

text: 17. Consequently, the Proposal should ensure that only personal information which is strictly necessary is processed for market surveillance purposes, in accordance with the principles of proportionality and data minimisation. With respect to RAPEX, this is currently achieved in practice by means of a standard notification form annexed to the RAPEX Guidelines adopted by the Commission. However, in the interest of legal certainty, an addition to that effect should be included in

text: Article 19

text: . Moreover, since no rules of this kind appear to exist at this time for ICSMS, the EDPS recommends that it is specified in more detail in

text: Article 21

text: what types of personal information may be processed in ICSMS (e.g. the name and contact details of the economic operator(s) and/or the person(s) filing a complaint, and/or the victim(s) of an unsafe product).

text: 18. As an example, pursuant to

text: Article 21(1)

text: (d), ICSMS shall store information about complaints or reports about issues relating to risks arising from products. Such complaints are likely to include personal information of the complainant. However, it is not immediately clear whether and to what extent the processing of such personal data can be justified on market surveillance grounds. The EDPS recommends that

text: Article 21

text: be amended in order to clarify what types of personal data may be processed in ICSMS for which specific purposes. Retention periods

text: 19. One of the fundamental principles of data protection requires that personal data is not kept (in a form which permits identification of the individual concerned) for longer than necessary for the purpose(s) of the processing . In practice, this means that in most situations a fixed retention period is determined, following the expiry of which the personal data is deleted.

text: 20. The EDPS notes that the Proposal does not contain any provisions which would limit in time the storage of personal data in RAPEX or the ICSMS. However, according to section 3.8 of the RAPEX operational guidelines, notifications distributed through the application are kept in the system for an unlimited period of time. The EDPS draws attention to the fact that, while an unlimited retention period may be justifiable in case of information about products, it would be difficult to justify it with respect to personal data (even if such personal data are only ancillary to the product information). He therefore recommends that fixed retention periods for the personal data processed in RAPEX and ICSMS are provided for in the proposed Regulation. Publication of information

text: 21. Article 10(6) of the Proposal provides for publication of information about unsafe products and measures taken in respect of them ‘to the fullest extent necessary to protect the interests of users of products in the Union’. The Proposal further states that, ‘[t]his information shall not be published where it is imperative to observe confidentiality in order to […] preserve personal data pursuant to national and Union legislation […]’.

text: 22. The EDPS notes that the Proposal does not state explicitly that such publication could include personal data. However, published information concerning measures taken in respect of unsafe products is likely to include personal information of the economic operator(s) concerned. This seems also implicit in the provision quoted above which appears to exclude publication of any information about a given case where such publication would imply the publication of personal data.

text: 23. In this respect, the EDPS wishes to underline that the objective of informing the public about unsafe products subject to measures taken by market surveillance authorities may be achieved without necessarily rendering personal information of economic operator(s) responsible for those products public. Indeed, this appears to be how information is published on the RAPEX website today . The EDPS recommends that the same approach is adopted for any publication of information by market surveillance authorities in the context of the Proposal.

text: 24. On the other hand, if it is the intention of the legislator to provide for the publication of personal information of economic operators, for example as a sanction in cases of repeated breaches or an additional deterrent for unscrupulous operators, the EDPS recommends including explicit provisions to that effect in the Proposal. As a minimum, a substantive provision should clarify what kind of personal data may be made public and for what purpose(s). In this context, attention is drawn to the Schecke judgment in which the Court of Justice underlined that, in order to strike a proper balance between the various interests involved, the EU institutions must take into consideration methods of publishing information which would be consistent with the objective of such publication while at the same time causing less interference with an individual’s right to respect for their private life and to protection of their personal data . International transfers of data Finally, the EDPS notes that, insofar personal data of economic operators that are natural persons are processed in the context of market surveillance, certain elements of the Proposal would imply transfers of such data to third countries. For instance, pursuant to

text: Article 19(4)

text: , participation in RAPEX shall be open to applicant countries, third countries and international organisations. Under EU data protection law, transferring of personal data to a third (i.e. non-EU/EEA) country is, in principle, only allowed on the condition that adequate level of protection is 18 19 ensured . A limited number of countries is currently considered to offer such adequate level of protection. However, transfers to other destinations may only take place under strict conditions.

text: 25. With this specific legal context in mind, the EDPS suggests clarifying that any agreements between the EU and those countries/organisations should not only include provisions on confidentiality, but also specific provisions about personal data protection corresponding to those applicable in the Union, as required by

text: Article 25 of Directive 95/46/EC

text: and

text: Article 9 of Regulation (EC) No 45/2001

text: 26. Moreover, Article 22 of the Proposal would allow the Commission and the Member States to exchange information shared through RAPEX with regulatory authorities of third countries or international organisations with which ‘confidentiality arrangements based on reciprocity’ have been concluded. The EDPS wishes to underline that whenever such information exchange would include personal data, rules on international data transfers set out in Directive

text: and

text: Regulation (EC) No 45/2001

text: become fully applicable. He therefore recommends including the explicit reference to data protection suggested in the preceding paragraph also in

text: Article 22

text: 27. It is the EDPS’ understanding that the Proposal does not provide for any cooperation with applicant countries, third countries or international organisations regarding information processing in ICSMS pursuant to

text: Article 21

text: . Nevertheless, he notes that, should cooperation of this kind be considered, a similar clause referring to data protection should be included in

text: Article 21

text: 3. CONCLUSIONS

text: 28. The EDPS appreciates that data protection issues have been taken into account in the Proposal to a certain extent. However, in the present Opinion he gives some recommendations on how the Proposal could be further improved from a data protection perspective.

text: 29. In particular, the EDPS recommends:  including a substantive provision to clarify that the Proposal is not meant to provide for general derogations from data protection principles and that relevant personal data processing legislation (i.e. national rules implementing Directive

text: and

text: Regulation (EC) No 45/2001

text: ) remain fully applicable in the market surveillance context. In addition, recital 30 would benefit from some redrafting;  amending Articles 19 and 21 of the Proposal so as to ensure that only personal information which is strictly necessary is processed for market surveillance purposes in RAPEX and ICSMS, respectively, in accordance with the principles of proportionality and data minimisation;  providing in the proposed Regulation (e.g. in Articles

text: and

text: ) for fixed retention periods for the personal data processed in RAPEX and ICSMS, keeping in mind that an unlimited retention period for personal data would be difficult to justify under EU data protection law (even though it may be justifiable in case of information about products);  maintaining the approach by which the public is informed about unsafe products (via the RAPEX website) without rendering personal information of economic operator(s) responsible for those products public, and applying a similar approach in all instances where information is published by market surveillance authorities in the context of the Proposal;  should it be the intention of the legislator to provide for the publication of personal information of economic operators (for example as a sanction in cases of repeated breaches or an additional deterrent), including explicit substantive provisions that would at least specify what kind of personal data may be made public and for what purpose(s). In this context, attention is drawn to the need to consider modalities of publication which would cause less interference with an individual’s right to respect for their private life and to protection of their personal data, in line with the Schecke judgment of the Court of Justice;  supplementing the provisions on participation of applicant countries, third countries or international organisations in RAPEX (

text: Article 19(4)

text: ), as well as on international exchange of confidential information (

text: Article 22

text: ) with explicit references to specific provisions about personal data protection corresponding to those applicable in the Union, as required by

text: Article 25 of Directive 95/46/EC

text: and

text: Article 9 of Regulation (EC) No 45/2001

text: . Done in Brussels, 30 May 2013 (signed) Giovanni BUTTARELLI European Data Protection Assistant Supervisor


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2013) 168 final/2. 4 COM (2012) 84 final.

text: Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Council Directive 89/105/EEC of 21 December 1988

text: relating to the transparency of measures regulating the pricing of medicinal products for human use and their inclusion in the scope of national health insurance system (OJ L 40, 11.2.1989, p. 8).

text: EDPS Opinion of 27 March 2013, available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/OpinionsC. 7 EDPS Opinions of 10 February 2012, available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/OpinionsC.

text: Joined Cases

text: and

text: , Volker und Markus Schecke GbR v Land Hessen; Eifert v Land Hessen, [2012] All E.R. (EC) 127, CJ.

text: See EDPS Opinion of 10 April 2007 on the financing of the Common Agricultural Policy, OJ 2007 C134/1 OJ C 134, 16.6.2007, p. 1–3.

text: See EDPS Opinion of 19 December 2012 on the Commission proposal for a Regulation on clinical trials on medicinal products for human use, and repealing Directive

text: available on the EDPS Website under: http://www.edps.europa.eu/EDPSWEB/edps/Consultation/OpinionsC. 11 See ECHR 17 July 2008, I v Finland (appl. No 20511/03), paragraph 38 and ECHR 25 November 2008, Armonas v Lithuania (appl. No 36919/02), paragraph 40.

text: See

text: Article 29

text: Working Party Opinion 03/2013 of 2 April 2013 on purpose limitation, p. 21-27. 13 See

text: Article 29

text: Working Party Opinion 03/2013 of 2 April 2013 on purpose limitation. 14 See

text: Article 29

text: Working Party Opinion 03/2013 of 2 April 2013 on purpose limitation, p. 21-27. 15 See above section 2.3.1.

identifier: EDPS yttrande (2013)

amnesord:
Necessity & Proportionality
Health

publisher: Europeiska datatillsynsmannen

sprak: en

title: Transparency of measures regulating the prices of medicinal products

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the amended Commission proposal for a Directive on the transparency of measures regulating the prices of medicinal products for human use and their inclusion in the scope of public health insurance systems

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free 2 movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 18 March 2013, the Commission adopted an amended proposal concerning a Directive on the transparency of measures regulating the prices of medicinal products for human use and their inclusion in the scope of public health insurance systems (the proposed Directive). This proposal was sent to the EDPS for consultation on 19 March 2013.

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and welcomes that a reference to this Opinion has been included in the preamble of the instrument. The EDPS regrets, however, that he was not consulted by the Commission during the preparation of or at least after the adoption of the original proposal from 1 March 2012 . 1.2. Objectives and scope of the proposal

text: 3. In the explanatory memorandum to the proposed Directive, the Commission states that Member States are responsible for the organisation of their healthcare system and for the delivery of health services and medical care, including the allocation of resources assigned to them. In this framework, each Member State can take measures to manage the consumption of medicines, regulate their prices or establish the conditions of their public funding. A medicinal product authorised in accordance with EU legislation on the basis of its quality, safety and efficacy profile may therefore be subject to additional regulatory requirements at Member State level before it can be placed on the market or dispensed to patients under the public health insurance scheme.

text: 4. Furthermore the Commission explains that Directive

text: was adopted to enable market operators to verify that national measures regulating the pricing and reimbursement of medicines do not contravene the principle of free movement of goods. To this end, Directive

text: lays down a series of procedural requirements to ensure the transparency of pricing and reimbursement measures adopted by the Member States. Since the adoption of this directive market conditions have fundamentally changed, for instance with the emergence of generic medicines providing cheaper versions of existing products or the development of increasingly innovative (yet often expensive) research-based medicinal products. In parallel, the constant rise in public expenditure on pharmaceuticals in the last decades has encouraged Member States to devise more complex and innovative pricing and reimbursement systems over time.

text: 5. The proposal for a Directive repealing the

text: Council Directive 89/105/EEC

text: was adopted by the Commission on 1 March 2012. The Commission states that negotiations in the Council Working Party on Pharmaceuticals and Medical Devices proved to be difficult, given the politically sensitive nature of the file.

text: 6. The European Parliament adopted its position in first reading on 6 February 2013. As the result of the vote in Plenary and taking into consideration the position of the Member States in the Council, the Commission decided to amend its Proposal by adopting the proposed Directive, and to consult the EDPS. 1.3. Aim of the EDPS Opinion

text: 7. This Opinion will focus on the following aspects of the proposed Directive relating to personal data protection: the applicability of data protection legislation, the publication of personal data of experts and members of certain bodies, the potential processing of patient health data through the access to market authorisation data and the proposed opportunity for the creation of databases at EU/member state level.

text: 2. ANALYSIS OF THE PROPOSAL 2.1. Applicability of data protection legislation

text: 8. In the draft Directive, processing of personal data will take place under various provisions concerning publication of personal information regarding experts and members of certain national decision-making bodies and under the provisions regarding access to market authorisation data under the proposed Directive. Both EU and national data protection legislation therefore apply.

text: 9. Neither recitals nor substantive provisions of the proposed Directive mention applicable EU data protection legislation such as Directive

text: for processing carried out by national competent authorities and

text: Regulation (EC) 45/2001

text: for processing carried out by EU Institutions and bodies. The EDPS considers that a reference to the applicable data protection legislation should be inserted in a substantive article of the proposed Directive. Such a reference is needed to clarify the relationship between the proposals and the EU framework for data protection. The proposed Directive should not be considered as derogation from the data protection framework, which remains fully applicable to the processing operations foreseen.

text: 10. The reference should explicitly provide as a general rule that Directive

text: and

text: Regulation (EC) 45/2001

text: apply to the processing of personal data within the framework of the proposed Directive. Furthermore, the EDPS suggests that the reference to Directive

text: should specify that the provisions will apply in accordance with the national rules which implement Directive

text: . 2.2. Provisions concerning disclosure 2.2.1 Information concerning names and declarations of interest

text: 11. The EDPS has in the past repeatedly expressed concerns about the interference with the right to the protection of their personal data caused by the publication of data (on the Internet). The Opinions on Insolvency proceedings and the Opinions on the legislative package on the revision of the banking legislation, credit rating agencies, markets in financial instruments (MIFID/MIFIR) and market abuse all deal extensively with this issue. Therefore, this section should be read in conjunction with those EDPS Opinions.

text: 12. According to Article 16 of the proposed Directive, Member States shall ensure that the competent authorities make publicly available a regularly updated list of the members of their decision-making bodies, together with their declarations of interest. This provision also extends to members of bodies responsible for remedy procedures according to Article 8(2) of the proposed Directive. Furthermore, Recital 21 states that the purpose of this publication is to ensure the transparency, integrity and independence of the decisionmaking process within the national competent authorities.

text: 13. These provisions have been introduced as a result of amendments adopted by the European Parliament in first reading and the Commission has included these provisions in the amended proposed Directive without carrying out an impact assessment or mentioning these provisions in the explanatory memorandum of the proposed Directive.

text: 14. Although the EDPS understands the importance of a high degree of transparency in this context, he is not convinced that the provisions, as they are currently drafted, meet the legal standard for publication of personal data set by the Court of Justice in the Schecke judgment. As the publication of the personal data of members constitutes an interference with the right to the protection of personal data, following the court's ruling, a proper balance needs to be found between the various interests involved. 2.2.2. Necessity and proportionality of mandatory publication

text: 15. In the Schecke judgment, the Court of Justice annulled the provisions of a Council Regulation and a Commission Regulation providing for the mandatory publication of information concerning beneficiaries of agricultural funds, including the identity of the beneficiaries and the amounts received. The Court held that the said publication constituted the processing of personal data falling under Article 8(2) of the European Charter of Fundamental Rights (the 'Charter') and therefore an interference with the rights recognised by Articles 7 and 8 of the Charter.

text: 16. After analysing that 'derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary', the Court went on to analyse the purpose of the publication and the proportionality thereof. It concluded that in that case there was nothing to show that, when adopting the legislation concerned, the Council and the Commission took into consideration methods of publishing the information which would be consistent with the objective of such publication while at the same time causing less interference with those beneficiaries' rights to respect for their private life and to the protection of personal data in particular.

text: 17. In this regard,

text: Articles 16

text: and Article 8 of the proposed Directive seem to be affected by shortcomings highlighted by the CJEU in the Schecke judgement. The EDPS is under the impression that the necessity and proportionality of the mandatory publication of a list of the members of Member State bodies, together with their declarations of interest are not clearly established since nothing in the text shows that alternative methods of disclosing the information which would be consistent with its objective while at the same time causing less interference with those beneficiaries' rights have been addressed by the Commission. It is not explained how the publication accessible to the public will better serve the desired objective of transparency than any other conceivable alternatives, such as limiting the access to the personal data to a well-defined group of interested parties or making the personal data available on request only.

text: 18. While the proposed Directive does not specify the medium on which the information should be published, in practice, it is likely that the publication will take place on the Internet. Internet publications raise specific issues and risks concerning in particular the need to ensure that the information is kept online for no longer than is necessary and that the data cannot be manipulated or altered. The use of internal/external search engines also entail the risk that the information could be taken out of context and channelled through and outside the web in ways which cannot be easily controlled.

text: 19. The EDPS recommends that the legislators carefully assess the necessity and proportionality of the proposed system and verify whether the publication obligation goes beyond what is necessary to achieve the public interest objective pursued and whether there are not less restrictive measures to attain the same objective. 2.2.3. The additional question of adequate safeguards

text: 20. Subject to the outcome of the aforementioned necessity and proportionality test, the publication obligation should in any event be supported by adequate safeguards to ensure respect of the rights of the persons concerned to object, the security/accuracy of the data and their deletion after an adequate period of time.

text: 21. The proposed Directive does not make reference to relevant articles in Directive

text: regarding data protection safeguards and does not explain the conditions of application of existing safeguards to the specific issue of measures relating to transparency, integrity and independence of the decision-making process within the national competent authorities. The EDPS considers that the proposed Directive should have foreseen adequate safeguards in order to ensure a fair balance between the different interests at stake. It should ensure that the rights of the data subjects are respected in a proactive manner. A proactive approach should imply that data subjects are informed by the data controller (in this case the national competent authority) beforehand of the fact that their names and declarations of interest are going to be published, and that they are granted the right to object under

text: Article 14 of Directive 95/46/EC

text: on compelling legitimate grounds. The EDPS recommends amending the text in this sense. 2.3. Access to data collected for market authorisation purposes

text: 22. Article 13(2) of the proposed Directive gives the competent authorities the right to request and have full access to data generated during the marketing authorisation process [...] so that they can assess the relative efficacy as well as the short- and long-term effectiveness, where appropriate, of a medicinal product. According to

text: Article 13 (3)

text: , the competent authorities shall also be able to use the available data or generate additional relevant data [...]. These rights are also mentioned in recital 17 of the proposed Directive.

text: 23. It is unclear from the text of the proposed Directive whether these market authorisation data sets will contain personal data and if so whether they will contain sensitive data such as patient health data. Neither the explanatory memorandum nor the impact assessment report provides any guidance on this matter. If personal data of patients or other actors in the market authorisation procedure is included among the market authorisation data, the access and use of this data would constitutes processing of personal (potentially sensitive) data in the meaning of Directive

text: 24. The term 'data generated during the marketing authorisation process' is not defined in the proposed Directive. As the market authorisation process of medicinal products both at national and EU-level is built up around clinical trials, the EDPS assumes that access to market authorisation data will also mean access to at least some clinical trials data submitted during the market authorisation process.

text: 25. This will presumably include primarily anonymised data derived from patient health data. It is not clear, however, based on the current legislative framework and the proposed Directive, whether this data may also include key-coded patient data or other directly or indirectly identifiable patient health data. As these would continue to be considered personal data, a clarification of this situation in the proposed Directive would be important. In this respect the EDPS would like to refer to the recent EDPS Opinion on Clinical trials where he recommended inserting a provision in the proposed legislation that clearly defines in which situations and subject to what safeguards information containing patient health data will be processed and stored in clinical trials databases.

text: 26. The proposed Directive does not provide justification for the need for directly or indirectly identifiable personal data of patients to be processed for the purpose of pricing and reimbursement decisions. Unless such a need is clearly demonstrated, or unless it is demonstrated that the data processed cannot be (fully) anonymised, the EDPS recommends full anonymisation (and high level of aggregation) of any patient data included in the market authorisation data as the most effective solution for the protection of personal data. Correct application of state-of-the-art anonymisation techniques would imply that no personal data are processed and Directive

text: would therefore be no longer applicable. The EDPS recommends amending the text in this sense. 2.3.1. Potential processing of patient data concerning health

text: 27. As stated above, access to market authorisation data would imply access to, for example, raw data from clinical trials. Clinical trials are by nature dependent on the processing and storage of personal data of patients at different levels (local, national and European). Personal data of patients participating in clinical trails is data relating to the health of the persons concerned since they reveal information about medicine use and associated health problems.

text: 28. The EDPS wishes to underline that the processing of health data (considered "special" or "sensitive") is subject to stricter data protection standards laid down in

text: Article 8 of Directive 95/46/EC

text: and its implementing national laws. Among the possible legal grounds for the processing of personal data relating to health, Article 8(3) of Directive 95/46 is applicable in this case. These provisions lift the prohibition of processing health related data if the processing is ‘required for the purpose of preventive medicine [...]’.

text: 29. The importance of protecting such data has repeatedly been emphasised by the European Court of Human Rights in the context of Article 8 of the European Convention of Human Rights. The Court has stated: ‘The protection of personal data, in particular medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention’ .

text: 30. If personal data concerning health is intended to be processed under the proposed Directive, the EDPS recommends inserting a reference to

text: Article 8 of Directive 95/46/EC

text: in the provisions concerning access to market authorisation data.

text: 31. Furthermore, the processing of personal data concerning health should always be accompanied by specific safeguards to ensure fair processing and to prevent any undue impact on the data subjects. The EDPS therefore recommends (as stated above in section 2.3.) inserting a provision in the proposed Directive that clearly defines in which situations and subject to what safeguards information containing patient health data will be processed. 2.3.2. Compatible use of market authorisation data

text: 32. The Proposal provides for the processing for the purposes of reimbursement and pricing decisions of personal data that was collected for a different purpose (clinical trials and market authorisation). This raises questions regarding purpose limitation, a concept that has been analysed in detail in a recent Opinion of the

text: Article 29

text: Working Party . In addition, the issue arises whether it is necessary and proportionate to use patient data for those secondary purposes, or whether it would be sufficient (and more proportionate) to only use (fully) anonymised datasets.

text: 33. The principle of purpose limitation protects data subjects by setting limits on how data controllers are able to use personal data, while at the same time offering them some degree of flexibility. The concept of purpose limitation has two main building blocks: personal data must be collected for 'specified, explicit and legitimate' purposes (purpose specification) and not be 'further processed in a way incompatible' with those purposes (compatible use).

text: 34. In the present case, the EDPS will concentrate his analysis on compatible use since this case concerns data that has already been collected for a different purpose (in particular, for purposes of conducting a clinical trial within the market authorisation procedure).

text: 35. Further processing for a different purpose does not necessarily mean that this purpose is incompatible: compatibility needs to be assessed on a case-by-case basis. A substantive compatibility assessment requires an assessment of all relevant circumstances. In 14 particular, account should be taken of the following key factors : 1) the relationship between the purposes for which the personal data have been collected and the purposes of further processing. In this case the purposes of market authorisation and pricing and reimbursement decisions are related although they do not directly stem from and are not directly in furtherance of the initial purpose for which the data was collected; 2) the context in which the personal data have been collected and the reasonable expectations of the data subjects as to their further use. In this case the data has been collected for purposes of a clinical trial (that is, for research and medicinal safety purposes to ensure that the medications on trial can be safely used). It is doubtful whether the data subject whose health data were collected during a clinical trial would have reasonable expectations that the data will be processed not only for market authorisation, but also for pricing and reimbursement, and may possibly be submitted to a different competent authority for evaluation; 3) the nature of the personal data in this case is potentially sensitive patient health data and the impact of the further processing on the data subjects is severe by nature in case of processing of this category of personal data ; 4) the safeguards adopted by the controller to ensure fair processing and to prevent any undue impact on the data subjects. In this case no specific safeguards are mentioned in the proposed Directive. However, the fact that market authorisation data (which includes clinical trials data) may be used for purposes of pricing and reimbursement decisions, is specifically mentioned in the proposal.

text: 36. The EDPS does not see the further processing of non-anonymised data as justified in this case and recommends that Article 13 of the proposed Directive should include a requirement to fully anonymise any patient data included in the market authorisation data before this data is transferred to the competent authority for any further processing for purposes of pricing and reimbursement decisions. 2.4 Potential establishment of a price information database

text: 37. The EDPS notes that Recital 20 of the proposed Directive states that the Commission and the Member States might investigate possibilities to co-operate in the view of setting up and maintaining a price information database on medicinal products and relevant conditions so as to provide a Union-wide added value in terms of price transparency while respecting the Member States’ competences in this field.

text: 38. Depending on which information that is to be included in this database, processing of personal data might take place, even processing of sensitive patient health data.

text: 39. At this stage, the EDPS would like to remind the legislator that a recital is not sufficient to provide a legal basis for the establishment of a database including personal data, at EU or MS level. For this, a binding legal provision would be necessary .

text: 40. In addition to legal and formal requirements, there are many data protection risks to take into account when contemplating the setting up and maintaining a price information database on medicinal products and relevant conditions, potentially including (sensitive) personal data(e.g. data quality and reliability, confidentiality, access restrictions, further use and purpose limitation principle, etc). Article 33 of the proposed Data Protection 17 Regulation foresees for many processing operations, including for those on health data, that data protection impact assessments (DPIA) should be carried out before launching any new database. The EDPS therefore recommends that the Commission carries out such a DPIA in advance, before any further action is undertaken in this context.

text: 3. CONCLUSIONS The EDPS makes the following recommendations:  insert references to the applicable data protection legislation in a substantive article of the proposed Directive. Such a reference should provide as a general rule that Directive

text: and

text: Regulation (EC) 45/2001

text: ;  assess the necessity of the proposed system in Article 16 of the proposed Directive for the mandatory publication of names and declarations of interest of experts, members of decision making bodies and members of bodies responsible for remedy procedures and verify whether the publication obligation does not go beyond what is necessary to achieve the public interest objective pursued, and whether there are any less restrictive measures to attain the same objective. Subject to the outcome of this proportionality test, the publication obligation should in any event be supported by adequate safeguards to ensure respect of the rights of the persons concerned to object, the security/accuracy of the data and their deletion after an adequate period of time;  insert a reference to

text: Article 8 of Directive 95/46/EC

text: in Article 13 of the proposed Directive concerning access to market authorisation data, if personal data concerning health is intended to be processed and insert a provision in the proposed Directive that clearly defines in which situations and subject to what safeguards information containing patient health data will be processed;  include in Article 13 of the proposed Directive a requirement to fully anonymise any patient data included in the market authorisation data before this data is transferred to the competent authority for any further processing for purposes of pricing and reimbursement decisions;  carry out a data protection impact assessment in advance, before any further action is undertaken with a view to launching any new database. Done in Brussels, 30 May 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor

type: vagledning

utgivare: edps