Back to EUR-Lex homepage

EUR-Lex Access to European Union law

Back to EUR-Lex homepage

This document is an excerpt from the EUR-Lex website

Use quotation marks to search for an "exact phrase". Append an asterisk (*) to a search term to find variations of it (transp*, 32019R*). Use a question mark (?) instead of a single character in your search term to find variations of it (ca?e finds case, cane, care).
Search tips
Need more search options? Use the Advanced search
You are here

Document 52013XX1207(01)

Executive summary of the Opinion of the European Data Protection Supervisor on the Commission proposals for a regulation on medical devices and amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and regulation (EC) No 1223/2009 and a regulation on in vitro diagnostic medical devices

OJ C 358, 7.12.2013, p. 10–12 (BG, ES, CS, DA, DE, ET, EL, EN, FR, IT, LV, LT, HU, MT, NL, PL, PT, RO, SK, SL, FI, SV)
OJ C 358, 7.12.2013, p. 10–10 (HR)

7.12.2013   

EN

Official Journal of the European Union

C 358/10

Executive summary of the Opinion of the European Data Protection Supervisor on the Commission proposals for a regulation on medical devices and amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and regulation (EC) No 1223/2009 and a regulation on in vitro diagnostic medical devices

(The full text of this Opinion can be found in English, French and German on the EDPS website: http://www.edps.europa.eu)

2013/C 358/07

1.   Introduction

1.1.   Consultation of the EDPS

1.

On 26 September 2012, the Commission adopted two proposals for a regulations on medical devices (‘the proposed MD Regulation’) (1), and a regulation on in vitro diagnostic medical devices (‘the proposed IVD regulation’) (2). These proposals were sent to the EDPS for consultation on 2 October 2012.

2.

The EDPS welcomes the fact that he is consulted by the Commission and recommends that a reference to the consultation be included in the preambles of the proposed regulations.

1.2.   Objectives and scope of the proposed regulation

3.

The proposed regulations aim at ensuring the safety of medical devices (‘MDs’) (3) and in vitro diagnostic medical devices (‘IVDs’) (4) and their free circulation within the internal market. They amend and clarify the scope of the existing legislation, to take into account scientific and technological progress. The proposed regulations contain legal frameworks to utilise an existing electronic database (Eudamed database) (5) at EU level to facilitate coordination between authorities to ensure rapid and consistent responses to safety issues, to increase devices traceability throughout the supply chain and to clarify the obligations and responsibilities of manufacturers, importers and distributors. They furthermore strengthen the different levels of supervision by clarifying and enhancing the position and powers of public authorities vis-à-vis economic actors.

1.3.   Aim of the EDPS Opinion

4.

The proposed regulations will affect the rights of individuals related to the processing of their personal data. Amongst other issues, they deal with the processing of sensitive data (health data), a central EU-level database which includes personal data, market surveillance (6) and record keeping.

5.

The EDPS welcomes that the Commission has made an effort to guarantee the correct application of EU rules concerning the protection of personal data in the proposed regulations. However, the EDPS sees a need for some clarifications with particular regards to sensitive data, especially when this category of personal data comes to the processing and storage in the database suggested by the proposed regulations. Indeed, the EDPS has identified certain ambiguities and inconsistencies in the way the proposed regulations deal with the issue of whether and what categories of personal data will be processed, in particular where sensitive data regarding health might be processed and stored.

3.   Conclusions

40.

The EDPS welcomes the attention paid specifically to data protection in the proposed regulations, but identified some scope for further improvement.

41.

The EDPS recommends:

—

that Article 85 of the proposed MD Regulation and Article 81 of the proposed IVD Regulation clarify the reference to Directive 95/46/EC by specifying that the provisions will apply in accordance with the national rules which implement Directive 95/46/EC,

—

inserting in Article 85 of the proposed MD Regulation and in Article 81 of the proposed IVD Regulation explicit reference to Article 8 of Directive 95/46/EC and Article 10 of Regulation (EC) No 45/2001,

—

inserting similar paragraphs regarding purposes for data processing, data subject rights and data retention periods as in Article 27 of the proposed MD Regulation into Article 25 of the proposed IVD Regulation, subject to the modifications suggested in this Opinion,

—

including a definition of the term ‘subject’ in the proposed regulations,

—

unambiguously preventing the inclusion of all patients' health data in the clinical investigations module of the Eudamed database,

—

inserting provisions in the proposed MD Regulation and the proposed IVD Regulation that clearly define in which situations and subject to which safeguards information containing patient health data will be processed and stored in the Eudamed database concerning vigilance and post-market surveillance. In particular, the proposed regulation should require that a risk assessment be carried out by the Commission before the processing and storage of any patient health data in the Eudamed database,

—

including, in a recital of both proposed regulations, that any implementing measures to be adopted under the proposed regulations should specify in detail the data protection implications of the functional and technical characteristics of the Eudamed database and the EDPS should be consulted,

—

explicitly mentioning that periodic reports in Article 61 of the proposed MD Regulation and Article 59 of the proposed IVD Regulation should only be using anonymous data,

—

adding the following sentence to Article 8(6) of both proposed regulations: ‘Before any processing of data concerning health of patients takes place, manufacturers shall obtain explicit consent from the data subject pursuant to Article 8(2)(a) of Directive 95/46/EC.’,

—

inserting provisions regulating how personal data should be managed as regards the surveillance by competent authorities in the proposed regulations,

—

inserting a maximum retention period for personal data under the proposed regulations. The chosen period should be necessary and proportionate for the purposes for which personal data are collected and processed.

—

consulting the EDPS in relation to any delegated or implementing act adopted pursuant to the proposed regulations which might have an impact on the processing of personal data.

Done at Brussels, 8 February 2013.

Giovanni BUTTARELLI

Assistant European Data Protection Supervisor

(1)  COM(2012) 542 final.

(2)  COM(2012) 541 final.

(3)  Medical devices include products such as sticking plasters, contact lenses, dental filling materials, x-ray machines, pacemakers, breast implants or hip replacements.

(4)  In vitro diagnostic medical devices include products such as devices used to ensure the safety of blood transfusion (e.g. blood grouping), detect infectious diseases (e.g. HIV), monitor diseases (e.g. diabetes) and perform blood chemistry (e.g. cholesterol measurement).

(5)  Established by Commission Decision 2010/227/EU (OJ L 102, 23.4.2010, p. 45).

(6)  For example regarding the market surveillance plan, where manufacturers are required to institute and keep up to date a systematic procedure to collect and review experience gained from devices placed on the market. This would entail the collection, recording and investigation of complaints and reports from healthcare professionals, patients or users on suspected incidents related to devices.

Top