Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Regulation laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency

(C/2023/712)

(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)

On 26 April 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency, amending Regulation (EC) No 1394/2007 and Regulation (EU) No 536/2014 and repealing Regulation (EC) No 726/2004, Regulation (EC) No 141/2000 and Regulation (EC) No 1901/2006.

The Proposal aims at achieving an internal market as regards medicinal products for human use and, at the same time, setting high standards of quality and safety for medicinal products in order to meet common safety concerns with regard to such products. In this regard, the EDPS welcomes that the Proposal aims to provide a clear legal basis for the processing of personal data, including health data, by the European Medicines Agency (EMA).

Exceptions to the prohibition on processing of personal data concerning health may be provided for by Union law where it is necessary for reasons of public interest in the area of public health and/or for scientific research purposes. When doing so, however, the legal basis provided by Union law must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The EDPS therefore considers that the Proposal should at least specify all relevant sources of personal health data, together with other relevant safeguards, such as pseudonymisation.

On the processing of personal data within the Eudravigilance database, the EDPS considers that the Proposal should define what categories of personal data would be processed when sharing information on suspected adverse reactions in human beings arising from use of the medicinal products. In addition, the EDPS also recommends to specify EMA’s role and responsibilities (and of Member States where applicable) within the meaning of data protection law.

The EDPS also understands that personal data would be processed in the context of the register of orphan medicinal products. Since the register will be set up and managed by EMA, the EDPS recommends explicitly designating EMA as the controller of the processing.

Lastly, the EDPS understands that personal data would be processed in the context of the web-portal created for the purpose of disseminating information on authorised or to be authorised medicinal products. Again, the EDPS considers it necessary to clarify the EMA’s role and responsibilities within the meaning of data protection law, as also the role of Member States and the Commission.

1. Introduction

According to its Explanatory Memorandum (2), the main objectives of the Proposal are to:

—	guarantee a high level of public health by ensuring the quality, safety and efficacy of medicinal products for EU patients, including for paediatric patients and patients suffering from rare diseases throughout the Union and;

—	harmonise the internal market for the supervision and control of medicinal products and the rights and duties incumbent upon the competent authorities of the Member States.

The specific objectives of the Proposal are to (3):

—	ensure that all patients across the EU have timely and equitable access to safe, effective, and affordable medicines;

—	enhance security of supply and ensure medicines are always available to patients, regardless of where they live in the EU;

—	offer an attractive innovation-and competitiveness friendly environment for research, development, and production of medicines in Europe;

—	make medicines more environmentally sustainable.

As explained in the Explanatory Memorandum (4), the Proposal builds on the pharmaceutical strategy for Europe (5). This strategy aims to provide a holistic answer to the current challenges of the pharmaceutical policy to ensure EU’s supply of safe and affordable medicinal products and supporting the EU pharmaceutical industry’s innovation efforts through a combination of legislative and non-legislative measures (6).

The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 26 April 2023, pursuant to Article 42(1) EUDPR (7). The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 EUDPR.

7. Conclusions

29.

In light of the above, the EDPS makes the following recommendations:

(1)	to clarify in Article 166 of the Proposal at least the sources from which personal health data would be collected by EMA, together with other relevant safeguards, such as pseudonymisation;

(2)	to modify Article 169(2) of the Proposal in a way that it specifies the purposes of the processing in a manner that would provide sufficient clarity and foreseeability for the individuals affected;

(3)	to delete Article 169(3) of the Proposal, since the EUDPR as a whole would apply to any processing to personal health data performed by EMA;

(4)	to clarify in Article 169(4) of the Proposal the elements that should be addressed by the Management Board’s decision when establishing the general scope of the regulatory science activities, the criteria shall be taken into account, as well as the manner in which the EDPS shall be consulted;

(5)	to clarify the categories of personal data to be processed within the Eudravigilance database when sharing information on suspected adverse reactions in human beings arising from use of the medicinal products;

(6)	to specify EMA’s role and responsibilities (and of Member States where applicable) within the meaning of data protection law in relation the processing operations carried out in the context of the Eudravigilance database;

(7)	to designate EMA as the controller of the processing in relation to the register of orphan medicinal products;

(8)	to clarify the EMA’s role within the meaning of data protection law, as also the role of Member States and the Commission, in relation to the web-portal created for the purpose of disseminating information on authorised or to be authorised medicinal products.

Brussels, 19 June 2023.

Wojciech Rafał WIEWIÓROWSKI

(1) COM (2023) 193 final.

(2) COM (2023) 193 final, p. 2.

(3) COM (2023) 193 final, p. 2.

(4) COM (2023) 193 final, p. 1.

(5) Communication from the Commission, Pharmaceutical Strategy for Europe (COM(2020) 761 final), https://health.ec.europa.eu/medicinal-products/pharmaceutical-strategy-europe_en

(6) Mission letter of the President of the European Commission to Stella Kyriakides, Commissioner for Health and Food Safety, https://commissioners.ec.europa.eu/system/files/2022-11/mission-letter-stella-kyriakides_en.pdf

(7) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).