New EU legislation applicable to EMA
EMA’s work is determined by its legal framework and throughout its history new pieces of legislation have often transformed the Agency’s remit and scope of activities. In 2019, EMA also had to work on the implementation of important pieces of new legislation together with the European Commission, the NCAs for medicines regulation, and other EU partners.
Veterinary medicines
The new Veterinary Medicines Regulation (Regulation (EU) 2019/6), which will become applicable on 28 January 2022, will modernise the existing rules on the authorisation and use of veterinary medicines to take account of the innovation taking place in the sector by, for example, reducing the administrative burden for applicants. It is aiming to increase the availability and safety of veterinary medicines and enhances EU action against antimicrobial resistance.
In 2019, EMA worked on the preparation of scientific and technical recommendations to feed into the delegated and implementing acts the EC is preparing as part of implementation of the Regulation. These are legally binding acts that supplement or amend EU laws (for example, defining detailed measures) and set conditions that ensure EU legislation is applied uniformly.
EMA’s recommendations are prepared by ad-hoc expert groups comprising members of the European network of experts and EMA staff, in collaboration with other EU bodies such as the European Centre for Disease Prevention and Control (ECDC) and European Food Safety Authority (EFSA), where necessary.
Some of the topics covered by the Agency’s recommendations last year were new requirements for the collection of data on the sales and use of antimicrobials in animals, which will complement the work already carried out by countries in the European Economic AreaiThe European Economic Area comprises the Member States of the EU and Iceland, Liechtenstein and Norway. (EEA) and Switzerland. This includes gathering data on sales of antibiotics, or developing an EU product database on veterinary medicines, which will provide information on all approved veterinary medicines and their availability in EU Member States.
To help stakeholders keep track of the upcoming changes, EMA launched a new webpage with information on EMA’s scientific and technical recommendations, as well as updates on other activities such as the preparation for implementation progress.
We prioritised work on the new veterinary legislation, despite EMA having to operate under business continuity conditions to safeguard core activities related to the evaluation and supervision of veterinary medicines. However, progress might be affected as the Agency will not only need time to rebuild its workforce after the relocation but may also have to absorb the new activities without a corresponding staffing increase.
Medical devices
Medical devices are regulated at the Member State level. The two new EU Regulations on medical devices – Regulation (EU) 2017/745 on medical devices and Regulation (EU) 2017/746 on in-vitro diagnostic medical devices – have given EMA and the NCAs new roles and more responsibilities. In February 2019, EMA published the first of a series of guidance documents to help applicants prepare for obligations stemming from the new Regulations, which will come into full effect in May 2020 and May 2022, respectively.
This first questions and answers (Q&A) document, developed jointly by EMA and the Co-ordination Group for Mutual Recognition and Decentralised Procedures - Human (CMDh), in close collaboration with the European Commission, focuses on implementation of Article 117 of the medical devices Regulation which stipulates that marketing authorisation applications for medicines with an integral medical device must include the results of the device’s assessment of conformity by a notified body.
Approximately one in four centrally authorised medicines includes a medical device component, and the majority of these involve an integral device. Examples include pre-filled syringes and pens, patches for transdermal drug delivery and pre-filled inhalers.
With the ever-increasing pace of innovation and the blurring of traditional boundaries between medicines and devices, it is inevitable for the Agency to assume new responsibilities in regulating complex medicines with a medical device component. The big challenge we face is to ensure we have the appropriate expertise and resources to adequately carry out these new tasks.
Data protection
The new Data Protection Regulation for EU institutions and bodies (Regulation (EU) 2018/1725), also known as EU DPR, entered into force on 11 December 2018. It ensures that the standards of data protection within EU institutions are in line with those provided for in the General Data Protection Regulation (GDPR), applicable to the public and private sector in the Member States.
EMA is reviewing its procedures to ensure that personal data processing activities are carried out in accordance with the new Regulation. In 2019, the Agency updated its privacy statements and the Data Processing Register, a repository of all data processing activities under its responsibility. These documents are available on EMA’s website and provide citizens with information on how their personal data is handled and how to exercise their rights. Of note, upon request by the European Data Protection Supervisor (EDPS), EMA has amended and published the privacy statement concerning our access-to-document procedures.
In October, a new cookie consent banner was also published on the website. Through the banner, users can choose which cookies they want to allow and find more information on how these are used by the Agency. EMA also implemented new technical measures to improve the security of the server where the website is hosted.
A new set of internal rules concerning restrictions of certain rights of data subjects (Article 25 of the EU DPR) in the context of administrative inquiries and disciplinary proceedings conducted by EMA was also approved and published in the Official Journal of the European Union. New implementing rules clarifying the role of the Data Protection Officer under the EU DPR were finalised. Moreover, EMA entrusted an external analyst to examine the security of its systems from a data protection perspective; recommendations for improvements have been received and will be analysed in 2020.
Training materials for staff dealing with personal data, including guidelines on how to manage a data breach and how to carry out data protection impact assessments, were developed throughout 2019.
In cooperation with the European Commission and in consultation with the EDPS, the Agency is undertaking an in-depth analysis of the legal basis for important processing activities, such as the secondary use of health data, the use of big health data and of artificial intelligence for regulatory purposes. The availability of adequate resources for full implementation of the EU DPR provisions remains a serious challenge and will be further discussed with the European Commission in 2020.