In its initial reply dated 25 July 2018, the Directorate-General for Internal Market,
Industry, Entrepreneurship and SMEs informed
that it had identified 2038
National Competent Authority Reports issued by Germany between 2012 and 2018 as
falling under the scope of the request. It further informed the applicant that these
documents ‘cover information pertaining to investigations performed by the German
Competent Authorities active in the field of medical devices. These Authorities have the
sole responsibility for market control in their territory’.
It fully refused access to the National Competent Authority Reports pursuant to Article
4(2), first indent (protection of commercial interests of a legal person), and Article 4(2),
third indent (protection of the purpose of investigations) of Regulation (EC) No
1049/2001. Furthermore, it referred to Article 20 of Council Directive 93/42/EEC of 14
June 1993 concerning medical devices3 (‘Directive 93/42/EEC’) which provides for the
confidentiality of certain information exchanged in the implementation of this Directive.
In your confirmatory application you request a review of the position of the Directorate-
General for Internal Market, Industry, Entrepreneurship and SMEs.
By letter of 7 September 2018, the Secretariat-General, as part of its confirmatory review,
informed you that your application concerned 2038 documents that would need to be
assessed individually.
Consequently, in accordance with Article 6(3) of Regulation (EC) No 1049/2001, the
Secretariat-General asked you to specify the objective of your request and your specific
interest in the documents requested4 and whether you could significantly narrow down
the scope of your request, so as to reduce it to a more manageable amount of documents.
In this context, the Secretariat-General provided a detailed calculation regarding the
estimated workload required for the various steps of the process. It explained to you in
detail the administrative burden that the handling of your confirmatory application would
entail.
With a view to reaching a fair solution concerning the handling of your confirmatory
application, taking into account the amount of work already engendered by assessing the
workload associated with the handling of your request, the Secretariat-General proposed,
by letter dated 7 September 2018, to deal with a total number of 20 National Authority
Reports from Germany.
In his reply of 11 September 2018,
did not contest the administrative
burden that the examination of the confirmatory application would entail and agreed to
limit the scope of the request to 20 documents.
After several further exchanges on the selection of documents corresponding to the
objective of the request and
specific interest in the requested documents,
3 Official Journal L 169, 12.7.1993, p. 1. A consolidated version is published as 1993L0042 —EN —
11.10.2007— 005.001— 1.
4 Judgment of the Court of Justice of 22 May 2012,
EnBW Energie Baden-Württemberg v European
Commission, T-344/08EU:T:2012:242, paragraph 105.
2
finally selected, by e-mail of 5 October 2018, 11 National Competent Authority
Reports from the list of 20 documents provided to him by the Secretariat-General.
In accordance with this selection, the scope of this confirmatory review covers the
following National Competent Authority Reports:
report with the reference number INC-DE-15-02-000038/DE-BFARM-2015-01-
27-922 (hereafter ‘document 1’);
report with the reference number INC-DE-15-07-000173/DE-BFARM-2015-07-
10-1104 (‘document 2’);
report with the reference number INC-DE-16-08-000181/DE-BFARM-2016-08-
01-1554 (‘document 3’);
report with the reference number INC-DE-16-11-000240/DE-BFARM-2016-11-
04-1708 (‘document 4’);
report with the reference number INC-DE-16-11-000253/DE-BFARM-2016-11-
17-1738 (‘document 5’);
report with the reference number INC-DE-17-01-000007/DE-BFARM-2017-01-
04-1889 (‘document 6’);
report with the reference number INC-DE-17-08-000241/DE-BFARM-2017-08-
04-2228 (‘document 7’);
report with the reference number INC-DE-18-01-000010/DE-BFARM-2018-01-
09-2362 (‘document 8’);
report with the reference number INC-DE-18-07-000181/DE-BFARM-2018-07-
06-2533 (‘document 9’);
report with the reference number INC-DE-18-07-000188/DE-BFARM-2018-07-
19-2547 (‘document 10’);
and
report with the reference number INC-DE-18-08-000197/DE-BFARM-2018-07-
16-2543 (document 11).
Every National Competent Authority Report includes a Field Safety Notice as attachment
(‘documents 1.1 – 11.1’). Each Field Safety Notice is also published on the website of the
Federal Agency for Medicinal Products and Medical Devices [
Bundesamt für
Arzneimittel und Medizinprodukte]5.
You support your confirmatory application with several arguments that I have taken into
account in my assessment, the results of which are described under point 2 below.
5 https://www.bfarm.de/SiteGlobals/Forms/Suche/Filtersuche Produktgruppe Formular html.
3
2.
ASSESSMENT AND CONCLUSIONS UNDER REGULATION (EC) NO 1049/2001
When assessing a confirmatory application for access to documents submitted pursuant to
Regulation (EC) No 1049/2001, the Secretariat-General conducts a fresh review of the
reply given by the Directorate-General or service concerned at the initial stage.
Following this review, and taking account of the opinion of the German authorities, from
which the requested documents originate, I can inform you that wide partial access is
granted to documents 1 and 3 – 11, as well as to documents 1.1 - 11.1, subject to the
redaction of personal data only pursuant to Article 4(1)(b) (protection of privacy and the
integrity of the individual) of Regulation (EC) No 1049/2001.
Partial access is granted to document 2, also on the basis of Article 4(1)(b) and in
addition pursuant to Article 4(2), first indent (protection of commercial interests of a
natural or legal person) of Regulation (EC) No 1049/2001 (EC) No as well as on the basis
of Article 20(1) of Directive 93/42/EEC and Article 15(1) of Council Directive
90/385/EEC of 20 June 1990 on the approximation of the laws of the Member States
relating to active implantable medical devices6 (‘Directive 90/385/EEC’).
2.1. Consultation of the German authorities
In accordance with Article 4(4) of Regulation (EC) No 1049/2001, ‘as regards third-party
documents, the institution shall consult the third party with a view to assessing whether
an exception in paragraph 1 or 2 is applicable, unless it is clear that the document shall or
shall not be disclosed’. According to Article 4(5) of Regulation (EC) No 1049/2001, ‘a
Member State may request the institution not to disclose a document originating from that
Member State without its prior agreement’.
Under the provisions of Article 4(4) and (5) of Regulation (EC) No 1049/2001 and with a
view to taking into account the arguments put forward in your confirmatory application, a
third-party consultation of the German authorities was initiated by the Secretariat-General
at confirmatory stage, as far as a potential public disclosure of the National Competent
Authority Reports is concerned.
2.1.1. Protection of privacy and the integrity of the individual
The German authorities agreed with wide partial disclosure of document 1 and
documents 3 – 11, subject only to the redaction of personal data on the basis of Article
4(1)(b) (protection of privacy and the integrity of the individual) of Regulation (EC) No
1049/2001.
6 Official Journal L 189, 20.7.1990, p. 1. A consolidated version is published as 1990L0385-EN-
11.10.2007-003.001-1.
4
2.1.2. Protection of commercial interests
Furthermore, with regard to document 2, the German authorities considered that, in
addition to personal data, a part of the information contained under ‘Conclusions’ and
forming part of the risk assessment of the Federal Agency for Medicinal Products and
Medical Devices [
Bundesamt für Arzneimittel und Medizinprodukte] should not be
disclosed, as public disclosure would undermine the commercial interests of the
manufacturer of the medical device concerned and that this information was thus
protected by Article 4(2), first indent (protection of commercial interests of a natural or
legal person, including intellectual property) of Regulation (EC) No 1049/2001.
In their reply, the German authorities pointed out that the relevant information constitutes
an intermediate assessment of the Federal Agency for Medicinal Products and Medical
Devices forming part of the risk assessment process of the medical device concerned that
had been carried out in 2015. They further indicated that the problems which had been
discussed between the Federal Agency for Medicinal Products and Medical Devices and
the manufacturer had been solved in the meantime. They concluded that public disclosure
of this intermediate assessment, in particular taken out of context, could however create
the incorrect public perception that the medical device was still unsuitable or dangerous
because of the initially detected risks.
2.1.3.
Confidentiality according to Article 20(2) of Directive 93/42/ECC
The German authorities further stated that the intermediate assessment contained
information which was to be kept confidential in accordance with Article 20(1) of
Directive 93/42/EEC.
2.2. The European Commission's assessment
2.2.1. Protection of privacy and the integrity of the individual
Article 4(1)(b) of Regulation (EC) No 1049/2001 provides that ‘access to a document is
refused where disclosure would undermine the protection of […] privacy and the
integrity of the individual, in particular in accordance with Community legislation
regarding the protection of personal data’.
In its judgment in Case C-28/08 P
(Bavarian Lager)7, the Court of Justice ruled that when
a request is made for access to documents containing personal data, Regulation (EC) No
45/2001 of the European Parliament and of the Council of 18 December 2000
on the protection of individuals with regard to the processing of personal data by the
Community institutions and bodies and on the free movement of such data8
(‘Regulation (EC) 45/2001’) becomes fully applicable.
7 Judgment of the Court of Justice of 29 June 2010,
European Commission v The Bavarian Lager Co.
Ltd, (hereafter referred to as ‘
European Commission v Bavarian Lager judgment’), C-28/08 P,
EU:C:2010:378, paragraph 59.
8 Official Journal L 8 of 12 January 2001, page 1.
5
As from 11 December 2018, Regulation (EC) No 45/2001 has been repealed by
Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October
2018 on the protection of natural persons with regard to the processing of personal data
by the Union institutions, bodies, offices and agencies and on the free movement of such
data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC9
(‘Regulation (EU) 2018/1725’).
However, the case-law issued with regard to Regulation (EC) No 45/2001 remains
relevant for the interpretation of Regulation (EU) 2018/1725.
In the above-mentioned judgment the Court stated that Article 4(1)(b) of Regulation (EC)
No 1049/2001 ‘requires that any undermining of privacy and the integrity of the
individual must always be examined and assessed in conformity with the legislation of
the Union concerning the protection of personal data, and in particular with […] [the Data
Protection] Regulation’.10
Article 3(1) of Regulation (EU) 2018/1725 provides that
personal data ‘means any
information relating to an identified or identifiable natural person […]’.
As the Court of Justice confirmed in Case C-465/00 (
Rechnungshof), ‘there is no reason
of principle to justify excluding activities of a professional […] nature from the notion of
private life’.11
All the National Competent Authority Reports as well as several annexes contain
information such as names and contact details of individuals who are representatives of
the responsible national authorities and of the manufacturers of the medical devices
concerned.
This information clearly constitutes personal data in the sense of Article 3(1) of
Regulation (EU) 2018/1725.
Pursuant to Article 9(1)(b) of Regulation (EU) 2018/1725, ‘personal data shall only be
transmitted to recipients established in the Union other than Union institutions and bodies
if ‘[t]he recipient establishes that it is necessary to have the data transmitted for a
specific purpose in the public interest and the controller, where there is any reason to
assume that the data subject’s legitimate interests might be prejudiced, establishes that it
is proportionate to transmit the personal data for that specific purpose after having
demonstrably weighed the various competing interests’.
Only if these conditions are fulfilled and the processing constitutes lawful processing in
accordance with the requirements of Article 5 of Regulation (EU) 2018/1725, can the
transmission of personal data occur.
9 Official Journal L 205 of 21.11.2018, p. 39.
10
European Commission v Bavarian Lager judgment, cited above, paragraph 59.
11 Judgment of the Court of Justice of 20 May 2003,
Rechnungshof v Österreichischer Rundfunk and
Others, C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraph 73.
6
In Case C-615/13 P
(ClientEarth), the Court of Justice ruled that the institution does not
have to examine of its own motion the existence of a need for transferring personal
data.12 This is also clear from Article 9(1)(b) of Regulation (EU) 2018/1725, which
requires that the necessity to have the personal data transmitted must be established by
the recipient.
According to Article 9(1)(b) of Regulation (EU) 2018/1725, the European Commission
has to examine the further conditions for a lawful processing of personal data only if the
first condition is fulfilled, namely if the recipient establishes that it is necessary to have
the data transmitted for a specific purpose in the public interest. It is only in this case that
the European Commission has to examine whether there is a reason to assume that the
data subject’s legitimate interests might be prejudiced and, in the affirmative, establish
the proportionality of the transmission of the personal data for that specific purpose after
having demonstrably weighed the various competing interests.
In your confirmatory application, you do not put forward any arguments to establish the
necessity to have the data transmitted for a specific purpose in the public interest.
Therefore, the European Commission does not have to examine whether there is a reason
to assume that the data subject’s legitimate interests might be prejudiced.
Notwithstanding the above, there are reasons to assume that the legitimate interests of the
data subjects concerned would be prejudiced by disclosure of the personal data reflected
in the documents, as there is a real and non-hypothetical risk that such public disclosure
would harm their privacy and subject them to unsolicited external contacts.
As to the handwritten signatures appearing in documents 3.1 and 5.1, which constitute
biometric data, there is a risk that their disclosure would prejudice the legitimate interests
of the persons concerned.
Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation (EC) No
1049/2001, access cannot be granted to the personal data, as the need to obtain access
thereto for a purpose in the public interest has not been substantiated and there is no
reason to think that the legitimate interests of the individuals concerned would not be
prejudiced by disclosure of the personal data concerned.13
2.2.2. Protection of commercial interests
Article 4(2), first indent of Regulation (EC) No 1049/2001 stipulates that ‘[t]he
institutions shall refuse access to a document where disclosure would undermine the
protection of commercial interests of a natural or legal person, including intellectual
property, […] unless there is an overriding public interest in disclosure’.
12 Judgment of the Court of Justice of 16 July 2015,
ClientEarth v European Food Safety Agency,
C-615/13 P EU:C:2015:489, paragraph 47.
13 Please note that in the version of several Field Safety Notices saved in the
Eudamed database personal
data has already been redacted by the German authorities.
7
I have come to the conclusion that the arguments provided by the German authorities
justify, at first sight, the refusal of access to the part of document 2 containing the
intermediate assessment of the Federal Agency for Medicinal Products and Medical
Devices.
Indeed, the General Court clarified that ‘before refusing access to a document originating
from a Member State, the institution concerned must examine whether that Member State
has based its objection on the substantive exceptions in Article 4(1) to (3) of Regulation
(EC) No 1049/2001 and has given proper reasons for its position. Consequently, when
taking a decision to refuse access, the institution must make sure that those reasons exist
and refer to them in the decision it makes at the end of the procedure’.14
Furthermore, the General Court highlighted that ‘the institution to which a request for
access to a document has been made does not have to carry out an exhaustive assessment
of the Member State’s decision to object by conducting a review going beyond the
verification of the mere existence of reasons referring to the exceptions in Article 4(1) to
(3) of Regulation No 1049/2001. […] The institution must, however, check whether the
explanations given by the Member State appear to it, prima facie, to be well founded’.15
The part which should be protected under ‘Conclusions’ in document 2 according to the
German authorities, contains the intermediate risk assessment of the Federal Agency for
Medicinal Products and Medical Devices which refers in a detailed way to issues in the
context of the valve alignment of the medical device concerned (
Edwards Commander
Delivery System, Models 9610TF23, 9610TF26, 9610TF29) that were still open after the
first corrective action taken by the manufacturer in February 2015 (advice on action to be
taken by the user) and also to the characteristics of the medical device in this context.
However, these issues have been addressed by further corrective actions as described in
document 2.1 (Field Safety Notice of August 2015), i.e. by an improved delivery system
replacing the previous one. Public disclosure of the relevant part under ‘Conclusions’
containing the intermediate risk assessment referring to the situation before August 2015
would engender the foreseeable and serious risk of putting into the public domain
misleading information concerning the characteristics of the medical device at stake for
which corrective action has been taken in the meantime. This, in turn, would result in
erroneous conclusions regarding the safety of the latter.
However, such erroneous conclusions on the safety of the medical device would have a
negative effect on the reputation and public image of the manufacturer concerned.
14 Judgment of the General Court of 8 February 2018,
Pagkyprios Organismos Ageladotrofon v European
Commission, T-74/16, EU:T:2018:75, paragraph 55. (There is no German language version of this
judgment).
15
Ibid, paragraph 57, confirmed by the recent judgment of the General Court of 21 November 2018,
Stichting Greenpeace Nederland and Pesticide Action Network Europe v European Commission,
T-545/11 RENV EU:T:2018:817, paragraph 45. (There is no German language version of this
judgment).
8
Indeed, in a recent judgment, the General Court acknowledged that the reputation of a
commercial undertaking is essential for the realisation of the latter’s economic activities
on the market.16
Moreover, the General Court confirmed on several occasions that the protection of a
commercial undertaking's reputation can require the (partial) refusal of documents based
on Article 4(2), first indent of Regulation (EC) No 1049/2001.17
Against this background, I am of the view that public access to the redacted information
in this specific context would have a negative effect on the reputation and public image of
the manufacturer of the medical device, affecting the latter’s competitive position on the
market of medical devices and thus its commercial interests.
Having regard to the above, I consider that the use of the exception under Article 4(2),
first indent of Regulation (EC) No 1049/2001 is
prima facie justified and that access to
the relevant part of document 2 must be refused on that basis.
2.2.3. Confidentiality according to Directives 93/42/EEC and 90/385/EEC
Article 20(1) of Directive 93/42/EEC provides that ‘[w]ithout prejudice to the national
provisions and practices on medical confidentiality, Member States shall ensure that all
the Parties involved in the application of this Directive are bound to observe
confidentiality with regard to all information obtained in carrying out their tasks’.
Article 20(2) of this Directive defines the categories of information not to be treated as
confidential, i.e. ‘information on the registration of persons responsible for placing
devices on the market […]; information to users sent out by the manufacturer, authorised
representative of distributor […] [following an incident]; […] information contained in
certificates issued, modified, supplemented, suspended or withdrawn’.
Article 15(1) and (2) of Directive 90/385/EEC contain a corresponding regulation.
The content of the intermediate assessment regarding the medical device concerned does
not fall under one of the categories of information to be published according to the above-
mentioned relevant provisions. Consequently, I consider that the German authorities were
entitled to qualify this information as confidential in accordance with Article 20(1) of
Directive 93/42/EEC and Article 15(1) of Directive 90/385/EEC, respectively.
No provision of Regulation (EC) No 1049/2001 and Directives 93/42/EEC and
90/385/EEC expressly gives one piece of legislation priority over the other. ‘Accordingly,
16 Judgment of the General Court 5 December 2018,
Falcon Technologies International LLC v European
Commission, T-875/16, EU:T:2018:877, paragraph 51. (There is no German language version of this
judgment).
17
Ibid, paragraphs 52 and 53; judgments of the General Court of 15 January 2013,
Strack v European
Commission, T-392/07, EU:T:2013:8, paragraph 228 and of 26 April 2016,
Strack v European
Commission, T-221/08, EU:T:2016:242, paragraph 210.
9
it is appropriate to ensure that each of those […] [pieces of legislation] is applied in a
manner compatible with the other and which enables a coherent application of them’.18
Indeed, the General Court has found that ‘the rules on access to documents, particularly
those set out in Article 4 of Regulation (EC) No 1049/2001, cannot where […] the
documents covered by the application fall within a particular area of EU law […] [- in the
case at hand the market surveillance and vigilance system concerning medical devices -]
be applied and interpreted without taking account of the specific rules governing the
transmission and use of the data contained in those documents’.19
These specific rules are laid down in the present case in Article 20 of Directive
93/42/EEC and Article 15 of Directive 90/385/EEC. As explained above, paragraph 1 of
each of these provisions provides that the Member States shall ensure that all the Parties
involved in the application of this Directive are bound to observe confidentiality with
regard to all information which does not fall within the categories listed in paragraph 2 of
each of these provisions.
Against this background, I consider that it is
prima facie justified that the German
authorities invoked Article 20(1) of Directive 93/42/EEC and that access to the relevant
part of document 2 must also be refused on that basis, together with Article 15(1) of
Directive 90/385/EEC.
In addition, I am of the view that the redacted parts in the section ‘Background
information and reason for this report’ as well as the entire risk assessment contained in
the section ‘Conclusions’ of document 2 have also to be withheld in accordance with the
two above-mentioned provisions.
Indeed, these parts reflect further confidential information on issues such as the
functioning of the medical device and the content of discussions between the Federal
Agency for Medicinal Products and Medical Devices and the manufacturer, which does
not correspond to one of the categories described in Article 20(2) of Directive 93/42/EEC
and Article 15(2) of Directive 90/385/EEC. This information is in particular not
contained in the Field Safety Notices published in February and August 2015 by the
Federal Agency for Medicinal Products and Medical Devices and it is therefore to be
considered as pertaining to the internal and confidential communication between the
relevant Parties in the framework of the market surveillance and vigilance system
concerning medical devices, pursuant to Article 20(1) of Directive 93/42/EEC and
Article15(1) of Directive 90/385/EEC.
18 See for the similar relation between Regulation (EC) No 1049/2001 and Regulation (EC) No
1224/2009 judgment of the General Court of 3 May 2018,
Republic of Malta v European Commission,
T-653/16, EU:T:2018:241, paragraph 137. (There is no German language version of this judgment).
19
Ibid, paragraph 141.
10
3. PARTIAL ACCESS
In accordance with Article 4(6) of Regulation (EC) No 1049/2001, (wide) partial access is
hereby granted to the requested documents, as set out above.
4. OVERRIDING PUBLIC INTEREST IN DISCLOSURE
The exception laid down in Article 4(2), first indent of Regulation (EC) No 1049/2001
must be waived if there is an overriding public interest in disclosure. Such an interest
must, firstly, be public and, secondly, outweigh the harm caused by disclosure.
In your confirmatory application, you refer to an overriding public interest in press
coverage because these ‘issues concern the health of millions of Europeans’,.
You also refer to Regulation (EU) 2017/745 on medical devices20 which gives particular
weight to transparency in your view.
Apart from the fact that this Regulation will only be applicable as from
26 May 2020, please note that its Article 109(2) also provides for confidentiality of
commercially sensitive information unless there is a public interest in disclosure.
Whilst I acknowledge the great importance of the issues at stake for the health and safety
of the public in general and patients concerned in particular as well as the need for a high
degree of transparency in the domain of medical devices, I consider that the efficient
functioning of the market surveillance and vigilance system established by the relevant
legal framework is in the public interest too.
Indeed, the proper functioning of this system requires that commercially sensitive
information as well as other confidential information can be exchanged between the
national competent authorities of the Member States without public disclosure in order
for them to have the full picture of the issues at stake. As explained above, the
information concerned does not fall within a category of information which shall not be
treated as confidential in accordance with Article 20(2) of Directive 93/42/EEC or Article
15(2) of Directive 90/385/EEC, and consequently, confidentiality is required pursuant to
paragraph 1 of each of these provisions.
Finally, I am of the view that the public interest is fully served in the present case by
disclosure of the other parts of the National Competent Authority Report and the relating
Field Safety Notice comprising relevant information for protecting the health and safety
of the public.
20 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical
devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No
1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC, Official Journal L 117, 5.5.
2017, p. 1.
11
I conclude, therefore, that the protection of the commercial interests as specified above as
well as of the effective functioning of the market surveillance and vigilance system
concerning medical devices as set out in Directives 93/42/EEC and 90/385/EEC prevails.
Please note also that Article 4(1)(b) of Regulation (EC) No 1049/2001 has an absolute
character and does not include the possibility to demonstrate the existence of an
overriding public interest.
5. MEANS OF REDRESS
I would like to draw your attention to the means of redress that are available against this
decision concerning public access to the requested documents, that is, judicial
proceedings and complaints to the Ombudsman under the conditions specified
respectively in Articles 263 and 228 of the Treaty on the Functioning of the European
Union.
Yours sincerely,
For the Commission
Martin SELMAYR
Secretary-General
Enclosures: (22)
12