This is an HTML version of an attachment to the Freedom of Information request 'The 61st-90th Commission replies to confirmatory applications issued in 2019'.

In its initial reply dated 25 July 2018, the Directorate-General for Internal Market, 
Industry, Entrepreneurship and SMEs informed 
 that it had identified 2038 
National Competent Authority Reports issued by Germany between 2012 and 2018 as 
falling under the scope of the request. It further informed the applicant that these 
documents  ‘cover information pertaining to investigations performed by the German 
Competent Authorities active in the field of medical devices. These Authorities have the 
sole responsibility for market control in their territory’. 
It fully refused access to the National Competent Authority Reports pursuant to Article 
4(2), first indent (protection of commercial interests of a legal person), and Article 4(2), 
third indent (protection of the purpose of investigations) of Regulation (EC) No 
1049/2001. Furthermore, it referred to Article 20 of Council Directive 93/42/EEC of 14 
June 1993 concerning medical devices3  (‘Directive 93/42/EEC’) which provides for the 
confidentiality of certain information exchanged in the implementation of this Directive. 
In your confirmatory application you request a review of the position of the Directorate-
General for Internal Market, Industry, Entrepreneurship and SMEs. 
By letter of 7 September 2018, the Secretariat-General, as part of its confirmatory review, 
informed you that your application concerned 2038 documents that would need to be 
assessed individually. 
Consequently, in accordance with Article 6(3) of Regulation (EC) No 1049/2001, the 
Secretariat-General asked you to specify the objective of your request and your specific 
interest in the documents requested4 and whether you could significantly narrow down 
the scope of your request, so as to reduce it to a more manageable amount of documents. 
In this context, the Secretariat-General provided a detailed calculation regarding the 
estimated workload required for the various steps of the process. It explained to you in 
detail the administrative burden that the handling of your confirmatory application would 
With a view to reaching a fair solution concerning the handling of your confirmatory 
application, taking into account the amount of work already engendered by assessing the 
workload associated with the handling of your request, the Secretariat-General proposed, 
by letter dated 7 September 2018, to deal with a total number of 20 National Authority 
Reports from Germany. 
In his reply of 11 September 2018, 
 did not contest the administrative 
burden that the examination of the confirmatory application would entail and agreed to 
limit the scope of the request to 20 documents.  
After several further exchanges on the selection of documents corresponding to the 
objective of the request and 
 specific interest in the requested documents, 
3   Official Journal L 169, 12.7.1993, p. 1. A consolidated version is published as 1993L0042  —EN  —
11.10.2007— 005.001— 1. 
4   Judgment of the Court of Justice of 22 May 2012, EnBW Energie Baden-Württemberg v European 
Commission, T-344/08EU:T:2012:242, paragraph 105. 

 finally selected, by e-mail of 5 October 2018, 11 National Competent Authority 
Reports from the list of 20 documents provided to him by the Secretariat-General. 
In accordance with this selection, the scope of this confirmatory review covers the 
following National Competent Authority Reports: 
  report with the reference number INC-DE-15-02-000038/DE-BFARM-2015-01-
27-922 (hereafter ‘document 1’); 
  report with the reference number  INC-DE-15-07-000173/DE-BFARM-2015-07-
10-1104 (‘document 2’); 
  report with the reference number  INC-DE-16-08-000181/DE-BFARM-2016-08-
01-1554 (‘document 3’); 
  report with the reference number INC-DE-16-11-000240/DE-BFARM-2016-11-
04-1708 (‘document 4’); 
  report with the reference number INC-DE-16-11-000253/DE-BFARM-2016-11-
17-1738 (‘document 5’); 
  report with the reference number INC-DE-17-01-000007/DE-BFARM-2017-01-
04-1889 (‘document 6’); 
  report with the reference number INC-DE-17-08-000241/DE-BFARM-2017-08-
04-2228 (‘document 7’); 
  report with the reference number INC-DE-18-01-000010/DE-BFARM-2018-01-
09-2362 (‘document 8’); 
  report with the reference number INC-DE-18-07-000181/DE-BFARM-2018-07-
06-2533 (‘document 9’); 
  report with the reference number INC-DE-18-07-000188/DE-BFARM-2018-07-
19-2547 (‘document 10’); 
  report with the reference number INC-DE-18-08-000197/DE-BFARM-2018-07-
16-2543 (document 11). 
Every National Competent Authority Report includes a Field Safety Notice as attachment 
(‘documents 1.1 – 11.1’). Each Field Safety Notice is also published on the website of the 
Federal Agency for Medicinal Products and Medical Devices [Bundesamt für 
Arzneimittel und Medizinprodukte
You support your confirmatory application with several arguments that I have taken into 
account in my assessment, the results of which are described under point 2 below. 
5 Produktgruppe Formular html. 

When assessing a confirmatory application for access to documents submitted pursuant to 
Regulation (EC) No 1049/2001, the Secretariat-General conducts a fresh review of the 
reply given by the Directorate-General or service concerned at the initial stage. 
Following this review, and taking account of the opinion of the German authorities, from 
which the requested documents originate, I can inform you that wide partial access is 
granted to documents 1 and 3 – 11, as well as to documents 1.1 - 11.1, subject to the 
redaction of personal data only pursuant to Article 4(1)(b) (protection of privacy and the 
integrity of the individual) of Regulation (EC) No 1049/2001.  
Partial access is granted to document 2, also on the basis of Article 4(1)(b) and in 
addition pursuant to Article 4(2), first indent (protection of commercial interests of a 
natural or legal person) of Regulation (EC) No 1049/2001 (EC) No as well as on the basis 
of Article 20(1) of Directive 93/42/EEC and Article 15(1) of Council Directive 
90/385/EEC of 20 June 1990 on the approximation of the laws of the Member States 
relating to active implantable medical devices6 (‘Directive 90/385/EEC’). 
2.1.  Consultation of the German authorities 
In accordance with Article 4(4) of Regulation (EC) No 1049/2001, ‘as regards third-party 
documents, the institution shall consult the third party with a view to assessing whether 
an exception in paragraph 1 or 2 is applicable, unless it is clear that the document shall or 
shall not be disclosed’. According to Article 4(5) of Regulation (EC) No 1049/2001, ‘a 
Member State may request the institution not to disclose a document originating from that 
Member State without its prior agreement’. 
Under the provisions of Article 4(4) and (5) of Regulation (EC) No 1049/2001 and with a 
view to taking into account the arguments put forward in your confirmatory application, a 
third-party consultation of the German authorities was initiated by the Secretariat-General 
at confirmatory stage, as far as a potential public disclosure of the National Competent 
Authority Reports is concerned.  
2.1.1.  Protection of privacy and the integrity of the individual 
The German authorities agreed with wide partial disclosure of document 1 and 
documents 3 – 11, subject only to the redaction of personal data on the basis of Article 
4(1)(b) (protection of privacy and the integrity of the individual) of Regulation (EC) No 
6   Official Journal L 189, 20.7.1990, p. 1. A consolidated version is published as 1990L0385-EN-

2.1.2.  Protection of commercial interests 
Furthermore, with regard to document 2, the German authorities considered that, in 
addition to personal data, a part of the information contained under ‘Conclusions’ and 
forming part of the risk assessment of the  Federal Agency for Medicinal Products and 
Medical Devices [Bundesamt für Arzneimittel und Medizinprodukte] should not be 
disclosed, as public disclosure would undermine the commercial interests of the 
manufacturer of the medical device concerned and that this information was thus 
protected by Article 4(2), first indent (protection of commercial interests of a natural or 
legal person, including intellectual property) of Regulation (EC) No 1049/2001. 
In their reply, the German authorities pointed out that the relevant information constitutes 
an intermediate assessment of the Federal Agency for Medicinal Products and Medical 
Devices forming part of the risk assessment process of the medical device concerned that 
had been carried out in 2015. They further indicated that the problems which had been 
discussed between the Federal Agency for Medicinal Products and Medical Devices and 
the manufacturer had been solved in the meantime. They concluded that public disclosure 
of this intermediate assessment, in particular taken out of context, could however create 
the incorrect public perception that the medical device was still unsuitable or dangerous 
because of the initially detected risks. 
Confidentiality according to Article 20(2) of Directive 93/42/ECC 
The German authorities further stated that the intermediate assessment contained 
information which was to be kept confidential in accordance with Article 20(1) of 
Directive 93/42/EEC. 
2.2.  The European Commission's assessment 
2.2.1.  Protection of privacy and the integrity of the individual 
Article 4(1)(b) of Regulation (EC) No 1049/2001 provides that ‘access to a document is 
refused where disclosure would undermine the protection of […]  privacy and the 
integrity of the individual, in particular in accordance with Community legislation 
regarding the protection of personal data’. 
In its judgment in Case C-28/08 P (Bavarian Lager)7, the Court of Justice ruled that when 
a request is made for access to documents containing personal data, Regulation (EC) No 
45/2001 of the European Parliament and of the Council of 18 December 2000 
on the protection of individuals with regard to the processing of personal data by the 
Community institutions and bodies and on the free movement of such data8 
(‘Regulation (EC) 45/2001’) becomes fully applicable.  
7   Judgment of the Court of Justice of 29 June 2010, European Commission v The Bavarian Lager Co. 
Ltd,  (hereafter referred to as ‘European Commission v Bavarian Lager  judgment’), C-28/08 P, 
EU:C:2010:378, paragraph 59.  
8   Official Journal L 8 of 12 January 2001, page 1.  

As from 11 December 2018, Regulation (EC) No 45/2001 has been repealed by 
Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 
2018 on the protection of natural persons with regard to the processing of personal data 
by the Union institutions, bodies, offices and agencies and on the free movement of such 
data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC9 
(‘Regulation (EU) 2018/1725’). 
However, the case-law issued with regard to Regulation (EC) No 45/2001 remains 
relevant for the interpretation of Regulation (EU) 2018/1725. 
In the above-mentioned judgment the Court stated that Article 4(1)(b) of Regulation (EC) 
No 1049/2001 ‘requires that any undermining of privacy and the integrity of the 
individual must always be examined and assessed in conformity with the legislation of 
the Union concerning the protection of personal data, and in particular with […] [the Data 
Protection] Regulation’.10 
Article 3(1) of Regulation (EU) 2018/1725 provides that  personal data ‘means any 
information relating to an identified or identifiable natural person […]’.  
As the Court of Justice confirmed in Case C-465/00 (Rechnungshof), ‘there is no reason 
of principle to justify excluding activities of a professional […] nature from the notion of 
private life’.11 
All the National Competent Authority Reports as well as several annexes contain 
information such as names and contact details of individuals who are representatives of 
the responsible national authorities and of the manufacturers of the medical devices 
This information clearly constitutes personal data in the sense of Article 3(1) of 
Regulation (EU) 2018/1725.  
Pursuant to Article 9(1)(b) of Regulation (EU) 2018/1725, ‘personal data shall only be 
transmitted to recipients established in the Union other than Union institutions and bodies 
if  ‘[t]he recipient establishes that it is necessary to have the data transmitted for a 
specific purpose in the public interest and the controller, where there is any reason to 
assume that the data subject’s legitimate interests might be prejudiced, establishes that it 
is proportionate to transmit the personal data for that specific purpose after having 
demonstrably weighed the various competing interests’. 
Only if these conditions are fulfilled and the processing constitutes lawful processing in 
accordance with the requirements of Article 5 of Regulation (EU) 2018/1725, can the 
transmission of personal data occur. 
9   Official Journal L 205 of 21.11.2018, p. 39. 
10   European Commission v Bavarian Lager judgment, cited above, paragraph 59. 
11   Judgment of the Court of Justice of 20 May 2003, Rechnungshof v Österreichischer Rundfunk and 
Others, C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraph 73.  

In Case C-615/13 P (ClientEarth), the Court of Justice ruled that the institution does not 
have to examine of its own motion the existence of a need for transferring personal 
data.12 This is also clear from Article 9(1)(b) of Regulation (EU) 2018/1725, which 
requires that the necessity to have the personal data transmitted must be established by 
the recipient. 
According to Article 9(1)(b) of Regulation (EU) 2018/1725, the European Commission 
has to examine the further conditions for a lawful processing of personal data only if the 
first condition is fulfilled, namely if the recipient establishes that it is necessary to have 
the data transmitted for a specific purpose in the public interest. It is only in this case that 
the European Commission has to examine whether there is a reason to assume that the 
data subject’s legitimate interests might be prejudiced and, in the affirmative, establish 
the proportionality of the transmission of the personal data for that specific purpose after 
having demonstrably weighed the various competing interests. 
In your confirmatory application, you do not put forward any arguments to establish the 
necessity to have the data transmitted for a specific purpose in the public interest. 
Therefore, the European Commission does not have to examine whether there is a reason 
to assume that the data subject’s legitimate interests might be prejudiced. 
Notwithstanding the above, there are reasons to assume that the legitimate interests of the 
data subjects concerned would be prejudiced by disclosure of the personal data reflected 
in the documents, as there is a real and non-hypothetical risk that such public disclosure 
would harm their privacy and subject them to unsolicited external contacts.  
As to the handwritten signatures appearing in documents 3.1 and 5.1, which constitute 
biometric data, there is a risk that their disclosure would prejudice the legitimate interests 
of the persons concerned. 
Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation (EC) No 
1049/2001, access cannot be granted to the personal data, as the need to obtain access 
thereto for a purpose in the public interest has not been substantiated and there is no 
reason to think that the legitimate interests of the individuals concerned would not be 
prejudiced by disclosure of the personal data concerned.13 
2.2.2.  Protection of commercial interests 
Article 4(2), first indent of Regulation (EC) No 1049/2001 stipulates that ‘[t]he 
institutions shall refuse access to a document where disclosure would undermine the 
protection of  commercial interests of a natural or legal person, including intellectual 
property, […] unless there is an overriding public interest in disclosure’. 
12   Judgment of the Court of Justice of 16 July 2015, ClientEarth v European Food Safety Agency,  
C-615/13 P EU:C:2015:489, paragraph 47. 
13   Please note that in the version of several Field Safety Notices saved in the Eudamed database personal 
data has already been redacted by the German authorities.  

I have come to the conclusion that the arguments provided by the German authorities 
justify, at first sight, the refusal of access to the part of document 2 containing the 
intermediate assessment of the Federal Agency for Medicinal Products and Medical 
Indeed, the General Court clarified that ‘before refusing access to a document originating 
from a Member State, the institution concerned must examine whether that Member State 
has based its objection on the substantive exceptions in Article 4(1) to (3) of Regulation 
(EC) No 1049/2001 and has given proper reasons for its position. Consequently, when 
taking a decision to refuse access, the institution must make sure that those reasons exist 
and refer to them in the decision it makes at the end of the procedure’.14 
Furthermore, the General Court highlighted that ‘the institution to which a request for 
access to a document has been made does not have to carry out an exhaustive assessment 
of the Member State’s decision to object by conducting a review going beyond the 
verification of the mere existence of reasons referring to the exceptions in Article 4(1) to 
(3) of Regulation No 1049/2001. […] The institution must, however, check whether the 
explanations given by the Member State appear to it, prima facie, to be well founded’.15 
The part which should be protected  under ‘Conclusions’ in document 2 according to the 
German authorities, contains the intermediate risk assessment of the Federal Agency for 
Medicinal Products and Medical Devices which refers in a detailed way to issues in the 
context of the valve alignment of the medical device concerned (Edwards Commander 
Delivery System,
 Models 9610TF23, 9610TF26, 9610TF29)  that were still open after the 
first corrective action taken by the manufacturer in February 2015 (advice on action to be 
taken by the user) and also to the characteristics of the medical device in this context. 
However, these issues have been addressed by further corrective actions as described in 
document 2.1 (Field Safety Notice of August 2015), i.e. by an improved delivery system 
replacing the previous one. Public disclosure of the relevant part under ‘Conclusions’ 
containing the intermediate risk assessment referring to the situation before August 2015 
would engender the foreseeable and serious risk of putting into the public domain 
misleading information concerning the characteristics of the medical device at stake for 
which corrective action has been taken in the meantime. This, in turn, would result in 
erroneous conclusions regarding the safety of the latter. 
However, such erroneous conclusions on the safety of the medical device would have a 
negative effect on the reputation and public image of the manufacturer concerned.  
14   Judgment of the General Court of 8 February 2018, Pagkyprios Organismos Ageladotrofon v European 
Commission,  T-74/16, EU:T:2018:75, paragraph 55. (There is no German language version of this 
15   Ibid, paragraph 57, confirmed by the recent judgment of the General Court of 21 November 2018, 
Stichting Greenpeace Nederland and Pesticide Action Network Europe v European Commission,  
T-545/11 RENV EU:T:2018:817, paragraph 45. (There is no German language version of this 

Indeed, in a recent judgment, the General Court acknowledged that the reputation of a 
commercial undertaking is essential for the realisation of the latter’s economic activities 
on the market.16 
Moreover, the General Court confirmed on several occasions that the protection of a 
commercial undertaking's reputation can require the (partial) refusal of documents based 
on Article 4(2), first indent of Regulation (EC) No 1049/2001.17  
Against this background, I am of the view that public access to the redacted information 
in this specific context would have a negative effect on the reputation and public image of 
the manufacturer of the medical device, affecting the latter’s competitive position on the 
market of medical devices and thus its commercial interests.  
Having regard to the above, I consider that the use of the exception under Article 4(2), 
first indent of Regulation (EC) No 1049/2001 is prima facie justified and that access to 
the relevant part of document 2 must be refused on that basis.  
2.2.3.  Confidentiality according to Directives 93/42/EEC and 90/385/EEC 
Article 20(1) of Directive 93/42/EEC provides that ‘[w]ithout prejudice to the national 
provisions and practices on medical confidentiality, Member States shall ensure that all 
the Parties involved in the application of this Directive are bound to observe 
confidentiality with regard to all information obtained in carrying out their tasks’. 
Article 20(2) of this Directive defines the categories of information not to be treated as 
confidential, i.e. ‘information on the registration of persons responsible for placing 
devices on the market […]; information to users sent out by the manufacturer, authorised 
representative of distributor […]  [following an incident]; […] information contained in 
certificates issued, modified, supplemented, suspended or withdrawn’. 
Article 15(1) and (2) of Directive 90/385/EEC contain a corresponding regulation. 
The content of the intermediate assessment regarding the medical device concerned does 
not fall under one of the categories of information to be published according to the above-
mentioned relevant provisions. Consequently, I consider that the German authorities were 
entitled to qualify this information as confidential in accordance with Article 20(1) of 
Directive 93/42/EEC and Article 15(1) of Directive 90/385/EEC, respectively.  
No provision of Regulation (EC) No 1049/2001 and Directives 93/42/EEC and 
90/385/EEC expressly gives one piece of legislation priority over the other. ‘Accordingly, 
16   Judgment of the General Court 5 December 2018, Falcon Technologies International LLC v European 
Commission,  T-875/16,  EU:T:2018:877,  paragraph 51. (There is no German language version of this 
17    Ibid, paragraphs 52 and 53; judgments of  the General Court of 15 January 2013, Strack v European 
Commission,  T-392/07,  EU:T:2013:8, paragraph 228 and of 26 April 2016, Strack v European 
T-221/08, EU:T:2016:242, paragraph 210. 

it is appropriate to ensure that each of those […] [pieces of legislation] is applied in a 
manner compatible with the other and which enables a coherent application of them’.18 
Indeed, the General Court has found that ‘the rules on access to documents, particularly 
those set out in Article 4 of Regulation (EC) No 1049/2001, cannot where […] the 
documents covered by the application fall within a particular area of EU law […] [- in the 
case at hand the market surveillance and vigilance system concerning medical devices -] 
be applied and interpreted without taking account of the specific rules governing the 
transmission and use of the data contained in those documents’.19 
These specific rules are laid down in the present case in Article 20 of Directive 
93/42/EEC and Article 15 of Directive 90/385/EEC. As explained above, paragraph 1 of 
each of these provisions provides that the Member States shall ensure that all the Parties 
involved in the application of this Directive are bound to observe confidentiality with 
regard to all information which does not fall within the categories listed in paragraph 2 of 
each of these provisions.  
Against this background, I consider that it is prima facie justified that the German 
authorities invoked Article 20(1) of Directive 93/42/EEC and that access to the relevant 
part of document 2 must also be refused on that basis, together with Article 15(1) of 
Directive 90/385/EEC.  
In addition, I am of the view that the redacted parts in the section ‘Background 
information and reason for this report’ as well as the entire risk assessment contained in 
the section ‘Conclusions’ of document 2 have also to be withheld in accordance with the 
two above-mentioned provisions.  
Indeed, these parts reflect further confidential information on issues such as the 
functioning of the medical device and the content of discussions between the Federal 
Agency for Medicinal Products and Medical Devices and the manufacturer, which does 
not correspond to one of the categories described in Article 20(2) of Directive 93/42/EEC 
and Article 15(2) of Directive 90/385/EEC. This information is in particular not 
contained in the Field Safety Notices published in February and August 2015 by the 
Federal Agency for Medicinal Products and Medical Devices and it is therefore to be 
considered as pertaining to the internal and confidential communication between the 
relevant Parties in the framework of the market surveillance and vigilance system 
concerning medical devices, pursuant to Article 20(1) of Directive 93/42/EEC and 
Article15(1) of Directive 90/385/EEC. 
18   See for the similar relation between Regulation (EC) No 1049/2001 and Regulation (EC) No 
1224/2009  judgment of the General Court of 3 May 2018, Republic of Malta v European Commission
T-653/16, EU:T:2018:241, paragraph 137. (There is no German language version of this judgment). 
19   Ibid, paragraph 141. 

In accordance with Article 4(6) of Regulation (EC) No 1049/2001, (wide) partial access is 
hereby granted to the requested documents, as set out above. 
The exception laid down in Article 4(2), first indent of Regulation (EC) No 1049/2001 
must be waived if there is an overriding public interest in disclosure. Such an interest 
must, firstly, be public and, secondly, outweigh the harm caused by disclosure. 
In your confirmatory application, you refer to an overriding public interest in press 
coverage because these  ‘issues concern the health of millions of Europeans’,. 
You also refer to Regulation (EU) 2017/745 on medical devices20 which gives particular 
weight to transparency in your view.  
Apart from the fact that this Regulation will only be applicable as from 
26 May 2020, please note that its Article 109(2) also provides for confidentiality of 
commercially sensitive information unless there is a public interest in disclosure. 
Whilst I acknowledge the great importance of the issues at stake for the health and safety 
of the public in general and patients concerned in particular as well as the need for a high 
degree of transparency in the domain of medical devices, I consider that the efficient 
functioning of the market surveillance and vigilance system established by the relevant 
legal framework is in the public interest too.  
Indeed, the proper functioning of this system requires that commercially sensitive 
information as well as other confidential information can be exchanged between the 
national competent authorities of the Member States without public disclosure in order 
for them to have the full picture of the issues at stake. As explained above, the 
information concerned does not fall within a category of information which shall not be 
treated as confidential in accordance with Article 20(2) of Directive 93/42/EEC or Article 
15(2) of Directive 90/385/EEC, and consequently, confidentiality is required pursuant to 
paragraph 1 of each of these provisions. 
Finally, I am of the view that the public interest is fully served in the present case by 
disclosure of the other parts of  the National Competent Authority Report and the relating 
Field Safety Notice comprising relevant information for protecting the health and safety 
of the public. 
20  Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical 
devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 
1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC, Official Journal L 117, 5.5. 
2017, p. 1. 

I conclude, therefore, that the protection of the commercial interests as specified above as 
well as of the effective functioning of the market surveillance and vigilance system 
concerning medical devices as set out in Directives 93/42/EEC and 90/385/EEC prevails. 
Please note also that Article 4(1)(b) of Regulation (EC) No 1049/2001 has an absolute 
character and does not include the possibility to demonstrate the existence of an 
overriding public interest.  
I would like to draw your attention to the means of redress that are available against this 
decision concerning public access to the requested documents, that is, judicial 
proceedings and complaints to the Ombudsman under the conditions specified 
respectively in Articles 263 and 228 of the Treaty on the Functioning of the European 
Yours sincerely, 
For the Commission 

Enclosures: (22)