Changes from plenary report to adopted text

AddedThe Agency shall equip itself with a high level of security controls and processes against cyber attacks, cyber espionage and other data breaches to ensure the protection of health data and the normal functioning of the Agency at all times, especially during public health emergencies or major events at Union level.

AddedFor the purposes of the first subparagraph, the Agency shall actively identify and implementtake measures to ensure its compliance with a high common level of cybersecurity best practices adopted within Union institutions, bodies, offices and agencies, identify and implement up-to-date cybersecurity best practices for preventing, detecting, mitigating, and responding to cyber attacks. [Am. 344]

AddedArticle 168 Confidentiality

Added1. Unless otherwise provided for in this Regulation and without prejudice to Regulation (EC) No 1049/2001 and Directive (EU) 2019/1937 of the European Parliament and of the Council, and existing national provisions and practices in the Member States on confidentiality, all parties involved in the application of this Regulation shall respect the confidentiality of information and data obtained in carrying out their tasks in order to protect the commercially confidential information and trade secrets of natural or legal persons in accordance with Directive (EU) 2016/943 of the European Parliament and of the Council, including intellectual property rights. [Am. 345]

Added2. Without prejudice to paragraph 1, all parties involved in the application of this Regulation shall ensure that no commercially confidential information is shared in a way which has the potential to enable undertakings to restrict or distort competition within the meaning of Article 101 TFEU.

Added3. Without prejudice to paragraph 1, information exchanged on a confidential basis between competent authorities of the Member States and between competent authorities of the Member States and the Commission and the Agency shall not be disclosed without the prior agreement of the authority from which that information originates.

Added4. Paragraphs 1, 2 and 3 do not affect the rights and obligations of the Commission, the Agency, Member States or other actors identified in this Regulation with regard to the exchange of information and the dissemination of warnings, nor do they affect the obligations of the persons concerned to provide information under criminal law.

Added5. The Commission, the Agency, and Member States may exchange commercially confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements.

AddedArticle 169 Processing of personal data

Added1. The Agency may process personal data, including personal health data, for the performance of its tasks as referred to in Article 135, in particular for the purpose of improving the robustness of its scientific assessment or verifying claims of the applicant or marketing authorisation holder in the context of the evaluation or supervision of medicinal products.

AddedAdditionally, the Agency may process such data for the performance of regulatory science activities, as defined in paragraph 2, provided that the processing of those personal data:

Added(a) is strictly required and duly justified to achieve the objectives of the project or of the horizon scanning activities concerned;

Added(b) as regards special categories of personal data, is strictly necessary and subject to appropriate safeguards, which may include pseudonymisation requirements and techniques, data minimisation measures, specific organisational measures and access controls on a ‘need to know’ basis and other appropriate measures, confidentiality requirements, and fundamental rights of data subjects as set out in Regulations (EU) 2016/679 and (EU) 2018/1725. [Am. 346]

Added2. For the purpose of this Article, ‘regulatory science activities’ shall mean scientific projects to complement available scientific evidence with regard to diseases or horizontal questions related to medicinal products, to fill evidence gaps that cannot be fully addressed through data in the possession of the Agency, or to support horizon scanning activities.

Added3. The processing of personal data by the Agency in the context of this Article shall be guided by the principles of transparency, explainability, fairness, and accountability.

Added4. The Management Board shall establish the general scope for the regulatory science activities in consultation with the Commission and the European Data Protection Supervisor.

Added5. The Agency shall keep documentation containing a detailed description of the process and of the rationale behind the training, testing and validation of algorithms to ensure transparency of the process and the algorithms, including their compliance with the safeguards provided for in this Article, and to allow for verification of the accuracy of the results based on the use of such algorithms. Upon request, the Agency shall make relevant documentation available to interested parties, including Member States.

Added6. If the personal data to be processed for the regulatory science activities have been directly provided by a Member State, a Union body, a third country or an international organisation, the Agency shall request authorisation from that provider of data, unless the provider of data has granted its prior authorisation to such processing for the purpose of regulatory science activities, either in general terms or subject to specific conditions.

Added7. Processing of personal data under this Regulation shall be subject to Regulations (EU) 2016/679 and (EU) 2018/1725, as applicable.

AddedArticle 170 Evaluation

Added1. Not later than [note to OP = five years after the date of entry into application], and every 10 years thereafter, the Commission shall commission an evaluation of the Agency's performance in relation to its objectives, mandate, tasks, governance and location(s) in accordance with Commission's guidelines.

Added2. The evaluation shall, in particular, address the possible need to modify the mandate of the Agency, and the financial implications of any such modification.

Added3. On the occasion of every second evaluation, there shall be an assessment of the results achieved by the Agency having regard to its objectives, mandate, governance and tasks, including an assessment of whether the continuation of the Agency is still justified with regard to these objectives, mandate, governance and tasks. This assessment shall also include the experience acquired as a result of the operation of the procedures laid down in this Regulation and in Chapter III, Sections 4 and 5 of [revised Directive 2001/83/EC] on the basis of input from Member States and the Coordination group referred to in Article 37 of [revised Directive 2001/83/EC].

Added4. The Commission shall report to the European Parliament, the Council and the Management Board on the evaluation findings. The findings of the evaluation shall be made public.

Added5. By 10 years following the entering into application, the Commission shall assess the application of this Regulation and produce an evaluation report on the progress towards achievement of the objectives contained herein including an assessment of the resources required to implement this Regulation.

AddedCHAPTER XII GENERAL PROVISIONS

AddedArticle 171 Penalties at national level

Added1. By ... [12 months from the date of entry into force of this Regulation], Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, without delay, notify the Commission of those rules and of those measures and shall notify it, without delay, of any subsequent amendment affecting them. [Am. 347]

Added2. Member States shall inform the Commission immediately of any litigation instituted for infringement of this Regulation.

AddedArticle 172 Union penalties

Added1. The Commission may impose financial penalties in the form of fines or periodic penalty payments on the marketing authorisations holder granted under this Regulation if they fail to comply with any of the obligations laid down in Annex II in connection with the marketing authorisations.

Added2. The Commission may, insofar as specifically provided for in the delegated acts referred to in paragraph 10, point (b), impose the financial penalties referred to in paragraph 1 on a legal entity or legal entities other than the marketing authorisation holder provided that such entities form part of the same economic entity as the marketing authorisation holder and that such other legal entities:

Added(a) exerted a decisive influence over the marketing authorisation holder; or

Added(b) were involved in, or could have addressed, such failure to comply with the obligation by the marketing authorisation holder.

Added3. Where the Agency or a competent authority of a Member State is of the opinion that a marketing authorisation holder has failed to comply with any of the obligations, referred to in paragraph 1, it may request the Commission to investigate whether to impose financial penalties pursuant to that paragraph.

Added4. In determining whether to impose a financial penalty and in determining its appropriate amount, the Commission shall be guided by the principles of effectiveness, proportionality and dissuasiveness and take into consideration, where relevant, the seriousness and the effects of the failure to comply with the obligations.

Added5. For the purposes of paragraph 1, the Commission shall take into account:

Added(a) any infringement procedure initiated by a Member State against the same marketing authorisation holder on the basis of the same legal grounds and the same facts;

Added(b) any sanctions, including penalties, already imposed on the same marketing authorisation holder on the basis of the same legal grounds and the same facts.

Added(ba) the nature, gravity and duration of the infringement and of its consequences, taking into account the scope as well as the number of persons affected and the level of damage suffered by them; [Am. 348]

Added(bb) the size and market share of the entity committing the infringement; [Am. 349]

Added(bc) the intentional or negligent character of the infringement; [Am. 350]

Added(bd) any action taken by the infringing party to mitigate the damage caused by the infringement; [Am. 351]

Added(be) the degree of responsibility of the infringing party taking into account technical and organisational measures implemented to prevent the infringement; [Am. 352]

Added(bf) the degree of cooperation with the competent authorities, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; [Am. 353]

Added(bg) the manner in which the infringement became known to the competent authorities, in particular whether, and if so to what extent, the infringing party notified the infringement; [Am. 354]

Added(bh) the risk to public health, including in the case of falsification of medicinal products. [Am. 355]

Added6. Where the Commission finds that the marketing authorisation holder has failed, intentionally or negligently, to comply with its obligations, as referred to in paragraph 1, it may adopt a decision imposing a fine not exceeding 5 % of the marketing authorisation holder’s Union turnover in the business year preceding the date of that decision.

AddedWhere the marketing authorisation holder continues to fail to comply with its obligations referred to in paragraph 1, the Commission may adopt a decision imposing periodic penalty payments per day not exceeding 2,5 % of the marketing authorisation holder’s average daily Union turnover in the business year preceding the date of that decision.

AddedPeriodic penalty payments may be imposed for a period running from the date of notification of the relevant Commission's decision until the failure to comply with the obligation by the marketing authorisation holder, as referred to in paragraph 1, has been brought to an end.

Added7. When conducting the investigation on a failure to comply with any of the obligations referred to in paragraph 1, the Commission may cooperate with competent authorities of the Member States and rely on resources provided by the Agency.

Added8. Where the Commission adopts a decision imposing a financial penalty, it shall publish a concise summary of the case, including the names of the marketing authorisation holders involved and the amounts of and reasons for the financial penalties imposed, having regard to the legitimate interest of the marketing authorisation holders for the protection of their business secrets.

Added9. The Court of Justice of the European Union shall have unlimited jurisdiction to review decisions whereby the Commission has imposed financial penalties. The Court of Justice of the European Union may cancel, reduce or increase the fine or periodic penalty payment imposed by the Commission.

Added10. The Commission is empowered to adopt delegated acts in accordance with Article 175 in order to supplement this Regulation by laying down:

Added(a) procedures to be applied by the Commission when imposing fines or periodic penalty payments, including rules on the initiation of the procedure, measures of inquiry, rights of the defence, access to file, legal representation and confidentiality;

Added(b) further detailed rules on the imposition by the Commission of financial penalties on legal entities other than the marketing authorisation holder;

Added(c) rules on duration of procedure and limitation periods;

Added(d) elements to be taken into account by the Commission when setting the level of and imposing fines and periodic penalty payments, as well as the conditions and methods for their collection.

AddedCHAPTER XIII DELEGATED AND IMPLEMENTING ACTS

AddedArticle 173 Standing Committee on Medicinal Products for Human Use and examination procedure