A little over six months after the entry into force of the Implementing Regulation 2016/9 on Joint Submission and Data Sharing in the context of REACH, a series of problems arise that companies should be aware of and prepare for.

Some of the essential elements of the data sharing system set up under REACH are challenged in particular by consultants who are seeking to sell to their customers, often non-EU companies, a "cheaper" access to EU registration by exploiting the gaps in the data sharing framework. These essential elements include (1) the obligation to share available data and respond to requests for data, (2) the duly justification of opt-outs and (3) the verification that registrants are in legitimate possession or have a right to refer to the studies they refer to, which is closely connected with (4) the protection of the intellectual property rights of data owners.

As in the past, ECHA is taking "data sharing disputes" and seeking to verify whether the parties have made "every effort" to reach an agreement on the sharing of data requested and if not may grant the prospective registrant with access to registered data. With the Implementing Regulation, these discussions are getting more difficult, with potential registrants or their consultants using the right now explicitly recognized in the Implementing Regulation for an "itemization" (and a justification) of the data and administrative costs to contest such costs and push lead registrants into the corner.

When ECHA grants access to registered studies on the basis of its judgement that the lead registrant has not made "every effort" it does not verify who owns the registered data which then puts the lead registrants and data owners in an awkward situation when seeking to obtain compensation for the access granted by ECHA.

Furthermore, since the Implementation Regulation has made clear that ECHA should also ensure the appropriate implementation of the OSOR principle, including the joint submission of data also in case of a full opt-out, some companies/consultants are now not only refusing to pay their share of the costs in the form of a letter of access, but request only the token from the Lead Registrant on the basis that they will opt-out from all end-points for which information has been jointly submitted by existing registrants. In what becomes "joint submission disputes" (sometimes, as if by chance, in mid-summer), when ECHA receives a complaint, it requests the parties to demonstrate they made "every effort" to reach and agreement on access to the joint submission in a fair, transparent and non-discriminatory manner and threatens to grant prospective registrants the token that the lead registrant refuses to grant them, if the former has made every effort.

This is a very dangerous development, in particular when considering "Wikipedia registrants", who may receive a token and register in breach of all the principles mentioned above, and in particular with a lack of legitimate rights to refer to full study reports, with no guarantee for the lead registrant that ECHA will verify the new "registration". They would have no other choice but to appeal the ECHA decision before the Board of Appeal and/or pursue lengthy and uncertain national proceedings to obtain the recognition of a breach of IP rights in the free-rider registration dossier. This cannot be accepted. Why?

Complying with REACH registration requirements for well intentioned companies is not only about filling information end-points by providing study data. It also entails a comprehensive assessment work (i.e. literature search, identification and rating of studies, reading them, reasoning for read-across, testing strategy, writing study endpoint summaries etc.). This crucial part is resource consuming for companies and/ or REACH consortia. The case of new registrants

copy/pasting information already submitted and referring only to published studies through a full opt-out registration without contributing to the assessment costs is clearly unfair to the existing registrants, because those free-riders cherry-pick the data served to them on a silver plate.

New registrants choosing for a full opt-out when faced with a letter of access cost they consider excessive should not be able to receive a token, unless they are able to demonstrate that (1) they are otherwise in legitimate possession/have a right of access to the data in the joint submission or, (2) they legitimately possess other data than that in the joint submission, in which case they have an obligation to share such data, in accordance with Article 29.3 of REACH; or (3) they have a justifiable waiver for the end-points in questions. The problem is that they refuse to share such information in most cases, leaving the lead registrant with no choice but to refuse to grant the token. Indeed, the lead registrant is legally bound by law and by contract to guarantee that data sharing is fair, transparent and non-discriminatory towards all previous registrants, which means that he cannot grant a token for virtually zero if he does not have such assurances while other co-registrants paid several thousand euros and accepted to do so in view of the work done. Otherwise, the lead registrant could engage its responsibility vis--vis its co-registrants (non-discrimination also applies to them!) and/or third party data owners. This is even more apparent when the lead registrant has elements which seek to demonstrate that the "opt-out" registration will be a cut and paste of the joint submission with no legitimate access to the underlying data.

Now, will ECHA control such elements? The ECHA data sharing dispute is only about "making every effort", in other terms ECHA decides which of the parties to the dispute has shown the most continued willingness to find an agreement. However, it is not about who is right or wrong on the appropriateness of the price asked for a Letter of Access and not about who holds legitimate rights to refer to the data submitted. Thus, whereas ECHA mechanically verifies whether there are separate registrations that need to be regrouped into a single joint submission, it does not systematically review the compliance of all registration dossiers, and is very reluctant to get into the intellectual property field. Opt-out dossiers are supposed to be prioritized for compliance check, but this does not mean a systematic review, and also it is not certain that the opt-out registrant will actually indicate in his submission that it is opting-out so that

the compliance verification by ECHA is all but uncertain. Also, ECHA rarely requests to be shown the elements justifying that a registrant is in legitimate possession or has a right to refer to a piece of data because this involves intellectual property considerations that it considers it is not equipped to address. Indeed, ECHA is still claiming its incompetency to assess legitimate possession of data without a breach being established by a competent national court beforehand. This opens a loophole into which those ill-intentioned consultants are stepping.

This is the very difficult situation in which many lead registrants are today, being forced to spend a lot of their otherwise scarce time to itemize and justify costs and cost sharing formula applied by many co-registrants to consultants who have as their only "modus operandi" to keep on their promise to deliver cheap registrations and who would do anything they can to achieve this, ultimately, at the risks of their clients. We are far from the intentions of the promoters of data sharing when REACH was redacted, namely to avoid duplication of testing and ensure a high level of protection of human health and the environment with relevant and coherent data backed up by the associated assessment work.

Companies involved in such discussions should be very careful as to how they deal with such discussions, as they need to make sure they do their best efforts regardless of the feelings they may have that this is losing their time. If ECHA eventually grants the token to a new registrant, existing registrants should seriously consider challenging that decision before the Board of Appeal and need to take steps in advance to prepare their case. Also, companies using these consultants and eager to cut costs should reflect twice as they may (and should) ultimately loose it all.

They should also make ECHA and competent authorities aware of these issues so that they can find pragmatic solutions when drafting the new data sharing guidelines so that token are not given without guarantees.