Reporting requirements for defective products
Government notificationWhat requirements are there to notify government authorities (or other bodies) of defects discovered in products, or known incidents of personal injury or property damage?
Consumer productsThe GPSR require producers or distributors to notify the enforcement authorities if they know that a product they have placed on the market or supplied does not comply with the general safety requirement. Although the obligation to notify applies to producers and distributors, in the UK the authorities’ approach is that notification by one of them is sufficient.
In general, the requirements concern notification of information concerning defects or newly discovered risks, irrespective of whether any incident, injury or damage has yet occurred.
PAS 7100 highlights that the PSIP should emphasise the legal duty to notify the relevant market surveillance authority and allocate responsibility for timely notification (see question 5). Distributors’ notification responsibilities, within the limits of their activities, are also listed in the PAS.
Commercial productsThere are currently no UK statutory requirements requiring notification to the authorities of defective products for commercial use. (See, however, the rules referred to in question 5 for specific sectors.) The HSE issues safety alerts if it becomes aware of a specific safety issue that, without immediate action, could result in a serious or fatal injury. Safety notices are issued for circumstances in which an unsafe situation could arise - for example, unclear instructions or labelling. Alerts are usually issued by the HSE during or after an investigation or as a result of notification from manufacturers or other European regulators.
Where products have been tested or certified by a third party, it is possible there may be a contractual obligation incorporated into the agreement requiring the manufacturer or its representative to inform the body concerned. This body may, in turn, inform the authorities.
Notification criteria and time limitsWhat criteria apply for determining when a matter requires notification and what are the time limits for notification?
Consumer productsThe criterion for notification is simply that a consumer product is known to have risks that are incompatible with the general safety requirement - namely, that it is not safe. It is not necessary for there to have been an incident involving personal injury or property damage. ‘Isolated circumstances or products’ do not need to be notified. The new proposed EU Regulation on Consumer Product Safety also makes an exemption from notification ‘if the manufacturers, importers or distributors can demonstrate that the risk can be fully controlled and cannot anymore endanger the health and safety of persons’. It is likely that the UK will have left the EU before this regulation comes into force; however, UK authorities may decide to adopt a similar approach.
In terms of assessing risk to determine whether notification is necessary, PAS 7100 makes reference to the ‘EU RAPEX methodology’, which is now found in Decision 2019/417 (EU) (repealing Decision 2010/15/EU) known as the RAPEX guidelines. The EU risk-assessment methodology looks at the product itself, the product hazard, the abilities and behaviour of the consumer (in particular vulnerable consumers), injury scenarios, the severity and probability of injury and the determination of risk. The number of products supplied or users potentially affected is not a relevant consideration for notification, although it may be taken into account in determining what action to take to address the risk.
Use of the methodology set out in the RAPEX guidelines is recommended in PAS 7100. The nomograph methodology is also recognised, as it can be used to supplement the RAPEX methodology and is applied by some market surveillance authorities. The Reference in PAS 7100 to use of the EU RAPEX methodology is unlikely to change after the UK’s departure from the EU.
The obligation under the GPSR is to notify the authorities ‘forthwith’ (or immediately) upon knowing a product is unsafe. The UK government guidelines advise that in practice this means making a notification as soon as possible, and no later than 10 calendar days of a risk assessment or obtaining other information showing the product is unsafe. Further, where there is a serious risk, the notification should be made no later than three days after the information has been obtained. PAS 7100 confirms that notification should not be delayed because the business is not yet in a position to provide all of the required information. In this case, the additional information should be provided as it becomes available.
Food and drinkObligations to notify the Food Standards Agency (FSA) and relevant local authority of unsafe food and drink products are governed by Regulation EC/178/2002 on General Food Law (article 19) and the Food Safety and Hygiene Regulations 2013. A food business operator must notify the authorities if it considers or has reason to believe that food it has placed on the market may be injurious to health. (See the FSA’s Guidance Notes for Food Business Operators on Food Safety, Traceability, Product Withdrawal and Recall 2007).
PharmaceuticalsNotification obligations are incorporated into manufacturers and wholesale dealers’ licences and marketing authorisations. The holder of a manufacturer’s licence has a duty to notify the Defective Medicines Report Centre (DMRC) (a unit of the Inspection, Enforcement and Standards Division of the Medicines and Healthcare Products Regulatory Agency (MHRA)) immediately once investigations have identified a defect that could result in recall or other restrictions on supply. Manufacturers who make a notification after a recall has commenced will be in breach of the Human Medicines Regulations 2012 (SI 2012/1916). The DMRC can be contacted for advice prior to a recall being undertaken. For guidance see: A Guide to Defective Medicinal Products (MHRA, 2014). Guidance is also available on the website of the European Medicines Agency, www.emea.europa.eu (to the extent that it remains applicable post-Brexit).
Medical devicesThe medical devices directives require vigilance systems that include reporting to the MHRA by the manufacturer or its authorised representative of malfunctions or deteriorations in a device, inadequacies in labelling or instructions for use that might lead or have led to a patient’s or user’s death or serious health effects and any technical or medical reasons for a systematic recall of the devices.
The MHRA’s Directives Bulletin 3 - Guidance on the Operation of the EU Vigilance System in the UK (September 2008) provides interpretation and guidance on notification of different types of incidents. The European Commission also provides up-to-date guidance in document MEDDEV 2.12-1 Rev 8 (2013). In respect of Brexit, in the event of a no-deal scenario, the UK’s participation in the European regulatory network for medical devices would cease and the UK MHRA would take on the responsibility currently undertaken by the EU.
Notification should be immediate upon the defect being known. The guidance contains guidelines on time limits ranging from two days to 30 days depending on the seriousness of the issue.
On 5 April 2017, two new European Regulations on medical devices were adopted and entered into force on 25 May 2017:
- Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No. 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC; and
- Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission Decision 2010/227/EU.
The new regulations strengthen the regulatory framework relating to medical devices including the pre-market assessment of devices, post market surveillance and the transparency of data. The new rules will only apply after transitional periods of three years after entry into force for the Regulation on medical devices (May 2020) and five years after entry into force for the Regulation on in vitro diagnostic medical devices (May 2022). The Commission has indicated that it will be reviewing its guidance documents over the next few years to take into account the new regulations. Post-Brexit, The Medical Devices (Amendment etc) (EU Exit) Regulations 2019 will transpose all the key elements contained in Regulation EU 2017/745 on medical devices and EU 2017/746 on in vitro diagnostic medical devices, which will be brought into force in line with the transitional timetable being followed by the EU for the full application of the two regulations.
Motor vehiclesSupplemental to the general consumer product laws above, the DVSA’s Vehicle Safety Defects and Recalls: Code of Practice (2014) applies to all vehicles (private and commercial). It requires notification to the DVSA by manufacturers of vehicle or component parts, importers, distributors or concessionaires of ‘safety defects’ (defined as a failure because of design or construction that is likely to affect the safe operation of the product without prior warning to the user and may pose a significant risk to the driver, occupants and others). The DVSA’s Code of Practice and Manufacturers’ Guide to Recalls in the UK Automotive Sector (April 2014) advocates early notification of alleged safety defects, even when all the information usually supplied on the official notification form is not available.
Competent authorityTo which authority should notification be sent? Does this vary according to the product in question?
For most consumer products, the appropriate authority for notifications in England and Wales is the Trading Standards Department of the local government authority for the area in which the manufacturer’s or supplier’s business is based. For contact details, see https://www.gov.uk/find-local-trading-standards-office. Pre-Brexit (and pending clarification as to ongoing cooperation with the EU), if the product is also supplied in other EU member states, one single notification can be made to the European Commission, via its Business Alert Gateway portal. All relevant national authorities will be informed by the European Commission.
Other authorities responsible for sector-specific notifications are the FSA (www.food.gov.uk), the DVSA (www.gov.uk/government/organisations/driver-and-vehicle-standards-agency) and the MHRA (www.gov.uk/government/organisations/medicines-and-healthcare-products-regulatory-agency).
These authorities may currently forward the information notified to them to the EU authorities for the purposes of RAPEX, Rapid Alert System for Food and Feed or other rapid alert systems in Europe for pharmaceuticals and medical devices, or for the purposes of information-sharing systems pursuant to other EU legislation. This may not be possible post-Brexit.
Notification informationWhat product information and other data should be provided in the notification to the competent authority?
The information to be notified for consumer products generally is the nature of the defect, the action being taken to prevent risks to consumers and the details of other EU member states in which the product is known to have been supplied or marketed (the latter may not be required post-Brexit). The reporting form for general consumer products is available from the UK Department for Business, Energy and Industrial Strategy (BEIS) (www.gov.uk/government/organisations/department-for-business-energy-and-industrial-strategy). Other specific product forms are available from the FSA, MHRA and DVSA.
PAS 7100 states that the notification must include information on any action taken to reduce risk to consumers and, in the case of serious risk, must provide the following:
- information enabling a precise identification of the product or batch of products in question;
- a full description of the risks the products presents; and
- all information relevant for tracing the product.
What obligations are there to provide authorities with updated information about risks, or respond to their enquiries?
Where it has only been possible to provide incomplete notification data within the time limits, updated information should be provided as soon as possible thereafter. There is a duty on producers and distributors to cooperate with the authorities in taking action to avoid risks to consumers. The authorities also have formal enforcement powers to require the provision of additional information and records if they require it in order to investigate a breach of product safety legislation or to decide whether to use their enforcement powers to, for example, serve safety notices. Failure to provide information requested is an offence. EU Market surveillance authorities will have new and expanded powers under the proposed EU Regulation on Market Surveillance of Products. The draft regulation requires economic operators to make available on request any documentation or information that the surveillance authorities require. This may not be applicable to UK producers, subject to the outcome of Brexit.
PenaltiesWhat are the penalties for failure to comply with reporting obligations?
The penalty for failing to properly notify the appropriate authority of a defective consumer product is an unlimited criminal fine or up to three months’ imprisonment (for an individual producer or distributor or, for example, a director of a corporation) or both.
Public disclosureIs commercially sensitive information that has been notified to the authorities protected from public disclosure?
There is limited protection for commercially sensitive information. The authorities are obliged to make available to the public information on the identity and risks associated with a defective product, and the measures taken to avoid the risk. There is no obligation on the authorities to disclose information that is covered by professional secrecy, unless its disclosure is necessary to protect the public.
Under the Freedom of Information Act 2000 (FOIA), any person may request information from the authorities on a product safety matter. The original provider of the information has no right to prevent its disclosure. The authorities have discretion as to whether to release information that is provided in confidence or which could prejudice a person’s commercial interests.
The FOIA recognises that in many circumstances it may be inappropriate for a public body to disclose the information that it holds. The FOIA therefore contains a number of exemptions that protect information from potential disclosure. Of particular relevance to product safety notifications and recalls are those exemptions relating to ‘investigations’, ‘law enforcement’ and ‘information provided in confidence’.
Information provided compulsorily under consumer protection legislation obligations may be protected from disclosure by provisions of the Enterprise Act 2002. (This extra protection does not extend to information originally provided voluntarily.) Disclosure of the information to a claimant for the purposes of civil proceedings may nevertheless be permitted.
Use of information in prosecutionMay information notified to the authorities be used in a criminal prosecution?
It is likely that the information obtained by the authorities will be relied upon if there were criminal proceedings or other enforcement action. There is no bar to the information being used as evidence. In some cases, it might amount to an admission of an offence.
