Brexit is expected to habe significant implications for business in various industry sectors. For the medical devices industry, Brexit could result in uncertainty over key elements of the medical devices legislation. The purpose of this article is to examine the potential implications of Brexit for:
- Manufacturers and Authorized Representatives;
- Notified Bodies; and
- Data privacy issues and clinical investigations.
1. Manufacturers and Authorized Representatives
The current Directives on medical devices provides that companies that do not have an establishment within the European Union (EU) and who wish to affic a CE MArk to medical devices and to market these products in the EU must either, establish an EU presence or, select a local representative to serve as its "Authorized Representative"
Authorized Representatives play a key role in the EU. An Authorized Representative serves as the manufacturer's point of contact with vompetent authorities in the EU. They also interact with EU authorities on behalf of the manufacturer.
Their name and address must appear on the labelling, outer packaging and "Instructions for Use" of medical devices and on the related Declaration of Conformity.
If and when the UK leaves the EU and depending upon the exact terms of the UK's withdrawal, UK medical devices manufacturers, be required to appoint an Authorized Representative established within an EU Member State to permit the continued marketing of their products within the EU. Alternatively, UK manufacturers may choose to establish a presence in one of the EU Member States, and to transfer to this new address their responsibility as legal manufacturer of the medical devices.
UK manufacturers may not be the only entity which may be affected by Brexit. As a consequence of Brexit, UK Authorized Representatives may lose their right to be appointed as the point of contact for third country manufacturers with competent authorities in the EU Member States. Manufacturers not established in the EU and which currently work with an Authorized Representative based in the UK may, therefore, also be required to appoint an Authorized Representative established in the EU to continue fulfilling the requirements of the Directive.
Identification by manufacturers of experience Authorized Representative in the EU may, for a number of reasons, also be more challenging than in the past. This includes the forthcoming adoption of the new regulations on medical devices and in vitro diagnostic medical services which are expected to substantially impact medical devices manufacturers. Among other things, Authorized Representatives would be jointly and severally liable with manufacturers for defective medical devices placed on the EU market. It is anticipated that some Authorized Representatives will simply cease their current activities due to their inability to undertake this potential liability.
2. Notified bodies
There are currently five notified bodies in the UK which have been designated by the UK competent authorities to conduct conformity
assessment procedures in relation to medical devices and in vitro diagnostic medical devices. The designation of these notified bodies by the UK competent authorities is based on the provisions of the relevant EU medical devices Directives. If and when the UK leaves the EU, these UK notified bodies may lose their right to conduct conformity assessment procedures based on applicable EU regulations in relation to medical devices. In such circumstances, the CE Certificates of Conformity granted by these notified bodies to medical devices manufacturers marketing products in the EU may also cease to be valid. Manufacturers working with UK notified bodies may, therefore, be required to appoint new notified bodies established in an EU Member State and to apply for new certificates. New conformity assessments with unpredictable outcomes for manufacturers may, therefore, be required to continue marketing of the medical devices in the EU.
3. Data privacy issues
3.1. Clinical investigations conducted in the EU: validity of the informed consent provided by study subjects
3.1.1. Trensfer of study subject data to the UK
Legislation in the EU and EN ISO 14155:2011 standard "Clinical investigation of medical devices for human subjects - Good clinical practice" require that the informed consent of study subjects for their participation in a clinical investigation in the EU be collected before their participation in the relevant study. The information to be provided to study subjects includes details concerning the processing and transfer of their personal data.
In the context of on-going clinical investigations conducted in the EU, it may, depending on related negotiations in the coming months, be necessary for the informed consent signed by the study subject to be revised to permit the transfer of the study subject's personal data to the UK.
Should the UK leave the EU, the UK could also become a "third-country" for the purposes of the application of the Data Protection Directive. Article 25.1 of the Data Protection Directive prohibits the transfer of personal data outside the EU to countries that do not ensure an adequate level of data protection.
It may be concluded that the UK will be required to undergo an "adequacy assessment" carried out by European Commission, for the purposes of the application of the Data Protection Directive. The result of the European Commission assessment may depend on the nature of the data protection legislative that will be in force in the UK at this time and on whether the UK chooses to implement the new EU General Data Protection Regulation, which will enter into force on 25 May 2018. Pending the decision of the related European Commission, or in the case of a negative decision by the European Commission, UK companies will be required to comply with the requirements provided by EU law for the transfer of personal data to third countries.
3.1.2. Options for transferring personal data to third countries
Article 26 of the Data Protection Directive establishes exceptions to the prohibition on transfer of personal data to third countries which are considered by the European Commission not to ensure an adequate level protection. The following alternatives are possible:
- the individual's unambiguous prior written consent to the transfer of their personal data to the third country;
- data transfer agreements, based on the standard contractual clauses adopted the European Commission;
- Binding Corporate Rules concluded between the EU and UK entities transferring the data. These Binding Corporate Rules are internal codes of conduct, defining a company's global policy with regard to the international transfer of personal data between entities within the same corporate group. Binding Corporate Rules should comply with the EU General Data Protection Regulation because the UK entities of companies will need to meet EU standards in order to receive data originating from the EU.
Given the options described above, the informed consent given by study subjects, particularly in clinical investigations that are on-going when the UK leaves the EU, may not be adequate if this does not include their unambiguous prior written consent to the transfer of personal data to the UK or if, in the alternative, the transfer is not based on standard contractual clauses or Binding Corporate Rules.
3.2. Clinical investigations conducted in the EU: designation of a Data Protection Representative
Article 4.2 of the Data Protection Directive provides that when a data controller is not established within the territory of the EU, it must designate a Data Protection Representative established in the territory of the EU Member States in which data processing activities are carried out.
The sponsor of a clinical investigation determined the purposes for which the study subjects' data are processed, and is commonly considered the data controller.
If a UK manufacturer is the sponsor of a clinical investigation in the EU, it will be required to designate a Data Protection Representative in each EU Member State where there is a clinical investigation site and where the personal data of the patients are processed.
This essentially means that UK companies would be required to appoint a Data Protection Representative in each EU Member State in which an investigation site is established.
3.3. Clinical investigations conducted with study subject in the UK
In the event that the UK leaves the EU, investigation subjects in the UK may be subject to a new set of data protection laws. These may, particularly in on-going clinical investigations, differ from those referred to in the informed consent signed by the study subjects at the beginning of the investigation.