Fabien Roy, Senior Associate, Hogan Lovells, presented a talk entitled 'The Impact of Brexit on the Medical Device Industry' at Medtec 2017, in Messe Stuttgart, Germany. Brexit is expected to have significant implications for business in various industry sectors. For the medical devices industry, Brexit could result in uncertainty over key elements of the medical devices legislation, which includes manufacturers and authorised representatives, notified bodies, and data privacy issues and clinical investigations.
Roy highlighted the key changes to be expected in the coming years:
Manufacturers and Authorised Representatives
During the process of leaving the EU, and depending upon the exact terms of the UK's withdrawal, UK medical devices manufacturers will be required to appoint an Authorised Representative established within an EU Member State to permit the continued marketing of their products within the EU. Alternatively, UK manufacturers may choose to establish a presence in one of the EU Member States, and to transfer to this new address their responsibility as legal manufacturer of the medical devices.
UK manufacturers may not be the only entity which may be affected by Brexit. As a consequence of Brexit, UK Authorised Representatives may lose their right to be appointed as the point of contact for third country manufacturers with competent authorities in the EU Member States.
Manufacturers not established in the EU and which currently work with an Authorised Representative based in the UK may, therefore, also be required to appoint an Authorised Representative established in the EU to continue fulfilling the requirements of the Directive.
Identification by manufacturers of experience Authorised Representative in the EU may also be more challenging than in the past. This includes the forthcoming adoption of the new regulations on medical devices and in vitro diagnostic medical services which are expected to substantially impact medical devices manufacturers.
Among other things, Authorised Representatives would be jointly and severally liable with manufacturers for defective medical devices placed on the EU market. It is anticipated that some Authorised Representatives will simply cease their current activities due to their inability to undertake this potential liability.
There are currently five notified bodies in the UK which have been designated by the UK competent authorities to conduct conformity assessment procedures in relation to medical devices and in vitro diagnostic medical devices. The designation of these notified bodies by the UK competent authorities is based on the provisions of the relevant EU medical devices Directives.
By leaving the EU, these UK notified bodies may lose their right to conduct conformity assessment procedures based on applicable EU regulations in relation to medical devices. In such circumstances, the CE Certificates of Conformity granted by these notified bodies to medical devices manufacturers marketing products in the EU may also cease to be valid.
Manufacturers working with UK notified bodies may, therefore, be required to appoint new notified bodies established in an EU Member State and to apply for new certificates. New conformity assessments with unpredictable outcomes for manufacturers may be required to continue marketing of the medical devices in the EU.
Data privacy issues
Clinical investigations conducted in the EU: validity of the informed consent provided by study subjects
Legislation in the EU and EN ISO 14155:2011 standard "Clinical investigation of medical devices for human subjects - Good clinical practice" require that the informed consent of study subjects for their participation in a clinical investigation in the EU be collected before their participation in the relevant study. The information to be provided to study subjects includes details concerning the processing and transfer of their personal data.
In the context of on-going clinical investigations conducted in the EU, it may, depending on related negotiations in the coming months, be necessary for the informed consent signed by the study subject to be revised to permit the transfer of the study subject's personal data to the UK.
The UK could also become a "third-country" for the purposes of the application of the Data Protection Directive. Article 25.1 of the Data Protection Directive prohibits the transfer of personal data outside the EU to countries that do not ensure an adequate level of data protection.
It may be concluded that the UK will be required to undergo an "adequacy assessment" carried out by European Commission, for the purposes of the application of the Data Protection Directive.
The result of the European Commission assessment may depend on the nature of the data protection legislative that will be in force in the UK at this time and on whether the UK chooses to implement the new EU General Data Protection Regulation, which will enter into force on 25 May 2018.
Pending the decision of the related European Commission, or in the case of a negative decision by the European Commission, UK companies will be required to comply with the requirements provided by EU law for the transfer of personal data to third countries.
Clinical investigations conducted in the EU: designation of a Data Protection Representative
Article 4.2 of the Data Protection Directive provides that when a data controller is not established within the territory of the EU, it must designate a Data Protection Representative established in the territory of the EU Member States in which data processing activities are carried out.
The sponsor of a clinical investigation determined the purposes for which the study subjects' data are processed, and is commonly considered the data controller.
If a UK manufacturer is the sponsor of a clinical investigation in the EU, it will be required to designate a Data Protection Representative in each EU Member State where there is a clinical investigation site and where the personal data of the patients are processed.
This essentially means that UK companies would be required to appoint a Data Protection Representative in each EU Member State in which an investigation site is established.
Clinical investigations conducted with study subject in the UK
During Brexit, investigation subjects in the UK may be subject to a new set of data protection laws. These may, particularly in on-going clinical investigations, differ from those referred to in the informed consent signed by the study subjects at the beginning of the investigation.