Spotlight: Launch of the Master's Program in Pharmaceutical and Health Law

We're pleased to announce we've launched the Master's Program in Pharmaceutical and Health Law, organized in collaboration with Sapienza University of Rome. Featuring participation from lawyers, professors and in-house experts, the program explores the key legal and regulatory aspects of the pharmaceutical and healthcare sectors, offering a unique opportunity to stay up-to-date with the latest legislative and regulatory developments.

Discover the full program and enrol now! Click here to learn more.

Regulatory

European Commission adopts rules for joint scientific consultations under HTA Regulation

On 18 December 2024, the European Commission adopted the Implementing Regulation (EU) 2024/3169 outlining the rules for joint scientific consultations on medicinal products under Regulation (EU) 2021/2282 (HTA Regulation). The Implementing Regulation details procedures for submitting requests, selecting stakeholders, consulting patient organizations, and engaging clinical experts. It also covers collaboration with the European Medicines Agency (EMA) when a health technology developer requests a joint consultation alongside EMA's scientific advice process. These consultations allow developers to discuss their product development plans with HTA bodies and get guidance on required data for clinical assessments. This is the fourth implementing act under the HTA Regulation.

AIFA adopts new Regulation on conflicts of interest

On 16 December 2024, the Italian Medicines Agency (AIFA) adopted its new Regulation on conflicts of interest. The Regulation requires AIFA's employees and managers to disclose any conflict of interest to their direct superiors, identifying three levels of risk:

• absent or irrelevant, which allows for the continuation of the Agency's activities;
• relevant, which entails some limitations, such as an obligation of abstention;
• high, which prevents the performance of any institutional function.

AIFA maintains the possibility to cooperate with highly professional and irreplaceable experts, whose contribution is essential to the Agency's operativity.

EMA and HMA update guidance on identifying CCI and personal data in MA applications

On 12 December 2024, the European Medicines Agency (EMA) and the Heads of Medicines Agencies (HMA) updated their guidance on identifying commercially confidential information (CCI) and personal data in marketing authorization (MA) applications for human medicines. This update applies to all regulatory procedures and emphasizes releasing most dossier data, except for manufacturing details, facility information, and specific contractual arrangements. The guidance replaces a binary release approach with detailed instructions for redaction and anonymization, along with updated examples of information that may qualify as CCI or protected personal data.

MDCG issues information form for manufacturers addressing supply interruption or discontinuation of certain devices

On 6 December 2024, the Medical Device Coordination Group (MDCG) issued the information form for manufacturers addressing the interruption or discontinuation of supply of certain medical devices and in vitro diagnostic medical devices. The form implements the requirements introduced by Regulation (EU) 2024/1860, which amends Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR). Following this, on 10 December 2024, the European Commission updated its Q&A to address practical aspects of implementing the Article 10a obligation in cases of supply interruption or discontinuation. Further information on this topic is available in our October newsletter.

AIFA announces implementation of the amended Variations Regulation (EU) 2024/1701

On 17 December 2024, the Italian Medicines Agency (AIFA) announced the implementation of Regulation (EU) 2024/1701, which takes effect on 1 January 2025. The Regulation revises the procedures for variations to marketing authorizations (MA) for human medicines under Regulation (EC) 1234/2008. The Regulation requires type IA variations to be grouped into annual updates, super-groupings, or within Type IB/II groupings or work-sharing, with single submissions allowed only in exceptional cases. Further information on this topic is available in our June newsletter.

EMA updates Union list of critical medicines to prevent shortages

On 16 December 2024, the European Medicines Agency (EMA) released the second version of the Union list of critical medicines. The updated list identifies human medicines essential for the functioning of healthcare systems and preventing serious harm to patients. It aims to ensure proactive measures are taken to avoid medicine shortages in the EU.

European Commission launches public consultation and call for evidence for medical devices evaluation

On 12 December 2024, the European Commission launched a public consultation and call for evidence to evaluate the EU legislation on medical devices and in vitro diagnostic devices. Stakeholders can share their views on the effectiveness of the current rules, highlight shortcomings, and propose improvements. The evaluation focuses on the rules' impact, including safety, costs, administrative burden (particularly for SMEs), benefits for patients and users, device availability (including orphan devices), and innovation. The consultation is open until 21 March 2025.

EMA publishes results of ePI pilot project

On 16 December 2024, the European Medicines Agency (EMA) published the outcomes of its Electronic Product Information (ePI) pilot project, conducted from July 2023 to August 2024. The project allowed companies to create and manage ePIs during regulatory procedures and made them publicly accessible. ePI, which includes authorized medicine information such as the summary of product characteristics, package leaflet and labelling, enhances accessibility, searchability, and multilingual support. It also integrates with electronic healthcare systems, offering healthcare professionals and patients accurate and up-to-date medicine information.

European Commission approves new strategy for the COMBINE programme

On 16 December 2024, the European Commission announced the approval of a new strategy for the COMBINE programme, which aims to streamline combined studies of medicines, medical devices, and in vitro diagnostics. The programme will involve seven cross-sector projects and focus on improving collaboration between national authorities, the European Medicines Agency, ethics committees, and stakeholders. Its goals include testing a unified assessment process for multi-country studies, harmonizing serious adverse event reporting, addressing regulatory overlaps, and facilitating knowledge exchange among national authorities.

WCC/Compliance

Assonime's position on new ANAC's draft guidelines on whistleblowing

On 10 December 2024, Assonime (Italian Association among Stock Companies) published its contribution to the public consultation opened by the Italian National Anticorruption Authority (ANAC) on the new draft guidelines on whistleblowing. In its paper, Assonime touches on some of the main critical issues in the implementation of the Italian Whistleblowing Decree (Legislative Decree 24/2023), such as the possibility of sharing reporting channels among entities of the same corporate group and the relationship between whistleblowing channels, 231 Models and Supervisory Bodie. Further information on this topic is available in our November newsletter.

Data, Privacy and Cybersecurity

EDPB publishes opinion on processing personal data in the context of AI models

On 17 December 2024, the European Data Protection Board (EDPB) published its opinion 28/2024 on data protection aspects related to the processing of personal data in the context of AI models. The opinion focuses on the development and deployment phases of AI models, discussing when and how an AI model can be considered anonymous, how controllers can justify the use of legitimate interest as a legal basis during these phases, and the consequences of unlawful personal data processing during the development phase on subsequent processing or the operation of the AI model.

Italian DPA publishes FAQs on the right to access personal data in medical records

On 23 December 2024, the Italian Data Protection Authority (Italian DPA) published a set of FAQs regarding the right to access to personal data in medical records. These FAQs clarify that healthcare facilities have to provide individuals with a copy of their personal data upon request, in accordance with Article 15 GDPR, and that the first copy of the data must be provided free of charge. The healthcare facility is responsible for determining whether to supply a complete or partial copy of the documentation contained in the medical record. However, when a full copy of the medical record is necessary to ensure that the requester can verify the accuracy, completeness, and clarity of the information, the facility must provide it free of charge.

Italian DPA fines University Hospital for failing to adopt appropriate security measures

On 23 December 2024, the Italian Data Protection Authority (Italian DPA) published a resolution in which it fined a University Hospital that had suffered a hacking attack on its information systems in December 2022. The data breach resulted in the loss of confidentiality, integrity and availability of the personal data of a large number of data subjects, including employees, consultants and patients. The attack did not disrupt healthcare services. The investigations revealed that the entity failed to adopt appropriate security measures as required by the GDPR. Specifically, it relied on outdated systems, employed insufficient measures to detect data breaches promptly, and failed to ensure the security of its IT networks. These shortcomings constituted a violation of the GDPR, leading to the fine of EUR25,000.

Italian DPA fines a local health authority for beaching the data minimization principle

On 23 December 2024, the Italian Data Protection Authority (Italian DPA) published a resolution in which it fined a local health authority for various violations, including irregularities in preparing certificates used to justify absence from work. More specifically, according to the Italian DPA, certificates confirming attendance at a hospital, which are issued to justify absence from work or the inability to participate in a competition, must comply with the principle of data minimization. Specifically, the certificates must not include details such as the name of the facility where the healthcare service was provided, the doctor’s specialization stamp, or any other information that could reveal the individual’s health status. The inclusion of this unnecessary information constituted a breach of GDPR principles, resulting in the fine of EUR17,000.

EDPB publishes guidelines on Article 48 GDPR

On 2 December 2024, the European Data Protection Board (EDPB) published the guidelines 02/2024 on Art. 48 GDPR. The guidelines aim to clarify the purpose and scope of Article 48, including how it interacts with other provisions in Chapter V of the GDPR. They also provide practical advice for EU-based companies who may face requests from authorities in non-EU countries to disclose or transfer personal data. According to the EDPB, the key principle of Article 48 is that judgments or decisions from authorities in non-EU countries cannot automatically or directly be recognized or enforced in EU member states. In general, the recognition and enforcement of foreign judgments or decisions depend on the existence of relevant international agreements.

Antitrust

ICA opens investigation against unfair commercial practices in the online sale of pharmaceuticals

On 5 December 2024, the Italian Competition Authority (ICA) has opened an investigation against a company active in the online sale of healthcare products, namely pharmaceuticals and over-the-counter medicines ordered on a website, for potential unfair commercial practices. The company allegedly publicised untrue and misleading information regarding product availability and delivery times. Additionally, many consumers reported incorrect or damaged deliveries and faced difficulties exercising the right of withdrawal, obtaining refunds or receiving replacement products.

Tax

Italian Revenue Agency publishes ruling no. 243 on deductibility of expenses for providing patient support programs related services

On 5 December 2024, the Italian Revenue Agency published the ruling no. 243 on the inherence of costs linked to the provision of services within the Patient Support Programs (PSP) framework. The ruling clarifies that the inherent costs incurred by a pharmaceutical company for providing PSP services are deductible since they are classified among those provided in the post-sale phase under specific agreements with healthcare institutions, and they are provided in the interest of all parties: patients, healthcare institutions, and the pharmaceutical company itself.