Made in accordance with Article 3(6) of the Statute of the European Ombudsman^[1]

The case concerns the refusal of the European Medicines Agency to disclose the name of a company that asked for public access to the latest ‘periodic safety update report’ on the drug Zyclara. The complainant is the pharmaceutical company that markets Zyclara.

EMA stated that it is its policy since 2015 not to release the name of companies that request access to documents. It explained to the complainant that this policy protects the requester’s commercial interests.

The Ombudsman has inquired into the matter and finds that the refusal to release the identity of the company requesting public access constitutes maladministration. She recommends that EMA reviews its policy and instead of outright refusing to disclose this information it first consults the initial requester on whether releasing its name to the complainant would undermine its commercial interests before taking its decision on this matter.

The background to the complaint

1. The complainant is a pharmaceutical company that markets Zyclara, a drug used to treat actinic keratosis. As part of its legal obligations as a “marketing authorisation holder” the complainant is required to submit “periodic safety update reports” (PSURs) to the European Medicines Agency (EMA).[2] PSURs contain a summary of data on the benefits and risks of a medicine and include updated results of all studies carried out with this medicine, both as regards its authorised and non-authorised uses. EMA then uses the information in PSURs to determine if there are new risks for a medicine and whether the balance of benefits and risks of a medicine has changed. It can then decide if further investigations are needed or if action needs to be taken (such as updating the product information provided to healthcare professionals and patients.)

2. In September 2015^[3], EMA received a request for public access to the latest PSURs on Zyclara.

3. EMA then asked the complainant whether there was any commercially confidential information in its PSURs. The complainant responded by asking EMA to redact certain information that it considered to be confidential. At the same time, it asked EMA for a copy of the request for access made to EMA regarding the Zyclara PSURs.

4. In October 2015, EMA granted the complainant access to the request for access. It redacted, however, the identity of the requester (along with addresses, email addresses and telephone numbers). It stated that the redactions were necessary to protect personal data and commercially confidential information. Information that the requester came from the pharmaceutical industry and the fact the specific person submitting the request worked as an “R&D Scientist” and that he/she was a “Senior Regulatory Intelligence Specialist” (presumably in the company making the request) was not redacted.

5. The complainant requested EMA to review its decision to redact the document. It noted that in a similar case, where the requester was another pharmaceutical company, EMA disclosed the name of that company. The complainant argued that, if the requester was indeed a company, it was only fair to the complainant to be informed of its name. In this regard, it stated that the requester knows who the complainant is and has a commercial interest in receiving the information on the complainant's product. It argued, that in the interest of equality, it should be told who the requester is.

6. In November 2015, EMA replied. It explained that the requester was a company and that its name was redacted to protect its commercial interests. In this regard, it referred to Article 4(2), first indent, of Regulation 1049/2001: disclosure of the name of the organisation may provide insights into the company’s future development and business plans, putting at risk its commercial interests.

7. As regards the fact that in a previous case, it had released the name of the company having made the initial request, EMA explained that, on 21 July 2015, it published on its website its new policy^[4] on the matter. Under the new policy:

“The Agency does not release information on the identity of the person or the name of the organisation requesting access to EMA documents to third parties (e.g. the marketing-authorisation holder for a medicinal product) consulted as part of its assessment of the request. In particular with regard to the name of an organisation, this is in line with the Agency's Code of Good Administrative Behaviour and specifically, the principle of proportionality set out in Section 4 of the Code.

When a document is requested using the online form, any data collected concerning the identity and/or the name of the organisation of the requested will be used for the sole purpose of processing the request and will not be disclosed to third parties. The Agency's practice reflects the principle that the identity of a person and the name of the organisation requesting access to documents are irrelevant for the handling of the request.

Regulation (EC) 1049/2001 does not require either the requester to reveal any information about their organisation, reasons or justifications for requesting access to documents, or require the Agency to disclose such information to a third party".

8. EMA also stated that there was no overriding public interest in disclosing the name of the requesting organisation.

9. In December 2015, the complainant submitted a complaint to the Ombudsman.

The inquiry

10. The Ombudsman opened an inquiry into the allegation that EMA had wrongly refused to grant access to the identity of the pharmaceutical company which, on 23 September 2015, made a request for public access to the periodic safety update reports (PSURs) concerning the Zyclara drug produced by the complainant.

11. In her letter of 3 March 2016, asking EMA for an opinion, the Ombudsman made a number of observations concerning EMA's new policy on releasing the name of requesters. In particular, she asked how the release of the name of the company could provide an insight into the requester’s “future development and business plans". She also noted, in particular, that EMA could have asked the requester to explain precisely how its commercial interests might be affected by the disclosure of its identity to the complainant.

12. In the course of the inquiry, the Ombudsman received the response of EMA on the complaint and, subsequently, the comments of the complainant on EMA's response. The Ombudsman's recommendation takes into account the arguments and views put forward by the parties.

Refusal of EMA to release the name of a pharmaceutical company

Arguments presented to the Ombudsman

13. EMA argued that its policy not to release the name of a requester was underpinned by a strong policy to increase the transparency of its activities.

14. As a first general statement, EMA noted that the identity of the requester was irrelevant for the handling of a request for public access to documents. EMA noted in this regard that it makes many documents directly accessible to the public on its website (in accordance with Article 12 of Regulation 1049/2001) and it does not record the identity of each individual organisation or person that accesses these documents. Indeed, some documents concerning Zyclara (for example, the European Public Assessment Reports or the Summary of Product Characteristics) are publicly available on the EMA’s website. EMA does not record who accesses them.

15. As a second general statement, EMA then clarified that its reference to the need to protect the commercial interests (of the requester) should have been understood as a general and abstract statement relating to the fact that the pharmaceutical companies have interests that merit protection. It went on to clarify that it was not relying on the exception set out in Article 4(2) of Regulation 1049/2001 (the need to protect the commercial interests) to justify not disclosing the name of the requester.

16. EMA stated that, in this case, it had no reason to request the opinion of the requester under Article 4(4) of Regulation 1049/2001 as to whether the disclosure of its identity to the complainant could have affected its commercial interests.

17. As regards the argument that it was “unfair competition” for EMA to refuse to disclose the name of the requester even though the complainant’s identity was known, EMA noted that EU pharmaceutical law requires the identity of a marketing authorisation holder to be included in all documents related to the marketing of the product^[5]. By contrast, Regulation 1049/2001 does not impose any requirements concerning the publication of the name of the requester.

18. EMA then explained why it considered that in this case it should not release the name of the requester.

19. EMA first argued that it has to guarantee that the right of the public to have access to documents concerning medicinal products is not obstructed by any third party who may have an interest in discouraging disclosure by EMA. It then stated that releasing the names of organisations requesting access to documents may lead those who submitted the documents to EMA to submit “requests on the requests” or even exert pressure on requesters to withdraw their requests for access.

20. EMA also argued that releasing the identity of requesters may undermine the mechanisms it has in place to optimise the handling of requests, It noted that it deals with a very large number of requests (in 2015 it dealt with 703 requests amounting to over 334 000 pages). In this context it may have to queue requests. It then stated that releasing the names of requesters would lead requesters to submit their requests using fictitious identities. It then noted the submission of requests from fictitious requesters would render useless its system that queues requests from the same requester. An entity that wished to monopolise EMA access to document regime could do so by submitting multiple requests at the same time using different names. It noted that its queuing system was established when certain entities submitted up to 17 requests at the same time. It then stated that refusing to release the name of the requester may deter the use of fictitious names.

21. EMA then stated that it had no reason to request the opinion of the requester under Article 4(4) of Regulation 1049/2001 as to whether the disclosure of its identity to the complainant could have affected its commercial interests.

22. In its observations, the complainant stated that the fundamental right to property (Article 17 of the European Charter of Fundamental Rights) was at stake (which includes, it stated, business secrets and other intellectual property rights). It argued that a request coming from a competitor represents a clear threat for its intellectual property rights. It added that EMA’s arguments that the pharmaceutical industry’s requests would obstruct the EMA’s work, or would put pressure on the initial requesters, is pure speculation.

23. It then argued that if a requester knows the origin of the information received, and can use it to further its own commercial interests, the complainant should also be informed of the requester’s identity for the same reason. It its view the requester and the complainant are probably in a competitive situation and therefore EMA should protect “fair competition”. The complainant concluded that transparency cannot serve to argue on the one hand that the owner of documents held by the EMA is forced to provide information, but that at the same time it has no right to know who receives such information.

The Ombudsman's assessment leading to a recommendation

24. The Ombudsman considers it useful to deal first with the argument of the complainant that there is a contradiction between EMA’s position that the complainant’s PSURs should be released and its position that the identity of the requester should not be released.

25. All EU institutions should treat comparable situations in the same manner. If an EU institution receives requests for public access to similar documents, it should treat those requests in the same manner. For example, if EMA receives requests for the PSURs of various marketing authorisation holders, it should treat those requests in a similar manner.

26. A PSUR contains a summary, drawn up by a market authorisation holder, of data on the benefits and risks of a medicine. It includes updated results of all studies carried out with the medicine, both as regards its authorised uses and non-authorised uses (off label use). Such product safety information cannot normally^[6] be considered as commercially confidential. In any case, there will normally be an overriding public interest in granting public access to such product safety information (at least once EMA has had the opportunity to examine the PSUR and take whatever action it deems necessary in relation thereto^[7]).

27. A PSUR relates to a product for which a marketing authorisation has already been granted. The name of the marketing authorisation holder is thus in the public domain prior to when a PSUR is submitted to EMA (it is in the public domain at least from the time the marketing authorisation was granted). Indeed, it is a legal requirement to release the identity of the marketing authorisation holder when a marketing authorisation is granted. Thus, the public disclosure of the PSUR on Zyclara does not constitute an act, which brings into the public domain the identity of the marketing authorisation holder.

28. In any case, it is not evident how the release of the name of a company submitting a PSUR to EMA might reveal any information about that company’s future plans, since a PSUR relates to a product that is already on the market.

29. The document to which the complainant seeks access is very different from a PSUR (the document is a simple request for access to a document made up of two lines of text and diverse contact details). The redacted information is the name of a company and the various contact details of that company. That request for access to that redacted information must be examined on its own merits. The fact that the complainant’s PSURs were released has no bearing on that analysis.

30. As a starting point in the analysis, the Ombudsman notes EMA’s argument that the identity of the requester is irrelevant to how a request for public access is dealt with. EMA then seems to draw the conclusion that for this reason alone there is no need to release the identity of a requester.

31. The fact that a requester’s identity is not relevant as regards how EMA deals with requests for access to documents does not constitute a reason why EMA can refuse access to information that happens to be in its possession. Regulation 1049/2001 only permits the redaction of information from documents in the possession of EMA if the redaction is necessary to respect the exception set out in Article 4 of Regulation 1049/2001. The fact that the information simply happens to be in the possession of EMA, and that the information may be of no practical relevance to EMA, has no bearing on the answer to that question

32. The Ombudsman has examined the documents in question and can confirm that the documents contain the name of a company and a physical person working for that company. The person’s name and contact details are “personal data” of that physical person. EU law does not allow the release of that personal data unless the physical person concerned has consented to its release or if the requester has put forward reasons why it needs that personal data. As the person has not given his consent and as the complainant put forward no reasons why it needed access to the name and contact details of that physical person, EMA was thus required to redact that name and their contact details.

33. EMA also received the name of the company with which that person works.  That information, however, is not personal data. Thus, EMA was required to justify, pursuant to Article 4 of Regulation 1049/2001, why it would redact that information.

34. As regards whether Article 4 applies to that information, the Ombudsman notes that the complainant seems to believe that the company that requested access to its PSURs must be a present or future competitor. The complainant asserts this belief with the expectation that it is of relevance in terms of granting it access to the document (it argues that it would only be “fair” to grant it access to information on its competitor if the competitor has access to its PSURs). However, if the suspicions of the complainant as to the identity of the requester have any relevance as regards Article 4 of Regulation 1049/2001, it is to argue in favour of not releasing the name of the requester. The reasons for this conclusion are as follows.

35. When the complainant challenged EMA’s initial refusal to grant public access to the document, EMA stated that the release of the name of the company making the request might give “insights” into the requester’s “future development and business plans, putting at risk its commercial interests”. The implication of EMA’s statement is that by requesting access to Zyclara PSURs the requester is at least giving an indication that it has at least some interest in that market segment and that, possibly, it might be interested in developing a new product for that market segment. The Ombudsman notes in this respect that the job title of the person who submitted the access request was “R&D Scientist” and “Senior Regulatory Intelligence Specialist”.

36. If the requester were indeed a company that wanted to enter the market to compete with Zyclara in the future (that is, if it were a potential competitor of the complainant), it would be correct for EMA to examine carefully if releasing the name of the requester to the complainant could give any insight into that company’s specific development plans.

37. However, EMA should never make assumptions regarding this matter. , EMA could only redact the name of the company if it had specifically and carefully verified with the requester that the publication of the company name would indeed alert competitors to its specific development plans.

38. The Ombudsman has serious doubts as to whether a convincing case could in fact be made to withhold the name of such a company, since it is difficult to imagine how knowledge that a company has requested public access to PSURs could be detailed relevant actionable. In that respect, the Ombudsman notes that when replying to the Ombudsman, EMA clarified that its reference to the need to protect the commercial interests (of the requester) should have been understood as a “general and abstract statement” relating to the fact that the pharmaceutical companies have commercial interests that, in general, merit protection. It went on to state that it was not now relying on the exception set out in Article 4(2) first paragraph of Regulation 1049/2001 (the need to protect commercial interests) to justify not disclosing the name of the requester.

39. EMA has now also provided more details of its arguments related to the extra workload that “requests on requests” could generate. It stated that if it releases the names of requesters there is a risk of an increased and abusive use of Regulation 1049/2001. First, it argued that releasing the names of requesters would undermine its ability to deal with requesters who abuse the right of public access to documents by making an excessive number of requests. Second, it argued that releasing the names of requesters would allow those pharmaceutical companies that oppose the release of documents by EMA to put pressure on the requesters to withdraw their requests. It argued that both scenarios would undermine its policy, to which it is very committed, to be as transparent as possible.

40. The Ombudsman does not see merit in these arguments.

41. EMA stated that, if the names of requesters are to be released, requesters will simply not provide EMA with their identities. EMA may then have to deal with requesters who make multiple requests.

42. As regards requesters making multiple requests, the Ombudsman appreciates that this can be a genuine problem for EU institutions. In this context, the Ombudsman recognises and appreciates the efforts by EMA to deal with the voluminous and often complicated requests for access to documents in its possession. This work serves an important public interest, to build trust in the work carried out by EMA to ensure that medicines for sale in the EU are safe and effective. The Ombudsman does not underestimate the workload involved and the dedication of the staff engaged in that work. She recognises the challenges that requests for access may pose to the proper functioning an EU institutions.

43. The applicable rules also recognise the issue of multiple requests. Article 6 of Regulation 1049/2001 states that, as regards an application relating to a very long document or to a very large number of documents, the institution concerned may confer with the applicant informally, with a view to finding a fair solution. There is no practical difference between making a single request for many documents and making multiple requests, in a short period, with a view to obtaining those same documents.  EMA is thus entitled to take steps to deal with individual requesters that wish to circumvent Article 6(3) of Regulation 1049/2001 by making multiple requests in a short period. However, if requesters can hide their true identity from EMA, the application of Article 6(3) may be rendered impossible.

44. While the above concerns of EMA are genuine, the Ombudsman does not see how releasing the name of a requester exacerbates them. Even if a company seeking access to documents from EMA were to decide not to give its identity to EMA, it will still have to give contact details of a person to EMA so that EMA can respond to the access request. A requester acting in good faith will not use multiple aliases. However, if such a requester is motivated to use multiple aliases (with a view to circumventing EMA’s efforts to reach fair solutions regarding multiple requests), it will use multiple aliases. The fact that EMA has a policy of releasing the names of companies that make requests to it will make no difference as regards resolving that problem.

45. As regards the second argument, that pressure may be put on requesters to withdraw requests, the Ombudsman notes that an institution can only refuse to grant access to a document if it has specifically and individually examined whether releasing the requested document undermines a protected interest (in this case a commercial interest of a legal person, including intellectual property under Article 4(2), first indent of Regulation 1049/2001). EMA has not specified how the complainant might put pressure on the requester and has not even indicated what that pressure might consist of.

46. The Ombudsman considers, therefore, that EMA should have consulted the initial requester on whether releasing its name to the complainant would have undermined its commercial interests. On the basis of the requester’s reply, EMA should then have taken a decision on whether or not to redact the name of the requester. If the requester had asked not to release its name, EMA should have assessed, on the objective merits of the case, whether releasing the name of the requester would have undermined the requester’s commercial interests.

47. In light of the above, the Ombudsman finds that the refusal to release the identity of the pharmaceutical company requesting public access to medical data constitutes maladministration. She therefore makes a recommendation, below, in accordance with Article 3(6) of the Statute of the European Ombudsman.

Conclusion

Recommendation

Based on the inquiry into this complaint, the Ombudsman makes the following recommendation to the EMA:

EMA should review its policy of outright refusal to release the identity of organisations which make a request for public access to documents.

EMA should consult, in accordance with Article 4(4) of Regulation 1049/2001, the company which made the initial request for access and then decide whether the name of the company should still be redacted.

EMA and the complainant will be informed of this recommendation.  In accordance with Article 3(6) of the Statute of the European Ombudsman, EMA shall send a detailed opinion before 13 October 2017 on this recommendation. The detailed opinion could consist of the acceptance of the recommendation and a description of how it has been implemented.

Emily O'Reilly

European Ombudsman

Strasbourg, 07/07/2017

 

[1] Decision of the European Parliament of 9 March 1994 on the regulations and general conditions governing the performance of the Ombudsman's duties (94/262/ECSC, EC, Euratom), OJ 1994 L 113, p. 15.

[2] See Article 24(3) of Regulation 726/2004 laying down procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency (OJ 2004 L 136, p. 1)

[3] The request contains both the dates of 16 September 2015 and 29 September 2015.

[4] http://www.ema.europa.eu/ema/index.jsp?curl=pages/document_library/document_listing/document_listing_000312.jsp&

[5] Articles 11, 54, 55 and 59 of Directive 2001/83/EC.

[6] A very limited exception might arise where the testing method used is innovative. In such very exceptional circumstances, it may be necessary to redact information that might allow competitors to gain insights into the innovative testing methods. The Ombudsman notes however that most forms of testing are standardised and well-known.