Confidentiality
1. Unless otherwise provided for in this Regulation or in national legislation on confidentiality, and without prejudice to Regulation (EC) No 1049/2001, each party involved in the application of this Regulation shall respect the confidentiality of information and data obtained in carrying out their tasks in order to protect the effective implementation of this Regulation, in particular for the purpose of authorisations, inspections, investigations or Commission controls.
2. Information and data may be exchanged on a confidential basis between SoHO competent authorities and between SoHO national authorities and the Commission, and shall not be disclosed without the prior agreement of the SoHO competent authorities from whom that information originates.
3. Paragraphs 1 and 2 shall not affect the rights and obligations of the Commission, Member States and SoHO competent authorities with regard to the exchange of information and the dissemination of alerts, nor the obligations of persons to provide information under national criminal law.
4. The Commission and Member States may exchange confidential information with regulatory authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements, as necessary and proportionate for the protection of human health.
5. Without prejudice to national legislation on the publication of the outcome of SoHO supervisory activities, SoHO competent authorities may publish or make otherwise publicly available the outcome of SoHO supervisory activities regarding individual SoHO entities provided that the following conditions are met:
(a)
the SoHO entity concerned is given the opportunity to comment on the information that the SoHO competent authority intends to publish or make otherwise publicly available, prior to its publication or release, taking into account the urgency of the situation;
(b)
the information or data which is published or made otherwise publicly available takes into account the comments expressed by the SoHO entity concerned or is published or released together with such comments;
(c)
the information or data concerned is made available in the interest of public health protection and is proportionate to the severity, extent and nature of the associated risk;
(d)
the information or data made publicly available does not unnecessarily undermine the protection of legal rights of the SoHO entity or any other natural or legal person;
(e)
the information or data made publicly available does not undermine the protection of court proceedings and legal advice.
6. Regarding information or data that is, by its nature, covered by professional secrecy and that is obtained by SoHO competent authorities in carrying out SoHO supervisory activities, SoHO competent authorities may only publish or make that information or data publicly available, without prejudice to national legislation, provided that the conditions laid down in paragraph 5, point (c), are met.
Data protection
1. Personal data required for the application of Article 5(5), Article 9(4), Articles 33 and 34, Article 35(3), points (a) and (b), Article 36(3), Article 39(2), point (a), Article 46(2), Article 64 and Article 68(3) shall be collected for the purpose of identifying the relevant contact persons within the relevant SoHO entities, SoHO competent authorities or delegated bodies, and shall only be processed further for the purpose of ensuring the administration and transparency of the SoHO supervisory activities and SoHO activities concerned.
2. Personal data, including data concerning health, exchanged through the EU SoHO Platform and required for the application of Articles 73 and 74 shall, where necessary, be processed in the interest of public health and for the following purposes:
(a)
to help to identify and evaluate risks associated with a particular SoHO donation or SoHO donor;
(b)
to process relevant information on clinical-outcome monitoring.
3. Personal data, including data concerning health, required for the application of Articles 33, 34, 39, 42 and 44, Article 53(1), points (e) and (f), Article 53(3), and Article 58(13), (14) and (15), shall only be processed for the purpose of ensuring quality and safety of SoHO and protecting the concerned SoHO donors, SoHO recipients and offspring from medically assisted reproduction. Those data shall be directly related to the performance of the supervisory activities and SoHO activities concerned and be limited to the extent necessary and proportionate for that purpose.
4. All information shall be processed by the Commission, Member States, SoHO competent authorities, including SoHO national authorities, delegated bodies, SoHO entities and any third party contracted by a SoHO entity, as applicable, in such a way that the personal data of the subjects remain protected in accordance with the applicable legislation on personal data protection. They shall, in particular, minimise the risk that subjects can be identified and shall limit the information processed to elements necessary and appropriate for carrying out their tasks and fulfilling their obligations under this Regulation.
5. The Commission, Member States, SoHO competent authorities, including SoHO national authorities, delegated bodies, SoHO entities and any third party contracted by a SoHO entity, shall implement appropriate technical and organisational measures to protect information and personal data processed, including health data, against unauthorised or unlawful access, disclosure, dissemination, alteration, destruction or accidental loss, in particular where the processing involves transmission over a network.
6. In relation to their responsibilities to process personal data to comply with the obligations of this Regulation, SoHO entities and SoHO competent authorities of the Member States shall be regarded as controllers as defined in Article 4, point (7), of Regulation (EU) 2016/679.
7. In relation to its responsibility to establish and manage the EU SoHO Platform, as referred to in Article 73 of this Regulation and the processing of personal data, including health data, that might result from that activity, the Commission shall be regarded as a controller as defined in Article 3, point (8), of Regulation (EU) 2018/1725.
8. For the purposes of this Article, the Commission is empowered to adopt delegated acts in accordance with Article 77 to supplement this Regulation by laying down the retention periods for personal data, including health data, as appropriate to their purpose and specific criteria that would allow identification of data relevant for public health protection as referred to in paragraph 2 of this Article.
Exercise of the delegation
1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.
2. The power to adopt delegated acts referred to in Article 26(7), Article 47(4), Article 53(5), Article 58(16) and Article 76(8) shall be conferred on the Commission for an indeterminate period of time from 6 August 2024.
3. The delegation of power referred to in Article 26(7), Article 47(4), Article 53(5), Article 58(16) and Article 76(8) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.
5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.
6. A delegated act adopted pursuant to Article 26(7), Article 47(4), Article 53(5), Article 58(16) or Article 76(8) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of 2 months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by 2 months at the initiative of the European Parliament or of the Council.
Urgency procedure
1. Delegated acts adopted under this Article shall enter into force without delay and shall apply as long as no objection is expressed in accordance with paragraph 2. The notification of a delegated act to the European Parliament and to the Council shall state the reasons for the use of the urgency procedure.
2. Either the European Parliament or the Council may object to a delegated act in accordance with the procedure referred to in Article 77(6). In such case, the Commission shall repeal the act immediately following the notification of the decision to object by the European Parliament or by the Council.
Committee procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and Article 5(4), third subparagraph, of Regulation (EU) No 182/2011 shall apply.
3. Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply.
Penalties
Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, by 7 August 2029, notify the Commission of those rules and of those measures and shall notify it, without delay, of any subsequent amendment affecting them.
