European Union Product Liability Law and its (Uncertain) Future – Some Thoughts on LF v. Sanofi Pasteur case

Magdalena Tulibacka, Director of the Center of International and Comparative Law, Visiting Assistant Professor of Practice, Emory Law School 

Photo credit: Pexels, via Wikimedia commons

 

It is difficult to overstate the importance of the forthcoming judgment of the European Court of Justice (ECJ) in LF v. Sanofi Pasteur.¹ The judgment, if it follows the recent opinion of ECJ’s Advocate General (AG) Medina,² is likely to create a major shift in the system of liability established by the EU’s Product Liability Directive (PLD).³

Three questions referred to the ECJ by the Court of Appeal of Rouen arose in a case involving a vaccine produced by Sanofi Pasteur. The case concerns a type of a health injury referred to by the French court as a progressive condition.⁴ The claimant started experiencing pain and other health complaints after being vaccinated. Her condition kept getting progressively worse. Even accounting for the continued worsening of LF’s health, however, it is somewhat puzzling how long it took for the case to reach the courts.⁵ It appears that LF waited 11 years from the time of appearance of first symptoms and 7 years from the diagnosis of her condition to commence proceedings before a compensation scheme, which rejected the claim because of lack of causal link,⁶ and 3 further years to bring a lawsuit against Sanofi.⁷ As held by two French courts considering this case, following Article 1245-15 and 1245-16 of Code Civil (implementing the provisions of the PLD on limitation periods), LF’s actions were thus time-barred.⁸

The Cour de Cassation, however, decided to refer the case back to a Court of Appeal of Rouen to test some of the recent arguments that appeared in its own jurisprudence and in judgments of other courts against the application of limitation periods in other domestic regimes when progressive conditions are concerned.⁹

In order to enable LF’s case against Sanofi to proceed, the Court of Appeal asked first of all whether a potential victim of a defective product could bring a case against its manufacturers based on fault in lack of vigilance and lack of information about the risks of using the products. This is very difficult to reconcile with the PLD - a system that does not allow any other general product liability system functioning on the same basis to exist. The primary reason that this question arose in the case seems to be that French law has more generous time limits for general tort liability claims, and thus LF could still arguably bring her claim against Sanofi.

The two remaining questions relate to the system of liability established by PLD and implemented into French law, and specifically its limitation periods and their application in cases of progressive diseases. The questions can be summarized as follows:

Does the PLD’s 10-year long stop period comply with the right to an effective remedy as provided in Article 47 of the EU’s Charter of Fundamental Rights,¹⁰ when it applies to cases of progressive conditions?

Does the Directive allow for the 3-year limitation period to start, in cases of progressive injuries, when the injury or condition has stabilized, not when the claimant knew or should have known about it, as indicated in PLD?

These questions push the boundaries of what the system of the Directive established. With its strict liability for property damage, personal injury and death caused by defective products, the PLD introduced one of the world’s most influential and comprehensive product liability systems. The Directive aims to be a complete system of liability rules, carefully balancing the variety of interests involved: the interests of victims of defective products, the industry, and even society as a whole. Recently, the PLD experienced a major overhaul, and a new Directive was enacted, bringing the European product liability law into the digitalized, increasingly complex market reality.¹¹ The new rules are not yet in force and do not apply in the case at hand, but they do reflect the current consensus on the whole system. The changes related to limitation periods will be described below.

The Directive continues to rely on national laws of EU Member States for interpretation and application of major elements of liability, such as defect, damage, and causal link. It also co-exists with other national contractual and non-contractual liability systems as well as compensation schemes for redress of damage caused by defective products. It is at this juncture – the interaction with the national systems of laws and remedies – that many questions arise, this case being a good example.

In response to the French court’s questions, the AG suggests that the ECJ ought to conclude as follows:

-          Victims of defective products can bring actions against the producers of these products using national tort-based, fault-based liability, as long as the alleged fault consists of factors not exclusively related to defectiveness of the product (like failures in vigilance).¹²

-          The ten-year long stop introduced in the Directive is invalid in the light of Article 47 of the EU’s Charter of Fundamental Rights, ‘in so far as its application has the effect of extinguishing the right to claim compensation of injured persons suffering from a progressive disease who, according to medical evidence, due to the progressive nature of their medical condition, cannot fully evaluate the damage caused to them and have therefore been unable to initiate proceedings against the producer within that period, thereby depriving those persons of their right of access to a court’.¹³

‘In the situation of a progressive disease, the three-year limitation period established in that provision starts to run on the date of stabilisation of the damage, defined as the moment from which, according to medical evidence, the condition of the injured person is no longer evolving.’¹⁴

For some context: the French system continues to challenge the maximum harmonization the PLD was meant to ensure. As regards the implementation of the PLD, France was reprimanded by the ECJ for late and then improper implementation and needed to amend its law.¹⁵

Further, the French tort liability system, and to some extent even its contractual liability, historically presented a more attractive option for victims of defective products.16 The French product liability law was developed by courts in the overall consumer-friendly climate, where the key role of liability rules was for victims of defective products to be compensated, as mostly strict liability of manufacturers and suppliers.¹⁷ French courts were open to abandoning the requirement of proving fault, as well as to adopting presumptions of causation and defect in product liability cases – the approach that is not common among other EU Member States.¹⁸ As mentioned above, the general tort liability system in France provides more generous limitation periods as well. It is thus not difficult to understand why some victims may wish to resort to this general liability system instead of the one established by the implementation of the PLD.

 

Reflecting on question 1.

In reference to the interaction between the PLD and the national liability systems, the AG’s opinion reflects a unique conundrum. While the Directive was not meant to be the only system of liability where victims of defective products could recover compensation, it is the only system of objective (‘defect-based’)¹⁹ liability for such products. Within the scope of liability as set out by the Directive, its rules constitute the threshold and the ceiling. Article 13 PLD provides that the Directive does not affect any rights an injured person may have according to the rules of contractual and non-contractual liability or a special liability system. This provision was further elucidated in ECJ’s jurisprudence. In Gonzalez Sanchez the Court highlighted that liability systems based on other grounds: such as fault or a warranty in respect of hidden defects, could remain it operation.²⁰ In Commission v France, a general product liability system different from that provided by the Directive was held not permissible.²¹ According to Gonzalez Sanchez, as confirmed by the AG in the current case, the Directive is the exclusive source for cases where the liability follows a defective product (as defined by PLD) causing damage or injury a person.²² Fault is not relevant in this system. The notion of defect as provided by the Directive focuses on lack of safety.²³

The AG’s argument that resorting to general tort liability rules should be possible if it could be established that the defendant was at fault by failing in its vigilance duties, however, is not very convincing. If the essence of the defendant’s fault is lack of vigilance over the product and the alleged lack of reaction (perhaps by pulling the vaccine off the market), is not the lack of safety in the product the condition si ne qua non here? Safety and vigilance seem to be very closely tied in European law. Within the context of product liability, courts cannot deem that there was a failure in vigilance without also assessing whether there was a defect (lack of safety). The AG suggests that fault in this case consists of factors not exclusively related to defectiveness of the product.²⁴

But surely, monitoring of the product’s safety once it enters the market is a requirement that features heavily in European Union laws on product safety. Pharmaceutical products carry a uniquely stringent set of requirements as regards monitoring. Further, in the context of product liability, failure to warn of potential risks, rather than being some additional criterion or requirement, is a feature of defect. Even though the PLD does not recognize the US-style ‘boxing’ of types of defects (into manufacturing, failure to warn and design defects), those three types are widely recognized in literature and jurisprudence across the EU and beyond.

In my opinion, the AG’s recommendations in this matter do not comply with the text of the Directive and the nature and spirit of product liability law as established by it.

 

Reflecting on Questions 2 and 3:

Let us now move to the question of limitation periods under the Directive. Generally, legal systems distinguish two types of limitation periods:

-          What we can call ‘ordinary’ limitation periods - procedural in nature and often, in product liability cases, dependent on subjective discovery of the injury/damage and the person responsible or liable to redress it. This moment of subjective discovery is also when the cause of action accrues.

-          Long-stops (also referred to as preclusion, prescription, long-stop, or repose) - more substantive in nature (in some systems, such as the PLD, a long stop is referred to as a period after which the claimant’s rights are extinguished), and dependent on objective criteria, not on the subjective position/situation of the claimant.

Factors at play in the determination of these periods can be broadly classified into the following categories:

-          Substantive, constitutional and fundamental rights arguments: legal certainty and rule of law, finality, fair trial, access to justice and effective remedy,

-          Procedural and evidential arguments: effect of the passing of time on availability of evidence, and

-          Economic arguments – ‘closing the books’, calculation of risk and liability exposure, obtaining affordable insurance coverage.

In summary: determination of limitation and expiry periods is always a product of compromise between the plaintiff and the defendant interests, but also wider social interests in justice being done on the one hand and in encouraging progress and development of new products on the other hand. Such a compromise has been established in the PLD. It has remained in place till today and survived the comprehensive reform of the Directive in 2024, with some changes.

In the old PLD, claimants can bring product liability suits within 3 years from when they became aware, or should reasonably have become aware, of the damage, the defect and the identity of the producer. Further, the rights under the Directive expire 10 years from when the product was placed into circulation.²⁵ In the new PLD, the 3-year limitation period has been retained virtually unchanged. The 10-year long-stop is now called ‘expiry period’. It has also been retained largely unchanged (with the modification of the start of the period for substantially modified products). However, an exception was introduced where an injured person is not able to initiate proceedings within 10 years due to the latency of her injury. The period in such cases is extended to 25 years.

The French Court’s questions address both the limitation period and what is now called the expiry period. With regard to the latter, the question is whether its very existence is contrary to Article 47 of the EU Charter of Fundamental Rights as regards progressive conditions. The Charter, as part of the Treaties and thus primary EU law, can be the basis for a constitutional review by the ECJ of any legally binding EU measure. Any secondary EU law, including the PLD, which does not comply with its requirement that everyone whose rights guaranteed by EU law were violated should have access to an effective remedy (Article 47), can be declared at least partially void.

The opinion of the AG recommending exactly such an outcome should be looked at in the context of the views of the ECtHR. In its 2020 judgment in Sanofi v. France and in an earlier judgment in Howard Moor v Switzerland the ECtHR held that the long-stop violated the right to access to justice of victims who suffered from latent diseases.²⁶

The recent amendment of the PLD extending the expiry period to 25 years for latent conditions addresses these concerns, albeit unfortunately the new PLD does not provide a definition of latency leaving its determination to national law. It is possible that even this longer period may not always be sufficient, as certain products may well cause injuries and diseases with a much longer latency period than 25 years. Perhaps the period will need to be extended in the future for some latent conditions, but we are not ready to abandon it entirely. We are also not ready to leave the decision whether or not it applies to courts if the conditions are already present but, according to the claimant’s doctors, may not have stabilized. The long-stop (expiry period) constitutes one of the fundamental elements of the balance of consumer-business interests set out by the PLD. Any amendments to it will no doubt cause a push-back from the industry side and calls for rebalancing the whole system. Especially amendments that have their roots in undefined legal and medical concepts.

What is particularly concerning in the case at hand is that the AG is willing to allow the unique approach adopted by some French judiciary for progressive conditions to be used in cases based on the Product Liability Directive, potentially extending its effect across other EU Member States. The question of progressive injuries is itself problematic. Further, this approach focuses on an (as yet undefined) concept of ‘stabilization’.

I will now address both these concepts and their application to limitation periods.

Progressive conditions mean that the injury is known for some time, albeit not in its entirety. The French argument is that the claimant will not be able to assess the full extent of the damage while her condition keeps developing, and thus, no limitation period should be running until the claimant’s condition ‘stabilizes’.²⁷ The notion of a progressive condition or disease is not defined in the Directive. It is also unlikely that the ECJ would provide such a definition, as it is rather a medical and a case-specific term. Thus, the exact meaning would be determined by doctors within each EU state – and that’s what the AG seeks to avoid.

If one were to agree with the opinion of the AG addressing questions 2 and 3, it would mean that for progressive diseases the only limitation period is three years from the moment when the claimant’s doctors conclude that her condition has stabilized (as the ten-year period would be disapplied). The AG’s argument that an EU-level approach is needed in such cases and the response cannot be left to Member States, should be commended but what she suggests is, in my view, the wrong way to approach this.

It seems from the submissions by the German government in the case that the problems with the progressive diseases and the resulting limitations in access to remedy may well be a problem with the French system. While it is a fact that provisional damages are normally not available in civil law systems, such systems have other ways in which victims can bring suits before their injuries present themselves in their entirety (such as bringing declaratory actions). Suits can be brought while the claimant’s condition is developing, and courts can assess potential future damages as part of the compensation award. Additional suits can potentially be brought as follow-on actions when new conditions develop, or the existing condition worsens beyond what was initially predicted. The text of the AG’s opinion contains statements to the effect that French law, in contrast to other legal systems in the EU, does not allow claims for compensation of future damages or provisional damages. It seems to also indicate that the claimant may not be able to bring follow-on claims. If that is indeed the case, there is a significant systemic problem in French rules of damages. But a more likely answer is that, in France, there are options for assessing of future damages and taking them into account in the final determination of compensation amounts due to the claimant, and there are also possibilities for bringing follow-on claims.

The application and enforcement of substantive rights granted by EU law has always been dependent on national remedial and procedural rules, subject to the requirements of effectiveness and equivalence. Here this principle is applied backwards – the AG is allowing the perceived deficiencies in these national systems to cause the whole, carefully constructed compromise of PLD to be shaken. Would it not be a better idea for the ECJ to request that only French law is clarified in this respect, thus maintaining the coherence of the whole PLD system across the EU?

The French requirement that the limitation period does not start running until the claimant’s disease has ‘stabilized’, was already subject to a judgment by the ECtHR, where Sanofi challenged France alleging that Article 6.1 of the European Convention of Human Rights (right to fair trial) was violated. The ECtHR concluded that France was within the limits of the discretion (margin of appreciation) granted by the Convention when it allowed the limitation period to be approached in this way by its courts.²⁸ This judgment was issued in a different legal context – specifically one where the ECHR is known for granting the states-parties a certain margin of appreciation. Here, in the context of the EU PLD, the discretion is severely limited.

Keeping the start of the limitation period flexible and subject to the decision of the doctor and the court in each case to the extent suggested by the AG can potentially create uncertainty. It is problematic from the perspective of access to evidence, the question of who has the power to determine ‘stabilization’, and the rights of the defendants.²⁹ It can also lead to potentially undesirable consequences of depriving the victim of a defective product of access to a remedy. The way the start of the ordinary limitation periods is usually understood is that it means the cause of action accrued. If the cause of action does not accrue until the person’s condition ‘stabilizes’, could it not be argued that patients who do not wish to wait for this moment do not have a claim? Would this not deprive many victims of access to remedy for a potentially long time, and often for the rest of their life?

Another point worth noting is that if we allow victims of defective products to wait with bringing cases until their condition has stabilized, which can mean after their death, we may be leaving the defendants in a position where they are to expect lurking lawsuits, usually by families of people who died. Thus, if the ECJ were to adopt the AG’s suggestion in this respect, perhaps it would be advisable to introduce a notification requirement into the PLD for such situations, such as the one in the Payment Services Directive, recently interpreted by the ECJ.30 If we take the need for an effective remedy into account, it may be a more effective, and more proportionate, response to require the claimant to notify the defendant of their injury, even if the latter is still progressing. Such a step would provide the defendant with the knowledge of the claim and some level of clarity, as well as provide the claimant with the certainty that their claim will not be time barred. Further, the notification could provide an encouragement for the parties to settle.

 

Conclusions:

In spite of the recent comprehensive reform of the PLD, some very important parts of the European Union product liability system are by no means settled, thus creating uncertainty for potential plaintiffs and defendants. This comment cautions against following the AG’s opinion because, while it may assist the claimant (LF) in her case, it could create a destabilizing effect on the EU-wide product liability system. The AG’s recommendations in this case are a concern. In a reality where European legal systems - through their legislators and courts – continue to face difficult cases of injuries, they are bound to experiment, introduce new systems, new rules, and new ways of interpretation and application of the existing rules. Perhaps it is not realistic to expect that PLD will fully achieve its objective of harmonization, and PLD is playing ‘catch up’ with national systems – the latest reform is an example. But the system should remain stable, and such national experimentation can threaten this stability.

The arguments raised in this comment are particularly notable after the new EU Directive on Representative Actions came into force. Product liability cases can now be brought using a pan-EU representative procedure. With some major private international law issues still unresolved, there will be scope for forum shopping. If we allow national peculiarities to remain part of the product liability system to the extent suggested by the AG in LF v. Sanofi Pasteur, we increase the risk of forum shopping.

 

¹ Case C-338/24, LF v. Sanofi Pasteur SA, Request for a preliminary ruling from the Cour d’appel de Rouen (France) lodged on 7 Mary 2024, https://eur-lex.europa.eu/eli/C/2024/4716/oj/eng.

₂ Opinion of AG Medina delivered on 19 June 2025.

³ Council Directive 85/374/EEC on the approximation of the laws, regulations and administrative provisions of the Member States concerning liability for defective products, OJ L 210, 7.8.1985, pp. 29-33, recently replaced by Directive (EU) 2024/2854 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC, OJ L 2024/2853, 18.11.2024; in the text of this comment: ‘PLD’ or ‘the Directive’ and ‘new PLD’ or ‘new Directive’.

⁴ No precise definition of such a progressive disease is provided, except for it being a condition that develops over a long period (para. 53 of the AG Opinion, see note 2).

⁵ LF received the Revaxis vaccine manufactured by Sanofi Pasteur in 2003. One explanation advanced in the case indicates that a residual amount of aluminum hydroxide (detected in LF’s body), used in certain vaccines, could have caused her condition.

⁶ The Board for Conciliation and Compensation for Medical Accidents is a French no-fault compensation scheme: Commission de Conciliation et d’Indemnisation des Accidents Medicaux (CCI). Her claim was rejected by CCI following an assessment by the expert appointed in the case who did not find a causal link.

⁷ LF’s condition was deemed stabilized 8 years after her diagnosis. In 2020 LF brought a lawsuit against Sanofi Pasteur, based on tort liability (fault liability - Article 1240 Code Civil), and strict product liability (Article 1245 Code Civil). The lawsuit was dismissed by the Court of Alençon and then by the Court of Appeal of Caen because LF’s claims were time-barred. Under the Code Civil, in the provisions implementing the PLD (Articles 1245-15 and 1245-16, implementing Articles 10 and 11 PLD) a claimant in a product liability case must bring a claim within three years from the date on which she was aware or ought to have been aware of the defect, the damage and the identity of the defendant. Further, in actions based on strict product liability there is a strict ten-year time limit (starting on the date when the product was placed on the market). The Cour de Cassation overturned the Court of Appeal’s decision and referred the case to the Court of Appeal of Rouen.  

⁸ As per Articles 10 and 11 of the current PLD, see below for analysis.

⁹ As per some previous judgments: Cass 1ère civ. 1 June 1999, B. 178; Cass. 2ème civ., 4 May 2000, no. 97-21.731; Cass 2ème civ. 11 July 2002, no. 01-02.182). The Cour de Cassation’s held that, in the event of an action for damages seeking compensation for bodily injury, the limitation period could only start running on the date when the damage has ‘stabilized’. Only then, according to the Court, the claimant would be able to assess the complete scope of her damage or injury.

¹⁰ Article 47 of the Charter provides for the right to an effective remedy: ‘Everyone whose rights and freedoms guaranteed by the Law of the Union are violated has the right to an effective remedy before a tribunal …’.

¹¹ See n. 3.

¹² C-338/24, AG Opinion, para. 43.

¹³ C-338/24, AG Opinion, para. 105.

¹⁴ C-338/24, AG Opinion, para. 124.

¹⁵ For instance, in Case C-52/00 Commission v. France, Judgment of 25 April 2002.

¹⁶ J.S. Borghetti, The development of product liability in France, in S. Whittaker (ed.) The development of product liability, Volume 1, Cambridge University Press, 2010, pp. 87-113., at p. 98.

¹⁷ Ibid. J.S. Borghetti, The development of product liability in France.

¹⁸ This approach was accepted by the ECJ as in line with the PLD in C-621/15 NW, LW, CW v. Sanofi Pasteur MSD SNC, judgment of 21 June 2017. Presumptions of defect and causation were also introduced in the new PLD: see Article 10.

¹⁹ H. Taschner, ‘Product liability: Basic problems in a comparative law perspective’, in Fairgrieve, D. (ed.), Product Liability in Comparative Perspective, Cambridge University Press, Cambridge, 2005, pp. 155 to 166, at p. 161.

²⁰ Case C-183/00 Gonzalez Sanchez v. Medicina Asturiana SA, Judgment of 25 April 2002, para. 31.

²¹ Case C-52/00 Commission v. France, Judgment of 25 April 2002.

²² AG Opinion, para. 36. See note 2.

²³ As defined in Article 6 of the old PLD.

²⁴ C-338/24, AG Opinion, (para. 48).

²⁵ Articles 10 and 11 old PLD, Articles 16 and 17 new PLD.

²⁶ ECtHR in Sanofi Pasteur v France, 2020. In Howard Moor, the court held that, ‘where it is scientifically proven that a person is unable to know that they are suffering from a certain illness, such circumstances should be taken into account when calculating the limitation period or statute of limitations.’ Elimination of a long-stop is not merely a European idea: for instance some U.S. states’ supreme courts struck down as unconstitutional the periods of repose in all product liability cases or only in cases of personal injuries. See: “50-State Survey of Statutes of Limitations and Repose in Prescription Product Liability Cases”, JD Supra, 2020.

²⁷ LF – the claimant in the French case – has indeed, according to her doctors, stabilized.

²⁸ This case involved the general tort liability system.

²⁹ For instance – it would be more difficult to assess liability risks for the purpose of obtaining insurance.

³⁰ Case C-665/23 IL v. Veracash SAS, Judgment of 1 August 2025.

 

 

 

As long as the system of remedies and the objectives are not undermined: The Court of Justice on GDPR enforcement (Case C-21/23, Lindenapotheke)

 

 

 

Alessandra Fratini and Giorgia Lo Tauro, Fratini Vergano European lawyers

Photo credit: via Wikimedia Commons

Introduction

On 4 October 2024, the Grand Chamber of the Court of Justice of the European Union issued its judgment in Lindenapotheke (Case C-21/23), a case concerning the online sale of pharmacy-only medicinal products and its implications as regards GDPR compliance. In its request for a preliminary ruling, the German Federal Court of Justice (Bundesgerichtshof) raised two questions on the interpretation of the GDPR. While acknowledging the importance of the second question on the meaning of ‘data concerning health’, this post focuses on the first one, concerning the compatibility of the system of remedies established in Chapter VIII GDPR with other remedies under national law. The paragraphs below, after a short overview of the facts of the case and the preliminary questions, review the main findings of the Advocate General and of the Court of Justice on the first question and conclude by placing the judgment within the rising trend of addressing the challenges of digital markets through a broader enforcement of EU digital regulation.

 

Facts of the case and questions referred

The main proceedings involved two competitors operating pharmacies in Germany, ND and DR. ND, which operates a pharmacy under the trade name ‘Lindenapotheke’, has been selling pharmacy-only medicinal products via the ‘Amazon-Marketplace’ online platform since 2017.

DR brought an action before the German Regional Court seeking an order for ND to cease selling pharmacy-only medicinal products via the online marketplace on the basis that such marketing constituted an unfair commercial practice in so far as it was pursued in breach of Article 9 GDPR, which requires that the data subject’s prior explicit consent be obtained for the processing of data concerning health. According to the German law against unfair competition, in fact, “anyone who infringes a statutory provision intended, inter alia, to regulate market conduct in the interest of market players acts unfairly where that infringement is capable of having an appreciable adverse effect on consumers, other market players or competitors”; such an infringement constitutes a prohibited unfair commercial practice enabling any competitor to claim an injunctive relief (paras. 21-23 of the judgment). The Regional Court upheld the action and the subsequent appeal brought by ND was dismissed by the Higher Regional Court, which held that such an online marketing was contrary to the national law against unfair competition. ND lodged an appeal on a point of law before the German Federal Court of Justice, which raised a request for a preliminary ruling on the interpretation of Chapter VIII and Article 9(1) GDPR, but also Article 8(1) of Directive 95/46 (the previous data protection Directive) before the Court of Justice.

Question 1

With its first question, the referring court asked the Court of Justice whether a competitor, who is not a data subject within the meaning of Article 4(1) GDPR, has standing to bring an action before the civil courts against the alleged infringer of the GDPR, on the basis that the alleged infringement falls within the prohibition of unfair commercial practices. The referring court noted that the provisions of Chapter VIII GDPR do not mention, nor do they explicitly exclude, the possibility for competitors to bring an action against an undertaking, where the infringement of data protection law constitutes an unfair commercial practice (para. 35). The referring court underlined the uncertainty of the situation and highlighted both the risks of recognising such a possibility for competitors, in terms of potential encroaching on the powers of the supervisory authorities and ensuing divergences, and its potential benefits in terms of ‘effet utile’ to ensure the highest level of data protection (paras. 36-39).

Question 2

With its second question, the referring court asked the Court of Justice to clarify whether the data which customers must enter on the online sales platform when ordering medicinal products (such as name, delivery address and information required for individualising the medicinal products ordered) constitute ‘data concerning health’ within the meaning of Article 8(1) of Directive 95/46 and Article 9(1) GDPR. In particular, the doubts of the referring court concerned non-prescription medicinal products, since these may be intended not necessarily for the customers but for third parties, who may not be identifiable (para. 41).

In the opinion of the referring court, the questions of a competitor’s standing to bring proceedings (para. 39) and of the notion of ‘special categories of personal data’ (para. 43) had not been clarified by the case-law of the Court of Justice and warranted its request for a preliminary ruling.

 

The Opinion

In his Opinion, Advocate General Szpunar first changed the order of the proposed questions, as he considered that if the answer to the second one were to be negative, there would be no need to answer the first one (para. 31 of the Opinion). Addressing the second question at the outset, the AG suggested to answer that “the data of the customers of a pharmacist which are transmitted when an order is placed on an online sales platform for pharmacy-only but non-prescription medicines do not constitute ‘data concerning health’ within the meaning of Article 4(15) and Article 9 of the GDPR, in so far as only hypothetical or imprecise conclusions as to the health status of the person placing the online order may be drawn, which it is for the referring court to verify” (para. 54).

In the light of that proposed negative answer, the first question was dealt with in the Opinion only for the sake of completeness. Having acknowledged that the GDPR confers no rights on undertakings and their competitors, as that regulation grants rights only to data subjects (paras. 79-81), the AG assessed whether the GDPR system of remedies has to be seen as an exhaustive system, in the sense that it precludes undertakings from relying on a GDPR infringement in the context of other remedies provided for by national law (paras. 82-89).

First, he noted that the action at issue in the main proceedings was not based on a GDPR infringement, but took such an infringement into account in an incidental manner. The Court already accepted, in its judgment in Meta Platforms and others (2023), that data may be taken into account in an incidental manner and that an infringement of the GDPR may constitute an infringement of competition law (paras. 90-91), and the AG considered that was applicable to the present case (para. 91). Second, as regards the interaction between national actions in which the GDPR can be invoked incidentally and the GDPR system of remedies, the AG observed that the former should be accepted only on condition that they do not undermine the GDPR system of remedies or the attainment of its objectives (para. 95). In the present case, since an action brought by an undertaking against a competitor is not intended to ensure respect for the data subjects’ rights but pursues another objective, the actions made available to data subjects by the GDPR system of remedies are preserved and may still be exercised in those circumstances (paras. 100-101). Furthermore, in the AG’s view, the objectives pursued by the GDPR, such as the high level of protection of natural persons and the consistent and homogenous application of the data protection rules (recital 10), are not threatened (but, as for the high level of protection, actually strengthened) by the possibility afforded to an undertaking to bring an action for an injunction against a competitor based on the prohibition of acts of unfair competition, in reliance on a GDPR infringement by that competitor (paras. 103-104). Finally, the AG noted that, far from being undermined, the effectiveness of the GDPR would be reinforced by the fact that compliance with its provisions may also be enforced in judicial proceedings distinct from those within its system of remedies. Accordingly, he concluded that such national remedies may exist alongside the system established by the GDPR (paras. 105-108).

 

The Judgment

The Court of Justice considered the questions in the order they were raised by the referring court and departed from the Opinion with regard to the answer to the second question.

To address the first question, the Court interpreted the relevant provisions of Chapter VIII GDPR by relying on their wording, the context and the objectives pursued by the GDPR (para. 52 of the judgment). As to the wording, the Court noted that not only the provisions of Chapter VIII do not expressly rule out the possibility for additional national remedies, but the rights provided for by Article 77(1), Article 78(1) and Article 79(1) are ‘without prejudice’ to any other administrative, judicial or non-judicial remedy (para. 53). When it comes to the context, while it agreed with the AG that only data subjects are beneficiaries of the GDPR protection, the Court noted in addition that the infringement of its substantive provisions is also liable to adversely affect third parties (in this sense, it referred to the right to compensation provided for by Article 82(1); para. 55). The Court recalled that it had already held that the infringement of data protection rules may at the same time give rise to an infringement of rules on consumer protection or unfair commercial practices (judgment in Meta Platforms Ireland, 2022, para. 78) and may be “a vital clue” in the assessment of an abuse of a dominant position (judgment in Meta Platforms and others, 2023, para. 47) (para. 55). It also noted the importance of access to personal data and the ability to process such data, which “have become a significant parameter of competition between undertakings in the digital economy”, so that it may be necessary to consider rules on data protection when enforcing competition law and the rules on unfair commercial practices (para. 56).

Interestingly, while the above would have been sufficient to interpret Chapter VIII in the light of the context, the Court went further to consider the margin of discretion enjoyed by Member States in the implementation of the GDPR. In this respect, even though the GDPR “seeks to ensure the harmonisation of national legislation on the protection of personal data which is, in principle, full, the fact remains that several provisions of that regulation expressly make it possible for Member States to lay down additional, stricter or derogating national rules, which leave them a margin of discretion as to the manner in which those provisions may be implemented (‘opening clauses’)”(para. 57). After referring to its judgment in Meta Platforms Ireland (2022, para. 57), which concerned a provision of the GDPR (Article 80) expressly containing an opening clause, the Court added: “It is true that the provisions of Chapter VIII of the GDPR do not specifically provide for such an opening clause which would expressly allow Member States to make it possible for a competitor of an undertaking which allegedly infringes the substantive provisions of that regulation to bring an action in order to put an end to that infringement. However, it follows from the wording and context of the provisions of Chapter VIII (…) that, by adopting that regulation, the EU legislature did not intend to bring about an exhaustive harmonisation of the remedies available in respect of infringements of the provisions of the GDPR and, in particular, did not wish to rule out the availability of such remedies to competitors of the person allegedly responsible for an infringement of the laws protecting personal data, on the basis of national law relating to the prohibition of unfair commercial practices” (paras. 59-60, emphasis added).

In the Court’s view, that interpretation was corroborated by the GDPR objectives (i.e., ensuring a consistent and high level of protection of natural persons with regard to the processing of personal data and removing obstacles to the flow of such data within the EU; strengthening of the rights of data subjects and of the obligations of those who process and determine the processing of data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States; providing natural persons in all Member States with the same level of legally enforceable rights and obligations and responsibilities for data controllers and processors, and ensuring consistent monitoring of the processing of personal data, and equivalent sanctions in all Member States) (para. 61). It found therefore that the possibility of national remedies like those at stake does not undermine those objectives but actually enhances the effectiveness of the GDPR provisions (para. 62). These national remedies are in addition to those of Chapter VIII and pursue an objective (fair competition) which is different from those pursued by the GDPR. In this context, as the German government observed, the uniform interpretation of the GDPR remains ensured by the preliminary ruling procedure under Article 267 TFEU (paras. 65-67). Furthermore, the Court held that national remedies aimed at ensuring fair competition undoubtedly contribute to compliance with the GDPR and, therefore, to strengthening the rights of data subjects: an application for injunctive relief filed by a competitor may also prove particularly effective in so far as it may prevent a large number of infringements of data subjects’ rights (paras. 69-70).

In the light of the above, the Court concluded that Chapter VIII does not preclude national legislation providing for such remedies to the benefit of competitors, while leaving to the referring court the assessment of whether the alleged infringement of the GDPR, in so far as it is established, also constitutes a breach of the prohibition of unfair commercial practices under the relevant national law (paras. 71-72).

As to the second question, suffice it to say that the Court, unlike the AG, found that the information which customers enter when ordering online pharmacy-only medicinal products, the sale of which does not require a prescription, does constitute ‘data concerning health’ even where it is “only with a certain degree of probability, and not with absolute certainty, that those medicinal products are intended for those customers” (para. 90). This, however, does not preclude it from being processed, in specific contexts, if the conditions for exemptions are met (para. 92), i.e. does not mean automatically that the processing is in breach of the GDPR.

 

Concluding remarks

The judgment in Lindenapotheke, as far as the first question is concerned, provides an interpretation of the GDPR system of remedies aimed at enhancing the effectiveness of data protection. The remarkable point of the reasoning is the emphasis placed on the margin of discretion recognised to Member States in implementing the GDPR, with a view to enhancing the protection afforded by it. While in Meta Platforms Ireland (2022) the Court could rely on the wording of the provision concerned (para. 59: “(…) Article 80(2) of the GDPR, which leaves the Member States a discretion with regard to its implementation. (…) Member States must make use of the option made available to them by that provision to provide in their national law for that mode of representation of data subjects”), in Lindenapotheke it admitted that Chapter VIII does not expressly provide for any opening clause allowing Member States to make available further remedies for actors other than data subjects invoking a GDPR infringement. However, by relying on the wording and context of Chapter VIII, as well as on the legislator’s intention and the GDPR objectives, it came to the conclusion that Member States can make available such remedies to competitors of the person allegedly responsible for an infringement of the laws protecting personal data, since such a possibility is not being ruled out by the GDPR system of remedies and its objectives (paras. 60-61). The Court’s interpretation actually seems to encourage Member States to make additional remedies available under national laws, insofar as they enhance the effectiveness of data protection (paras. 62 and 69).

From this perspective, the Court’s conclusion is significantly relevant when placed in the context of the ongoing debate on the GDPR (under) enforcement (Gentile-Lynskey, 2022), the shortcomings of its composite enforcement system (Hofmann-Mustert, 2024) and the Commission’s Proposal for a Regulation laying down additional procedural rules relating to the enforcement of the GDPR (2023). When it comes to the handling of complaints and the role of complainants, it has been observed that these vary significantly among Member States, which in turn results in a limitation of individual procedural rights (Hofmann-Mustert, 2024). Against this background, some rightly fear, by comparing this judgment with previous case law, that its “implications have the potential to be more disruptive” as regards the consistent enforcement of the GDPR and introduce “greater potential risks of interference between administrative and judicial enforcement” (van den Poel, 2024).

However, the implications of the judgment are less daunting when considering the GDPR enforcement in the broader context of digital legislation. The Commission Second Report on the application of the GDPR, published on 25 July 2024, makes it clear that “the development of digital regulations raises the need for close cooperation across regulatory fields. Such cooperation is all the more necessary since data protection issues increasingly intersect with questions of, for example, competition law, consumer law, digital markets rules, electronic communications regulation and cybersecurity. (…) data protection authorities are taking steps to ensure their actions are complementary and coherent with other regulatory fields”. In its statement of 3 December 2024 on the Commission Second Report, the EDPB also recognised that it “would support a holistic methodological approach for the next evaluation of the GDPR that explores the interplay between the GDPR and other EU digital legislation”.

The judgment fits into this context of growing institutional awareness of the need for a holistic and coordinated approach for the effective protection of personal data, in line with the “more ‘collaborative approach’” proposed by scholars for the enforcement of data protection, competition law and unfair competition law (Vandendriessche, 2024). The Court insists on the likely enhanced effective enforcement of the GDPR via national remedies aiming at other objectives (Holtz, 2024), by proposing an interpretation where the GDPR as such calls upon the Member States for its effective enforcement (again, paras. 60-61). By stating that “such an application for injunctive relief brought by a competitor may prove, like that brought by a consumer protection association, to be particularly effective in ensuring such protection, in so far as it is capable of preventing a large number of infringements of the rights of data subjects by the processing of their personal data” (para. 70), the Court recognises the preventive effect of a potential “private enforcement” (Opinion, para. 93) through remedies allowed under national laws, which has been read as an ‘incentive’ for market players to contribute to GDPR compliance (Vandendriessche, 2024). In this sense, the judgment embraces an emerging approach in the EU regulation of the digital environment, which is aimed at involving in the enforcement multiple actors of society as a whole. This approach is evident when it comes to making the online world safer and fairer, namely with the DSA: for example, as far as institutional actors are concerned, in the cooperation required between the Commission and the Digital Services Coordinators with regard to systemic risk mitigation measures (Peukert, 2024); even more, as far as non-institutional actors are concerned, in the mechanisms required to allow any user - individual or entity - to notify illegal content online, or in the required cooperation with “trusted flaggers” (Articles 16, 22, 35 DSA) (in this sense, see also Commission’s dialogue with Civil Society Organisations for implementing the DSA).

It remains to be seen whether such an approach succeeds in becoming consolidated through greater coordination of EU institutions and national authorities and greater awareness of society at large, alongside the required adjustments for the effective implementation of the remedies the GDPR grants to data subjects.

Analysis 1 of the Brexit deal: Healthcare entitlements in the EU-UK Trade and Cooperation Agreement

 

 

Professor Tamara Hervey, University of Sheffield

 

What – if any – entitlements to healthcare are covered by the EU-UK Trade and Cooperation Agreement, agreed in principle on 24 December 2020? (For an overview of the agreement as a whole, see Steve Peers’ Twitter thread and the overview on this blog). (Update: later blog posts cover human rights, dispute settlement and environment and climate change in the Brexit deal). (This blog post was updated April 28 2021 to refer also to the final Article numbers of the TCA; it also retains references to the original numbering for convenience).

 

Introduction

 

If there are any, they will be found in the provisions on social security coordination (Heading Four: Social security coordination and visas for short-term visits). This is the equivalent of – but, as we will see, in many respects a weak equivalent of – the provisions of EU law on social security coordination. On the other hand, these are not ‘ordinary trade agreement’ provisions: there’s nothing like this in CETA for instance.

 

Those provisions of EU law include access to healthcare for EU citizens, and their families (irrespective of citizenship), who are resident in a Member State other than the ‘competent state’ for the purposes of social security coverage, and also access to healthcare necessary during a ‘stay’ (a short-term visit, not establishing a new place of residence) in another Member State. It is this latter provision that is covered by the European Health Insurance Card (EHIC) scheme.

 

Many people want to know whether the EHIC scheme or a version of it will continue. For many people, especially elderly people, private health insurance for travel is unaffordable (health insurance companies take EHIC into account when calculating premiums) and in some cases not available. For people who have been accustomed to regularly visiting family or friends in the EU or UK, EHIC or not will make a significant difference to how they live their lives after end December 2020.

 

But in order to answer that question, I need to work through the legal text methodically, and that is what this blog does. There are multiple parts of the legal text that apply to the coordination of social security: a chapter in the main text, a Protocol, and several Annexes. I am setting out my reasoning step by step so that others can check it.

 

Interpretation and enforcement

 

The wording of the parts of the Agreement on social security coordination is complex, hard to follow, and likely to be subject to disagreement. The analysis that follows is my best-attempt on a first take: I may be wrong. In some respects, the wording of the Agreement is also opaque: in part this is because the relevant equivalent provisions of EU law and of the Withdrawal Agreement, on which this part of the Agreement draws, are also opaque. (Remember that the Withdrawal Agreement remains in force separately, including its provisions on EU citizens in the UK and UK citizens in the EU, discussed here).  That is why I’m starting this analysis with some words on interpretation and enforcement of the parts of the Agreement on social security coordination.

 

The Preamble to the Agreement recognises that social security coordination is important to human beings, not just those who are migrating as ‘economic entities’ (providing services, for example), but also their families. The Preamble also recognises that social security coordination applies not just to people who move between the UK and the EU to reside, but also to stay:

 

Preamble: “RECOGNISING the importance of the coordination of social security rights enjoyed by persons moving between the Parties to work, to stay or to reside, as well as the rights enjoyed by their family members and survivors,”

 

Provisions of the Preamble of an international agreement are an important reference point when it comes to interpretation of that agreement. Interpretation of the EU-UK Trade Agreement (‘the Agreement’) is to be in accordance with international law (not EU or UK law). This approach includes taking account of the context of the legal text, and the ‘object and purpose’ of the Agreement as a whole. It is possible – and perhaps in the context of the social security coordination rules, likely – that the interpretation of the provisions of the Agreement on social security coordination will differ between the UK and the EU Member States. In the context of this Agreement, there is nothing like the Court of Justice of the EU, or the EFTA Court, to seek to prevent such divergent interpretation:

 

TITLE II: PRINCIPLES OF INTERPRETATION AND DEFINITIONS

 

Article 4 (originally COMPROV.13): Public international law

 

1. The provisions of this Agreement and any supplementing agreement shall be interpreted in good faith in accordance with their ordinary meaning in their context and in light of the object and purpose of the agreement in accordance with customary rules of interpretation of public international law, including those codified in the Vienna Convention on the Law of Treaties, done at Vienna on 23 May 1969.

 

2. For greater certainty, neither this Agreement nor any supplementing agreement establishes an obligation to interpret their provisions in accordance with the domestic law of either Party.

 

3. For greater certainty, an interpretation of this Agreement or any supplementing agreement given by the courts of either Party shall not be binding on the courts of the other Party.

 

The agreement will, however, be interpreted by the courts in the UK and the EU separately, and is subject to the treaty’s dispute settlement process (as noted below).

 

The EU Member States and the UK are obliged to ‘coordinate’ their social security systems, in accordance with the Protocol on Social Security Coordination. The object and purpose of this coordination is ‘in order to secure the social security entitlements of the persons covered therein’ (Article 488, previously Ch.SSC.1).

 

This is one of the few parts of the Agreement that has individual human beings as its focus. In general, the Agreement does not confer rights or impose obligations on human beings or legal persons. There is no provision for directly invoking the Agreement in domestic law. The Agreement is an instrument of international law, conferring obligations on the Parties to the Agreement (the EU, its Member States and the UK). It is totally different to EU law in this regard. It is also totally different to the Withdrawal Agreement, which includes a significant number of citizens’ rights provisions, and special measures for its enforcement.

 

Article 5 (originally COMPROV.16): Private rights

 

1. Without prejudice to Article SSC.67 of the Protocol on social security coordination (originally MOBI.SSC.67) and with the exception, with regard to the Union, of Part Three of this Agreement, nothing in this Agreement or any supplementing agreement shall be construed as conferring rights or imposing obligations on persons other than those created between the Parties under public international law, nor as permitting this Agreement or any supplementing agreement to be directly invoked in the domestic legal systems of the Parties.

 

2. A Party shall not provide for a right of action under its law against the other Party on the ground that the other Party has acted in breach of this Agreement or any supplementing agreement.

 

The social security rights under the Agreement must be protected by each Party’s domestic legal order. The Parties have agreed that human beings (and companies) must be permitted, by domestic law (not by the Agreement itself) to invoke the provisions of the Agreement before domestic courts, tribunals and administrative authorities, and thus to seek ‘adequate and timely’ remedies for any breach. The word ‘and’ suggests that courts and tribunals must be included in the arrangements made for enforcing social security coordination rights under the Agreement, and that only providing for an administrative process, such as Ombudsman or other complaints process, would not be compliant with the Agreement.

 

TITLE V: FINAL PROVISIONS

 

Article SSC.67: Protection of individual rights

 

1. The Parties shall ensure in accordance with their domestic legal orders that the provisions of the Protocol on Social Security Coordination have the force of law, either directly or through domestic legislation giving effect to these provisions, so that legal or natural persons can invoke those provisions before domestic courts, tribunals and administrative authorities.

 

2. The Parties shall ensure the means for legal and natural persons to effectively protect their rights under this Protocol, such as the possibility to address complaints to administrative bodies or to bring legal action before a competent court or tribunal in an appropriate judicial procedure, in order to seek an adequate and timely remedy.

 

In the UK, such a process for protection of individual rights is likely to be through the Social Security and Child Support Tribunals, in the first instance, with appeal to the Upper Tribunal (Administrative Appeals Chamber). Note that the draft UK bill giving effect to the TCA simply copies its social security provisions into domestic law (clause 26).

 

Who is covered?

 

The Protocol on Social Security Coordination applies only to ‘situations arising between one or more Member States of the Union and the United Kingdom’ (Article 490(1), previously Ch.SSC.3 (1)). People whose situations are confined in all respects to either the UK or the EU Member States fall outside the scope of the Protocol (Article 490(2), previously Ch.SSC.3 (2)). There is no further definition of this scope rule. Do I fall within the scope of the Protocol if I visit the EU from the UK? If I’m providing a service under the Agreement’s provisions on services (eg Articles 140-143, previously SERVIN 4.1, 4.2, 4.3, 4.4, on performance of economic activities through the entry and temporary stay in the territory of the EU/UK of natural persons of the UK/EU, who are business visitors for establishment purposes, contractual service suppliers, independent professionals, intra-corporate transferees and short-term business visitors), then it would seem obvious that I fall within the scope of the Protocol. Equally, I would argue that if I am visiting the UK from the EU or the EU from the UK, as a tourist, or for other non-economic reason (eg to visit family or friends), on the basis of the visa-free travel provided for under the Agreement (Article 492, previously VSTV.1), I also fall within its scope.

 

But this looks suspiciously like a continuation of aspects of free movement of persons, an inseverable part of the disciplines of the internal market, according to the EU’s negotiating position. My counter-argument to that position is that the coordination of social security, while linked to the internal market as it supports free movement of persons in practice, is not an integral part of harmonised internal market law in the way that the EU law provisions on entry, residence or non-discrimination in employment or self-employment rights are. This interpretation is supported by the fact that the Agreement includes provisions on entitlement to social security benefits (healthcare under a national health system) during a stay in the UK/an EU Member State (see further below).

 

The definition of who is covered by the Protocol on Social Security Coordination is based on the EU law on coordination of social security: people who are ‘subject to’ the social security legislation of one or more States (the UK, EU Member States), their families and their survivors (Article SSC.2 of the Protocol). Curiously, ‘subject to’ is not further defined, either in this Agreement, or in the Withdrawal Agreement, or in EU Law. In many situations, being ‘subject to’ social security legislation will be obvious: if one is paying social security contributions (eg for a pension), or receiving benefits (eg for invalidity or unemployment), then one is obviously ‘subject to’ the legislation. But in other situations, it is less obvious. Is someone who contends that they fall within the scope of the relevant social security rules ‘subject to’ those rules? The Agreement includes some provision on what happens if there is disagreement about whether someone falls within its scope (see below).

 

The Agreement further specifies that, in principle, the Protocol on Social Security Coordination applies only to people who are lawful residents of the UK or an EU Member State (Article 489, previously Ch.SSC.2 in the main Agreement). But this rule does not affect ‘entitlements to cash benefits which relate to previous periods of legal residence of persons covered by Article SSC.2’). So someone might no longer be lawfully resident in the EU or UK, but still fall within the scope of who is covered by this part of the Agreement, for example if they are entitled to pension benefits under the Agreement, but live outside of the EU and UK.

 

What is covered?: General rules

 

The Protocol on Social Security Coordination covers all the main branches of social security that are covered by EU law and by the Withdrawal Agreement. These include ‘sickness benefits’ (Article SSC.3 (1) (a)) (in cash or in kind) – that is, medical treatment. Like in EU law and the Withdrawal Agreement, medical assistance is not covered (Article SSC.2 (4) (b)). Neither is voluntary social insurance, unless it is the only social insurance scheme for the particular branch of social security in the relevant State (Article SSC.13). Neither are ‘assisted conception services’ (Article SSC.3 (4) (e)), defined as ‘any medical, surgical or obstetric services provided for the purpose of assisting a person to carry a child’ (Article SSC.1 (c)). Just to be clear, Article SSC.5 explicitly excludes the matters listed in Article SSC.3 (4) from the general non-discrimination principle (Article SSC.5).

 

EU Member States and the UK may charge a health fee as part of an application to enter, stay, work or reside in that State (Ch.SSC.4). But given that, at least until due notification is given, and if possible at least 3 months before a requirement for visa for a a short-term visit take effect, visa-free travel for short term visits applies between the UK and EU Member States (Article VSTV.1), I think that this provision must apply in practice, at least in the short term, only to applications for residence or work permits, not for visitor entry or short-term visits.

 

The general rules (and there are exceptions) for the Protocol are that (Article SSC.4) social security coordination rules are on the basis of non-discrimination between Member States of the EU. However, this rule is without prejudice to the Common Travel Area arrangements between the United Kingdom and the Republic of Ireland. To access Irish state healthcare, UK nationals need show either an EHIC, or proof of their UK residence. This continuation of the existing rules from 1 January 2021 is confirmed in the UK government’s website.

 

In general (again there are exceptions), the people who are covered by the Protocol enjoy the same benefits (and are subject to the same obligations) as the nationals of the relevant State (Article SSC.5). In general, the Protocol applies a principle of ‘equal treatment of benefits, income, facts or events’ (Article SSC.6).

 

There are two key aspects to this. First, if receipt of social security benefits (or income) has certain legal effects in one State, that State must also recognise equivalent benefits (or income) acquired under the legislation of another state. Second, where legal effects flow from facts or events taking place in one State, that State must take into account ‘like facts or events’ taking place in another State, as if they had taken place on the territory of the first State (Article SSC.6 (a) and (b)). In general, the Protocol requires the aggregation of periods of social insurance, employment, self-employment or residence, completed in any of the States Parties to the Agreement (Article SSC.7). There is a whole section of ANNEX SSC-7: Implementing part on specifics of the aggregation rules (Article SSCI.11 and 12). In general, receipt of cash benefits under the Protocol must not be made conditional on residence (Article SSC.8). All of these provisions are similar to those in the Withdrawal Agreement (Article 31 WA) and in EU law (Regulation 883/2004/EC, Articles 4,5,6,7).

 

Again, as in the Withdrawal Agreement and in EU law, the ‘single state rule’ applies. In general, ‘persons to whom this Protocol applies shall be subject to the legislation of a single State only’ (Article SSC.10). The starting point here is employment or self-employment, and only if neither applies does residence become relevant. If someone is employed or self-employed in a State, that State is the State whose social security legislation they are ‘subject to’ (Article SSC.10 (3) (a) (b)). There are rules for people who normally are employed in both the UK and one or more EU Member States (Article SSC.12): basically if someone is resident where they perform a substantial part of their work, that is the relevant state; if not, the place in which the employer is registered; or the ‘centre of interest’ of the activities of a self-employed person is the relevant state. There is, obviously, lots of room for interpretation of these rules in specific situations.

 

If someone is neither employed nor self-employed, the general rule is that their residence (which means ‘where the person habitually resides’ Article SCC.1 (aa)) determines the relevant State. There is a whole section of the ANNEX SSC-7: Implementing part on the elements for determining residence (Article SSCI.10). There are special rules for people who work on ships and aircraft (Article SSC.10 (4) and (5)).  

 

Like many international agreements, the Protocol on Social Security Coordination allows for States Parties to derogate from its general terms in some respects. The Protocol allows Member States to derogate from the single state rule for ‘detached workers’ (Article SSC.11). ‘Detached workers’ are either employed by an employer in a State which normally carries out its activities there, and sent by their employer to another State to work on the behalf of that employer; or self-employed and normally pursuing a self-employed activity in one State, and who go to another State to pursue a similar activity (Article SSC.11 (1) (a) and (b)). There is no list of these Member States yet in the text (see p 1246). Article SSC.11 obliges the European Union to notify the UK, by the time the Agreement enters into force, whether each Member State falls into one of three categories: A: the Member State wishes to derogate from the general rules of the Protocol on which state is the state responsible for social security (Article SSC.10); B: the Member State does not wish to so derogate; or C: the Member State has not indicated either A or B. That list of three categories of Member States will become Annex SSC-8, when the Agreement enters into force. One month later, categories B and C will cease to exist. Member States in category C will be deemed to be in category A for one month. After that, such a Member State can join category A by the Union notifying the new Specialised Committee on Social Security Coordination (see below) to that effect. A Member State can leave category A in the future by the same mechanism. For Member States in category A, transitional rules for ‘detached workers’ will apply for a 24 month transitional period.

 

This is one of a myriad of examples of Brexit not being ‘done’.

 

What is covered? ‘Sickness benefits’

 

Title III of the Protocol sets out special provisions for each category of benefits (pensions, unemployment benefit and so on). Chapter 1 concerns sickness benefits. Like in EU law, there is a set of rules for ‘insured persons’ (people ‘subject to’ social security legislation of the ‘competent state’, and members of their families) and a separate set of rules for pensioners and members of their families.

 

‘Insured persons’ and their families who are resident in a State other than the competent state, are entitled to receive in the State of residence ‘sickness benefits in kind’ provided by the ‘institution of the place of residence’, as though those people were insured under the legislation of the place of residence (Article SSC.15; Article SSC.21 (pensioners)). People in this category include frontier workers (who live in one state and work in another – special rules apply to them (Article SSC.16)); posted workers (who are sent by their employer to work in another state); and also people who return home for intervals longer than a week (the frontier worker definition).

 

So, if someone is ‘subject to’ UK social security legislation for the purposes of receiving healthcare in the UK, because under the UK legislation they are deemed ‘resident’ in the UK (that being the national rule determining access to the NHS), and they are employed or self-employed in the UK (see the single state rules above), but they are also deemed ‘resident’ in Spain by Spanish legislation, because they are in Spain sufficiently to count as ‘resident’ under Spanish legislation, this provision of the Protocol entitles them to access Spanish healthcare as if they were insured under the Spanish legislation. These provisions are almost identical to the equivalent provisions of EU law (Regulation 883/2004, Articles 17 and 18, 23-26).

 

Articles SSC.17 and SSC.25 (pensioners) cover ‘stay’ outside the competent State. This is the equivalent of the EHIC provision in EU law. It entitles an insured person, and members of their family, who are staying in a state other than the competent state, to healthcare which becomes necessary on medical grounds during their stay. The determination of necessity must take account of the nature of the healthcare or medical treatment and the length of the stay. It is the healthcare provider in the state providing the healthcare that determines necessity. The entitlement under Article SSC.17 or SSC.25 does not cover someone who travelled with the purpose of receiving the healthcare or medical treatment. (There is an exception for a passenger or someone working on a ship or aircraft, who became ill during the voyage or flight). These provisions are almost identical to the equivalent provisions of EU law (Regulation 883/2004, Articles 19 and 20, 27).

 

Healthcare provided under these provisions must be fully reimbursed by the competent State (Article SSC.30).

 

What is different from EU law is that a person seeking to receive healthcare or medical treatment during a stay outside the competent state must present a ‘valid entitlement document’. The entitlement document is covered in Appendix SSCI-2. For EU Member States, the valid document is essentially the EHIC: it has to comply with the technical specifications of the relevant EU law determining EHIC cards (Decision No S2 of 12 June 2009 of the Administrative Commission concerning the technical specifications of the European Health Insurance Card) (Appendix SSCI-2 1). For the UK, the entitlement document has to contain the following information (Appendix SSCI-2 2):

 

(a) surname and forename of the document holder;

(b) personal identification number of the document holder;

(c) date of birth of the document holder;

(d) expiry date of the document;

(e) the code “UK” in lieu of the ISO code of the United Kingdom;

(f) identification number and acronym of the United Kingdom institution issuing the document;

(g) logical number of the document;

(h) in the case of a provisional document, the date of issue and date of delivery of the document, and the signature and stamp of the United Kingdom institution.

 

The UK must notify the Specialised Committee on Social Security Coordination ‘without delay’ of the technical specifications of the UK document (Appendix SSCI-2 3).

 

The UK government’s website explains that people who have valid EHICs will be able to continue to use them from 1 January 2021, to access necessary healthcare on a visit to an EU country. For Norway, Iceland, Liechtenstein and Switzerland, a new GHIC (UK Global Health Insurance Card) is available. When someone’s EHIC expires, they will be able to apply for a GHIC for free.

 

Appendix SSCI-2 confirms that the entitlements under Article SSC.17 of the Protocol on Social Security Coordination include medical treatment for pre-existing illnesses and chronic conditions, as well as medical treatment in conjunction with pregnancy and childbirth, unless the purpose of the trip is to receive these treatments. But for vital medical treatment that is only available through a specialised medical unit, authorisation in advance is required before the trip. This includes (but is not limited to)

 

(a) kidney dialysis;

(b) oxygen therapy;

(c) special asthma treatment;

(d) echocardiography in case of chronic autoimmune diseases;

(e) chemotherapy.

 

So some medical treatments that used to be available under the EHIC scheme will after 31 December 2020 only be available if the relevant State (the UK or EU Member State) gives prior authorisation. This will be the case, for instance, for UK patients accessing kidney dialysis in EU Member States. As far as I am aware, the UK has not yet indicated whether it will authorise such treatments, or under what conditions.

 

As in EU law, there is scope for authorisation of medical treatment in another State under the Agreement. The UK used this provision infrequently when it was an EU Member State. Some Member States, eg Malta, rely on it significantly. If authorised, there is an obligation on the healthcare institution of the place to which the person authorised travels to provide the medical treatment authorised as if the person was insured in that State (Article SSC.18). There is also, as in EU law, in effect an obligation to grant authorisation ‘where the treatment in question is among the benefits provided for by the legislation in the State where the person concerned resides and where that person cannot be given such treatment within a time limit which is medically justifiable, taking into account their current state of health and the probable course of their illness’ (Article SSC.18). This provision also gives entitlements to family members of the ‘insured person’. There is provision for if the family members and the insured person reside in different States.

 

This provision (the ‘S2’ in EU law, Regulation 883/2004, Article 20) is used relatively infrequently between Great Britain and the EU, but several hundred people a year do rely on it to receive health care across the border between Northern Ireland and the Republic of Ireland. The question of whether a time limit before which someone receives treatment is ‘medically justifiable’ is obviously contentious. When the UK was an EU Member State, EU law was used to seek judicial review of this question, and a number of English NHS Hospital Trusts reduced waiting times for elective procedures such as hip replacements in response. Apparently there is ongoing litigation in Northern Ireland which seeks judicial review of the NHS there for breaching waiting time limits, in part relying on EU law. Given the COVID-19 context, we might see further attempts to use litigation before domestic courts in a similar way in the future – reliant on the domestic legislation implementing the Agreement, rather than the Agreement itself.

 

Article SSC.19 makes provision for those States which provide cash benefits for healthcare, rather than benefits in kind. This is the direct equivalent to the relevant provision of EU law (Regulation 883/2004, Article 21).

 

Implementation, Administrative Arrangements and Dispute Settlement

 

Annex SSC-7: Implementing Part sets out significant detail on the practicalities of implementing the parts of the Agreement on Coordination of Social Security. There is an obligation on the UK and the EU Member States to ‘provide or exchange all data necessary for establishing and determining the rights and obligations of persons to whom the Protocol applies’ and to do so ‘without delay’ (Article SSCI.2). A Specialised Committee on Social Security Coordination is empowered to authorize – if it so decides – the use of the EU’s Electronic Exchange of Social Security Information for exchange of information. If this decision is taken, the rules applying to that system (which are rules of EU law) will apply (Article SSCI.4 (2)).

 

There is an obligation to make sure necessary information is made available, so that people concerned are able to assert their rights under the Protocol and Annex (Article SSCI.3 (1). Information must be forwarded, and documents issued, ‘without delay’ and in accordance with any time limits specified in national legislation (Article SSCI.3 (3)).

 

If a decision is made to refuse benefits, reasons must be given, and information communicated about remedies and time periods for appeals (Article SSCI.3 (3)).

 

Where there is a difference of views between States on what is the applicable legislation or on which is the competent state which is responsible for providing cash benefits or benefits in kind (eg medical treatment), there is an obligation under the Agreement to provisionally apply the legislation of one State (Article SSCI.6 (1) and (2)). For determining applicable legislation, this State is the state where the person actually pursues employment or self-employment, if there is such a state; or the state of residence if the person concerned pursues employment or self-employment in two or more States and performs part of their activity or activities in the State of residence, or if the person concerned is neither employed nor self-employed. In all other cases, it is the State to which a claim was first made, if the person pursues an activity, or activities, in two or more States.  For determining the competent state, the legislation of the person’s place of residence applies or, if that person does not reside on the territory of one of the States concerned, that person is provisionally entitled to the benefits provided for by the legislation applied by the institution to which the request was first submitted.

 

These provisions mean that people should not be left in limbo while complex cases are decided.

 

There is provision for bilateral procedures between States to depart from those in the Annex, provided that they do not have an adverse effect on people’s rights (Article SSCI.8). The bilateral procedures have to be notified to the Specialised Committee on Social Security Coordination and listed in the Appendix SSCI-1, thus securing (at least some) transparency. Any pre-existing bilaterals serving the same or similar purposes to the social security provisions in the Agreement will continue to apply, but they must also be listed in Appendix SSCI-1.

 

Finally, the Agreement includes provisions for a Specialised Committee on Social Security Coordination, which addresses matters covered by Heading Four of Part Two and the Protocol on Social Security Coordination (Article 8(1)(p), previously INST.2 (p)); and for Parliamentary Cooperation and participation of civil society (Articles 11-14, previously INST.5 to INST.7).  These will be important sites for scrutiny of compliance with the Agreement, any future divergence in interpretation of obligations, and (given that the role for an over-seeing court is non-existent) for legal contestation. It will be important to ensure that the UK Parliament, and, where appropriate the Parliaments in Northern Ireland, Scotland and Wales exercise oversight over executive powers; and to ensure that relevant NGOs are represented in the civil society processes.

 

Article 8(4) (previously INST.2 (2)) provides that Specialised Committees shall have the power to: (a) monitor and review the implementation and ensure the proper functioning of this Agreement or any supplementing agreement; … (c) adopt decisions, including amendments, and recommendations in respect of all matters where this Agreement or any supplementing agreement so provides or for which the Partnership Council has delegated its powers to a Specialised Committee in accordance with point (f) of Article 7(4) (previously INST.1(4) [Partnership Council]); (d) discuss technical issues arising from the implementation of this Agreement or any supplementing agreement; (e) provide a forum for the Parties to exchange information, discuss best practices and share implementation experience; (f) establish, supervise, coordinate and dissolve Working Groups; and (g) provide a forum for consultation pursuant to Article 738(7) (previously INST.13(7) [Consultations], in the Dispute Settlement provisions of Part Six).

 

The Specialised Committee on Social Security Coordination will have power to make recommendations (which have no binding force) and decisions, by mutual consent: Article 10 (previously INST.4). Decisions adopted by the Specialised Committee on Social Security Coordination will have binding force on the Parties to the Agreement. The Committee will make decisions, for instance, on ‘the structure, content and format of forms and documents issued on behalf of the States for the purposes of implementing the Protocol’ (Annex SSC-7, Article SSCI.4 (1)). The Committee is tasked with reconciling differing points of view on ‘information provided by the persons concerned, the validity of a document or supporting evidence or the accuracy of the facts on which the particulars contained therein are based’ (Article SSCI.5 (4).

 

The Agreement’s general provisions on dispute settlement also apply to the social security coordination provisions (Article 735, previously INST.10: Scope), although not in individual cases (Article 735(5), previously INST.10(5)). Note that it's not possible, in the event of a successful complaint by one party about breach of the treaty, to retaliate by suspending the social security provisions (Article 749(3)(a), previously INST.24(3)(b)). This also applies to successful complaints about breaches of the withdrawal agreement (Article 749(4), previously INST.24(4)).  Other people will already have written about this – but the basic message here is that this is international law, not anything like EU law.

 

Conclusion

 

In summary, this is a significantly better settlement than No Deal at the end of transition would have been, from the point of view of people who relied on EU law to receive healthcare and medical treatment in the UK or an EU Member State.

 

For UK/EU residents, in the EU/UK access to healthcare continues on the same basis as national residents, as before. For visitors, a form of EHIC entitlements are preserved going forward.

 

What is different is the legal basis on which these rights are enjoyed, with corresponding implications for how rights are enjoyed and enforced. All will be well so long as the parties to the Agreement comply with their obligations under it.

 

* This post was amended on January 1, 2021, to add details about the absence of a power to suspend the social security provisions pursuant to the dispute settlement rules, on January 2, 2021 to add a link to the overview of the trade and cooperation agreement published on this blog, and on April 28, 2021 to refer to the revised Article numbers of the final TCA.   

Barnard & Peers: chapter 27

Photo credit: Health Europa