By Oliwia, Kaloyan and Carolin

The problem and regulatory framework

Pharmacovigilance produces near-constant scrutiny of medicines on the EU market. Yet in the years since the EU gave itself the power to fine companies for pharmacovigilance failures, that power has been formally triggered once, and no fine has followed.

The EU monitors the safety of authorised medicines continuously. Companies must track and report adverse events, national authorities inspect their systems, and the European Medicines Agency (EMA) assesses the safety of centrally authorised products on an ongoing basis. Set against that volume of routine oversight, one figure stands out: since Regulation (EC) No 658/2007, the Penalties Regulation, empowered the EU to impose financial penalties for such failures, it has produced a single infringement procedure, and that procedure closed without a fine.

Why so much monitoring but so little penalising? Part of the answer is that enforcement power is divided. A national authority may detect a problem, the EMA investigates it, but the decision on penalties is taken elsewhere, by the European Commission. When responsibility for an outcome is split this way, it can become unclear who is answerable for the result.

This post uses two distinct ideas to explain that. The first is responsibility in Dennis Thompson’s sense: ownership of an outcome, that is, whose conduct produced it. The second is accountability in Mark Bovens’s sense: the obligation of an actor to explain and justify its conduct to a forum that can question it and pass judgement. The argument is that when many hands produce an enforcement outcome, responsibility for the overall result becomes diffuse, and no forum is positioned to hold that overall result to account.

The framework itself is extensive. Directive 2001/83/EC sets out the general rules for medicinal products. For authorised medicines distributed within the EU, Regulation (EC) No 726/2004 establishes the EMA’s role and powers. The Clinical Trials Regulation and the EU’s pharmacovigilance rules add further safety and monitoring obligations. What determines whether these rules matter in practice is how they are applied.

Pharmacovigilance rules  –  the legal requirements and guidelines ensuring that medicines are monitored for safety, so that their benefits continue to outweigh their risks.

 

In practice, enforcement is divided between actors, each with a defined role:

• National authorities detect problems at Member State level
• The EMA investigates and assesses possible infringements
• The European Commission decides whether to impose penalties

The EMA is central to supervision and investigation, but it cannot impose fines. Although penalties can reach 5% of a company’s EU turnover for certain infringements, the power to impose them rests with the Commission. This leaves a gap between investigating a breach and deciding what follows from it. When enforcement is shared across institutions, establishing accountability becomes harder.

Comparative perspective

Other EU agencies are built differently. The European Securities and Markets Authority (ESMA) and the European Central Bank (ECB) can investigate breaches and impose penalties directly. ESMA can supervise specific market actors and adopt binding decisions, including financial penalties, without depending on another institution; the ECB supervises banks and sanctions breaches of EU banking rules. In those models, the body that builds the case also owns the outcome. The EMA model separates the two.

How Enforcement Works in Practice

One procedure, nineteen medicines, no fine

The first and, to date, the only infringement procedure opened under the Penalties Regulation tells us less about wrongdoing than about how the system divides authority.

 

80 000+ REPORTS LEFT UNASSESSED

~5 years FROM OPENING TO CLOSURE

€0 PENALTY IMPOSED

How it began

In 2012, a routine pharmacovigilance inspection by the UK’s MHRA, part of a coordinated European inspection programme, identified serious shortcomings in Roche’s pharmacovigilance system. Around 80,000 reports collected through a Roche-sponsored patient support programme in the United States had not been evaluated to determine whether they should have been reported to EU authorities as suspected adverse reactions. These included 15,161 reports of patient death. Whether the deaths had any causal link to the medicines was not known; under EU law the reports nonetheless had to be assessed, and they had not been.

The findings were referred to the European Commission, which asked the EMA to open a formal infringement procedure under the Penalties Regulation.

The procedure, step-by-step

2012	MHRA inspection identifies shortcomings. Some 80,000 unassessed reports found in Roche’s pharmacovigilance system. At the Commission’s request, the EMA opens an infringement procedure on 23 October 2012 under the Penalties Regulation.
2013	EMA finalises its benefit-risk safety review. No new safety concerns identified across the medicines concerned; this review is separate from, and without prejudice to, the infringement procedure. (EMA, 19 Nov 2013)
2014-2016	EMA builds the infringement case. Its initial report is finalised in April 2014 and passed to the Commission; the file returns to the EMA in 2015 for further inquiry; the EMA sends its final report to the Commission on 1 July 2016. The procedure concerns 19 centrally authorised products.
Dec 2017	Commission closes the procedure. Satisfied with Roche’s remedial actions, the Commission decides not to issue a statement of objections and closes the case. No fine is imposed. (Commission statement, 15 Dec 2017)

 

Who did what?

 

MHRA identified the problem

→

Commission asked EMA to act

→

EMA investigated

→

Commission decided the outcome

How to read the outcome

Enforcement did happen. Roche implemented remedial measures, the EMA produced a detailed record of the failures, and the safety review found no impact on the benefit-risk balance of the medicines. Closing a case once a company has remediated is a recognised regulatory approach. In EU competition law, the Commission can resolve non-cartel cases through a commitments procedure without imposing a penalty. On this reading, enforcement here corrected behaviour rather than punishing it.

But the division of roles has a cost for visibility. The institution that built the case had no formal say in how it ended. The Commission, which decided, published only a brief statement of its reasons, namely that it was satisfied with Roche’s remedial actions, rather than a detailed, reasoned account of why remediation was preferred to a penalty.

KEY OBSERVATION

The EMA carries the investigative burden; the Commission carries the decisional authority. The framework does not clearly require either institution to explain publicly how investigative findings translate into the final decision.

 

This design is deliberate. Under Regulation 658/2007, the EMA initiates and conducts the inquiry while the Commission takes the final decision. What the Roche case shows is not merely how one procedure unfolded, but how decisional power is distributed, and how that distribution affects whether responsibility for the outcome is visible.

What are the sanctions for?

Whether the absence of a fine is a problem depends on what a penalty is supposed to do. If its role were purely restorative (to repair an undesirable situation), then the outcome looks adequate: Roche overhauled its reporting systems, the outstanding reports were assessed, and the safety review found no effect on the benefit-risk balance of the medicines. The system was, in that narrow sense, repaired.

The harder questions concern the other functions. A penalty also has a deterrent and preventive role, signalling to every marketing authorisation holder that failing to assess tens of thousands of safety reports carries a real cost, and an expressive one, marking publicly that an obligation central to patient safety was breached. Remediation after the fact does little for either. This is why the accountability concern here does not depend on the claim that Roche deserved a fine. The concern is that a discretionary choice with system-wide signalling effects was made without a reasoned public justification. The problem is the unexplained exercise of discretion, not the absence of a penalty as such.

Who is responsible?

The Roche case exposes a recurring difficulty: when several institutions each follow their own rules correctly, yet the overall outcome is still open to question, it becomes unclear who bears responsibility for that outcome. This is the “problem of many hands.”

Dennis Thompson named the difficulty that arises wherever a task is divided among many actors:

“Because many different officials contribute in many ways to decisions and policies of government, it is difficult even in principle to identify who is morally responsible for political outcomes.” 

Dennis Thompson (1980), p.905

Many hands, or many eyes?

A reader might object that this is really a case of the “problem of many eyes” rather than many hands. Bovens draws both, and the distinction is worth stating precisely. Many hands describes the actor side: a forum faces several potential actors and cannot easily determine who contributed what, or who can be called to account. Many eyes describes the forum side: a single actor answers to many forums at once, each applying its own criteria. Many eyes is a problem of forum surplus (Bovens, “Public Accountability,” 2007, 182–208).

On the many-eyes reading, the accountable actor is Roche, facing a divided set of overseers: the MHRA, national authorities, the EMA and the Commission. That reading is coherent, but it answers a different question from the one this post asks. The concern here is not how Roche answers to its overseers; it is who owns the enforcement outcome, that is, the decision to close the case without a penalty or a reasoned justification. On that question the case fits the many-hands pattern: the MHRA, the EMA and the Commission each acted within their powers, yet responsibility for the combined result is not clearly attributable to any of them.

And it comes with a twist. Many eyes is a problem of too many forums; the difficulty here is the opposite. There is no forum at which the overall enforcement outcome must be justified. The case sits between the two: many hands on the actor side, and a forum gap, rather than a forum surplus, on the accountability side.

Applying this to EU pharmaceutical enforcement

In the Roche case, the EMA, the Commission and the MHRA each performed their role within their legal powers, and enforcement did take place: the failures were identified, investigated and remedied. But because the steps are carried out by different actors, no single institution oversees the process end to end. When the procedure closed without a fine and without a detailed public justification, it became difficult to identify who was responsible for that outcome. This is not the failure of any one institution but a feature of the system: responsibility is diffused across the stages of enforcement rather than attributable to a single actor.

Where responsibility sits, and where it does not

Political oversight does not generally focus on individual enforcement decisions, and where no formal sanction is imposed, judicial review may be unavailable, raising a concern under Article 47 of the Charter of Fundamental Rights, which guarantees the right to an effective remedy.

Accountability and design

On Bovens’s account, accountability is a relationship between an actor and a forum: the actor must explain and justify its conduct, the forum can question it and pass judgement, and the actor may face consequences. In the Roche procedure, there is no point at which the overall enforcement outcome must be justified in this way. Individual steps can be reviewed, but the combined result is not clearly subject to any single accountability forum. Accountability is missing precisely where responsibility is hardest to locate, which is how diffused responsibility (many hands) becomes an accountability gap.

Unlike the EMA, ESMA and the ECB can investigate and sanction directly, so the institution that builds the case also owns the outcome.

The issue, then, is not that enforcement is absent but that responsibility for it is not clearly visible. Addressing this need not mean redesigning the system. Granting the EMA limited sanctioning powers, on the ESMA model, would close the gap between investigation and outcome. Requiring the Commission to publish reasoned decisions when it closes such cases would make the exercise of its discretion visible to Parliament, courts and the public. As enforcement increasingly runs through shared structures, making responsibility visible is a precondition for accountability to function at all.