Tier 2!

Events, ,

The rankings of The Legal 500 are out and this year Gitti and Partners’ life sciences practice has been recognized as a “Tier 2” firm, with Paola Sangiovanni as “Leading Individual”.

Check out the rankings here:

https://www.legal500.com/c/italy/industry-focus-healthcare-and-life-sciences/

A huge THANK YOU to our wonderful testimonials, but also to all of our clients, who help us get better year after year, and to our team, who makes working fun!

Corporate Liability Under Legislative Decree No. 231/2001: Latest Developments

Legal news, , , , ,

In the context of criminal proceedings for aggravated fraud for obtaining public funds (art. 640 bis of the Criminal Code) and for ideological falsity of the private party in a public deed (art. 483 of the Criminal Code), the Italian Supreme Court (ruling No. 3196/2024 Jan. 26, 2024) had the opportunity to reiterate some useful principles in the context of 231 Models:

•the legal representative of the entity, suspected or accused of the predicate offense, cannot appoint the entity’s defense attorney, due to the absolute prohibition of representation posed by Article 39 of Legislative Decree No. 231 of 2001. The incompatible representative cannot perform any defensive act in the interest of the entity and, if performed, must be considered ineffective. However, the entity may join the proceedings by replacing the representative who has become incompatible or by appointing an ad hoc representative.

•The Court must always make an independent determination of the administrative liability of the entity and this means that:

1)It is not necessary to make a final and complete finding of individual criminal liability of the natural person, but a mere incidental finding is sufficient.

2)The configurability of criminal liability of managers for 231 crimes is not sufficient to affirm the liability of the entity. The judge must carry out a judgment of the suitability of the 231 Model adopted, ideally placing it at the time when the offence was committed, in order to verify whether compliance with the 231 Model would have eliminated or reduced the danger of the occurrence of offences of the same kind as the one that occurred.

The Italian Government Fund for the Governance of Medical Devices

Legal news, , , , , , , ,

With Ministerial Decree dated December 29, 2023, the Italian Ministry of Health has established criteria and methods for feeding the fund dedicated to the governance of medical devices, the so-called “Fondo per il governo dei dispositivi medici” (Fund for medical devices governance, “Fund”).

Key Features

  • Annual payment obligation.  Companies manufacturing or distributing medical devices, large medical equipment and in vitro diagnostic medical devices must pay a sum equal to 0.75% of the company’s previous year turnover from the sale of such devices to the National Health Service, net of VAT.
  • Annual Declaration Requirement.  Companies must submit an annual statement to the Ministry of Health regarding:
    • The estimated amount of 0.75% of the above-mentioned turnover.
    • The company’s previous year turnover to the National Health Service, net of VAT;
  • Use of the Fund. The Fund will be used for various activities related to Health Technology Assessment and governance of medical devices (including the management of the National Price Observatory, the vigilance system and the market surveillance system).
  • Deadlines and next steps. The first deadline for compliance with the fund regulations is set for December 31, 2024.

Companies are currently assessing whether the Fund can be challenged in court with arguments that may be similar to those raised in the so called “payback” litigation, which will see its day in Court (namely, the Italian Constitutional Court) on May 22, 2024.

Make Sure Employees’ E-Mail Metadata Are Deleted

Legal news, , ,
New guidelines have been issued by the Italian Data Protection Authority, or Garante, regarding processing of metadata relating to employees’ work emails. The Garante worries that, absent a specific agreement with trade unions, processing of such employees’ metadata may trigger risks of systematic monitoring, unlawful processing and excessive data retention. Therefore, they need to be deleted within a few hours/days and up to 7 days. Companies, who are acting as data controllers of such employees’ metadata, must ensure that their service providers carry out such deletions, making sure that default settings that prolong the processing are deactivated. They must also reflect in the information notice to employees the specific use of technologies that impact the processing of their data.

New Obligations for Companies Under the Proposed CS3D

Legal news, , , ,

The proposed Corporate Sustainability Due Diligence Directive, so-called CS3D, may set new rules binding large EU or non-EU companies aimed at preventing adverse impacts on the environment and human rights resulting not only from their own operations, but also from those of their business partners.

CS3D has been criticized for its strong impact on the whole supply chain. While only large companies are in scope, vendors of such obligated entities will need to comply with such entities’ policies inspired by CS3D.

What Are the Proposed Obligations?

New due diligence requirements are supposed to be established by CS3D and may subsequently be implemented by each member state. According to the text under discussion, companies will have to identify, prevent, stop, mitigate and account for the adverse impacts on the environment and human rights caused by their activities. In addition, they will need to have a plan to ensure that their business strategy is compatible with limiting global warming to 1.5°C in line with the Paris Agreementand the climate neutrality goals set by Regulation (EU) 2021/1119.

Which Companies are In Scope of CS3D?

CS3D would apply to European companies that:

  • have, on average, more than 250 employees and a global net turnover of more than EUR 40 million in the last financial year for which the annual accounts were drawn up;
  • even if they do not meet the minimum thresholds, are the parent company of a group that had 500 employees and a global net turnover of more than EUR 150 million in the last financial year for which the annual accounts were drawn up.

It would also applty to third-country companies that:

  • generated a global net turnover of more than EUR 150 million, provided that at least EUR 40 million of that turnover was generated in the European Union in the financial year preceding the last financial year, including turnover generated by third-country companies with which the company and/or its subsidiaries have concluded a vertical agreement in the Union in exchange for licensing rights;
  • even if they do not meet the minimum thresholds mentioned in point (a), are the parent company of a group that had 500 employees and a global net turnover of more than EUR 150 million, of which at least EUR 40 million was generated in the European Union in the last financial year for which the annual accounts were drawn up, including turnover generated by third-country companies with which the company and/or its subsidiaries have concluded a vertical agreement in the Union in exchange for licensing rights.

When Will It Enter into Force?

CS3D is still under discussion. The proposal for the Directive was presented by the European Commission on February 23, 2022, and the Parliament adopted the amended text on December 14, 2023. The proposal must be formally approved by the Commission, the Parliament and the Council before it can officially enter into force.

The Data Act: a New European Regulation on Data Sharing in the EU

Legal news, ,

Today, January 11, 2024, marks the entry into force of EU Regulation 2023/2854, better known as “Data Act”.

The new regulation sets forth new rules on B2B and B2C data access and provides a regulatory framework for sharing data generated by the use of connected devices and related services. In addition, the Data Act contains measures to restrain economic operators from abusing contractual imbalances in data-sharing contracts.

The new regulation’s declared goals are to:

  • stimulate a competitive and fair data market;
  • foster data-driven innovation;
  • boost data accessibility;
  • make it easier to switch between data processing service providers;
  • protect data from unlawful transfers;
  • develop interoperability standards for data to be reused between sectors.

Art. 50 of the regulation provides that the new set of rules shall apply from September 12, 2025; however, certain articles, shall apply at a later stage.

Will the Sunshine Act and the Whistleblowing Act change life sciences companies?

Legal news,

Although not revolutionary, these two new pieces of legislation are certainly of great interest to life sciences companies operating in Italy. They may, in fact, entirely change the quantity and quality of information available on and to life sciences companies, and perhaps even impact the cultural landscape in which such companies operate.

–> INFORMATION IN: the Whistleblowing Act is designed to encourage a flow of information to the company;

<– INFORMATION OUT: the Italian Sunshine Act will ensure that interactions with HCPs or HCOs are publicly disclosed, which will generate information from companies out to the public.

THE SUNSHINE ACT.

  • Not yet applicable.  The Italian Sunshine Act (law number 62 of 2022) is not yet applicable because the website of the Italian Ministry of Health where data should be published is not yet ready.
  • Aim.  The purpose of the Sunshine Act is to enhance transparency of relationships between companies and healthcare operators. Also, in the intention of the legislator, it also aims at fighting corruption even though the subject matters of the disclosure are entirely legitimate transactions.
  • Reportable interactions.  Under the Sunshine Act, agreements and delivery of money, goods, services or other benefits to an healthcare professional (HCP) having a value above €100 or an annual aggregate value of more than €1,000 trigger the obligation to report the transaction. The threshold is higher if an healthcare organization (HCO) is involved, as the value must be above €1,000 individually or above €2,500 annually. Additionally, any agreements with HCPs or HCOs regarding the attendance to congresses, trainings, events, or any consultancy, research and teaching relationship must also be reported, as well as any equity or bonds in life science companies granted to HCPs or HCOs (even if granted for free) and any consideration for intellectual property licenses. Reporting must occur every 6 months and the information on the registry will be available for 5 years. Consent to disclosure by HCPs is (supposedly) implied.

THE WHISTLEBLOWING ACT.

  • In force. The Whistleblowing Act (legislative decree no. 24 of 2023) is already in force for all companies to which it applies (including, but not limited to, life sciences’ companies). This means companies which have adopted a “231” model, as well as companies with more than 50 employees, or less if they are active in specific sectors.
  • Aim.  The purpose of whistleblowing legislation is to protect the reporting person by prohibiting any retaliation against him or her, while ensuring confidentiality and compliance with data protection legislation. This should encourage reports, also anonymous, on any illicit activity happening within or outside the company. Companies must appoint a specific body or person to manage the reports so that they can be properly investigated (when relevant), and feedback can be provided to the reporting person.

Both laws rest on the assumption that corruption is inherent in businesses, especially in life sciences’ companies, and should be unearthed, even in an industry that is heavily regulated, self-regulated, and closely monitored by regulators and authorities.

Will the Sunshine Act and the Whistleblowing Act change the perception of life sciences companies? Will their efforts in terms of transparency and accountability be rewarded with a more positive reputation? That’s hard to predict, and probably unlikely.

Life sciences companies must balance the tensions between health and profit, the needs of buyers, users and patients, their products’ innovation and safety. They must do that ethically and generally invest a lot of resources into their compliance efforts. The two new laws may further strengthen such commitment.

Quick Guide on Legislation In Force and Legislation Stalled

Legal news, , , , , , , ,

Just a quick blog post to align our readers on which legislation is in force and which is stalled at the moment:

  • The Ultimate Beneficial Owners register (discussed here), which companies strived to populate by December 11, 2023, is currently on hold due to administrative litigation that currently blocks the application of the register.
  • The European Regulation on Artificial Intelligence, which we already discussed here, is now final. It will enter into force in 2 years.
  • Legislation on payback for medical devices will be scrutinized by the Italian Constitutional Court thanks to decisions of the Lazio Administrative Court issued on November 24, 2023.
  • The Italian Sunshine Act (Law no. 62 of 2022), which we illustrated here, is in force but not yet applicable since the transparency website is not yet live.
  • Next week the Whistleblowing Law (analyzed here and here) will be mandatory for all companies in scope.
  • The Digital Services Act and the Digital Markets Act are in force.