Notified Bodies potentially liable to end users of medical devices rules CJEU

We've previously reported on Advocate General Sharpston's Opinion in case C 219/15 Elisabeth Schmitt v TÜV Rheinland LGS products GmbH concerning the obligations and liabilities of Notified Bodies under the Directive 93/42/EEC (the Medical Devices Directive). The Court of Justice of the European Union (CJEU) has now handed down its ruling in that case in the latest development in the long-running Poly Implant Prosthèse (PIP) litigation.

In this article, we discuss the CJEU's judgment in detail and its impact on manufacturers of medical devices and Notified Bodies. We also comment whether the decision actually gives rise to more (rather than less) uncertainty as questions of liability will ultimately be addressed by national courts applying different rules to determine the conditions of culpable failure of duties.

The facts

PIP was a manufacturer of breast implants based in France and commissioned TÜV Rheinland as the Notified Body tasked with conducting conformity assessment procedures with respect to the implants under the Medical Devices Directive.

In March 2010, PIP's premises were inspected by the French regulators following an increase in the number of reports concerning the safety of the implants and PIP's failure to provide consistent responses to the French regulators regarding these complaints.

The inspection revealed that PIP had been using industrial grade silicone to manufacture the implants rather than medical grade silicone which was required in the approved product specification. The French regulators subsequently suspended the marketing, distribution, export and use of the implants on 29 March 2010, with other regulators around the world quickly following suit.

Litigation subsequently ensued around the world by those affected by the PIP scandal, particularly from women claiming damages or compensation in respect of harm or losses allegedly caused by receiving the implants. However, the company entered into liquidation in 2011, so the claimants sought compensation from third parties, including TÜV Rheinland. Mrs Schmitt was such a claimant.

Mrs Schmitt had silicone breast implants manufactured by PIP fitted in Germany in 2008. These implants were removed in 2012 on medical advice after the outbreak of the scandal.

She subsequently commenced proceedings against TÜV Rheinland in the German courts, in which she sought €40,000 as compensation for non-material damage and a declaration that the Notified Body was liable for any material damage that might arise in future.

She argued that an inspection of the delivery notes and invoices in PIP's possession would have made clear to TÜV Rheinland that medical grade silicone had not been used in the manufacture of the implants.

Mrs Schmitt was unsuccessful at first instance and on appeal. The reasons given by the Appeal Court in dismissing the case were essentially two-fold:

• There was no direct contractual relationship between Mrs Schmitt and TÜV Rheinland and, as a matter of German private law, the principles for extending the protective effect of a contract to third parties did not apply (ie the contract between PIP and TÜV Rheinland did not provide a protective effect to the benefit of third parties like Mrs Schmitt). To include the protection of such third parties within the scope of the contract, contrary to the intention of the parties to the contract and in the absence of any legitimate interest, would have the effect of extending the liability of TÜV Rheinland indefinitely.
• The Appeal Court considered that Notified Bodies were not liable under the law of tort. A finding of liability in tort would have required a Notified Body to have breached a duty imposed by law that required it to act in order to protect others. The purpose of the Notified Body activities was not to protect patients. TÜV Rheinland had not failed in its duty as it had made regular, announced inspections, which would be deemed to be sufficient in the absence of any suggestion of improper practices. Consequently, there was no liability under German civil liability law.

Mrs Schmitt appealed on a point of law to the Bundesgerichtshof, the German Federal Court of Justice (FCJ). As the FCJ is Germany's highest civil court and the matter depended on the interpretation of the Medical Devices Directive, the following reference questions were lodged at the CJEU in May 2015:

• "Is it the purpose and intention of the [Medical Devices Directive] that, in the case of Class III medical devices, the Notified Body responsible for auditing the quality system, examining the design of the product and surveillance acts in order to protect all potential patients and may therefore, in the event of a culpable infringement of an obligation, have direct and unlimited liability towards the patients concerned?"
• "Does it follow from the aforementioned points [points 3.3, 4.3, 5.3 and 5.4] of Annex II to [the Medical Devices Directive] that, in the case of Class III medical devices, the Notified Body responsible for auditing the quality system, examining the design of the product and surveillance is subject to a general obligation to examine devices, or at least to examine them where there is due cause?"
• "Does it follow from the aforementioned points of Annex II to [the Medical Devices Directive] that, in the case of Class III medical devices, the Notified Body responsible for auditing the quality system, examining the design of the product and surveillance is subject to a general obligation to examine the manufacturer’s business records and/or to carry out unannounced inspections, or at least to do so where there is due cause?"

The judgment

Questions 2 and 3 – Obligations of a Notified Body

The CJEU held that the answer to the second and third questions was that Annex II to the Medical Devices Directive read in light of Articles 11(1) and (10) and Article 16(6) are to be interpreted as meaning that a Notified Body is not under a general obligation to carry out unannounced inspections, to examine devices and/or to examine the manufacturer's business records.

However, in the face of evidence indicating that a medical device may not comply with the requirements laid down in Medical Devices Directive, a Notified Body must take all the steps necessary to ensure that it fulfils its obligations under Article 16(6) and Annex II of that Directive.

Although agreeing with the Advocate General that Notified Bodies must be allowed an appropriate degree of discretion as regards their independence and scientific expertise in carrying out their duties, that discretion was not without limit.

In particular, the CJEU stated that the Notified Body "would not be able to fulfil its function under the procedure relating to the EC declaration of conformity if it were free not to take any steps in the face of evidence indicating that a medical device might not comply with the requirements laid down in [the Medical Devices Directive]".

Notified Bodies were under a general obligation to act with all due diligence when engaged in a procedure relating to the EC declaration of conformity.

Question 1 – Liability of Notified Bodies

The CJEU held that Medical Devices Directive must be interpreted such that the purpose of a Notified Body's involvement in the procedure relating to the EC declaration of conformity is to protect the end users of the medical devices.

However, the conditions under which culpable failure by that body to fulfil its obligations under the Medical Devices Directive in connection with that procedure may give rise to liability on its part regarding those end users that are governed by national law, subject to the principles of equivalence and effectiveness.

The CJEU considered the following points in reaching this conclusion:

• The aim of the Medical Devices Directive was not only the protection of health stricto sensu, but also the safety of persons and that it does not concern only patients and users of medical devices, but "third parties" or "other persons" more generally (as considered by the CJEU in Nordiska Dental). Accordingly, the actual aim of the Medical Device Directive was to protect end users of medical devices.
• While it was the primary responsibility for manufacturers to ensure that medical devices comply with the requirements of the Medical Devices Directive, the legislation also imposed obligations to that end on the Member States and Notified Bodies.
• As CJEU held in Lohmann & Rauscher International that it was a combination of the obligations in connection with procedures for safeguarding, vigilance and health surveillance under the Medical Devices Directive, ensures the protection for the health and safety of persons.
• It was also apparent from the wording and overall scheme of the Medical Devices Directive that the purpose of the procedure relating to the EC declaration of conformity was to ensure protection for the health and safety of persons.

On the matter of culpability of a Notified Body regarding end users of medical devices, the CJEU considered (referring to its previous judgment in Paul and Others, Case C-222/02) that it did not necessarily follow that the fact that a Directive imposes surveillance obligations on certain bodies, or the fact that one of the objectives of the Directive is to protect injured parties, that the Directive seeks to confer rights on such parties in the event that those bodies fail to fulfil their obligations, and that is the case especially if the directive does not contain any express rule granting such rights.

In addition, it could not be maintained that the purpose of the Medical Devices Directive is to govern the conditions under which the end users may be able to obtain compensation for culpable failure by Notified Bodies to fulfil their obligations, in the absence of any mention in that Directive of the manner in which civil liability of Notified Bodies may be incurred.

Further, the mere fact that Notified Bodies are required to take out civil liability insurance under the Medical Devices Directive is not sufficient to conclude that the Directive requires Member States to confer on end users of medical devices who have suffered injury as a result of culpable failure on the part of Notified Bodies to fulfil their obligations a right to look to Notified Bodies for compensation.

Consequently, the conditions which culpable failure on the part of a Notified Body to fulfil its obligations under the procedure relating to the EC declaration of conformity set out in the Medical Devices Directive may give rise to liability on its part regarding end users was a matter for national law, subject to the principles of equivalence and effectiveness.

Will the CJEU's judgment give rise to even more divergent decisions?

The CJEU's judgment is broadly aligned with Advocate General's Opinion, which will not come as a surprise to many given the need for greater safety and scrutiny of devices. However, it raises interesting questions on how the judgment will be applied by national courts in the EU.

EU Directives need to be implemented in the national law of Member States – what might be considered to be a medical device in one country may be considered to be a general consumer product in another.

Additionally, national laws determining the conditions under which culpable failure could give rise to liability are divergent as illustrated by our analysis of how the CJEU's judgment might be applied in the German, French and English courts.

Germany

Liability in contract or in tort will depend on whether the court classifies the Notified Body's omissions as a negligent violation of the Notified Body's relevant obligations.

The German Courts will therefore apply their own assessment on whether there have been indications for the defectiveness of a medical device and whether the Notified Body violated any obligations to recognise such indications and to act accordingly.

One main allegation made by Mrs Schmitt was that the TÜV Rheinland failed to conduct unannounced audits.

Given that the case took place before the stricter standards for the work of Notified Bodies were introduced by the Commission Implementing Regulation (EU) No. 920/2013, the omission of unannounced audits would rather not be qualified as breach of a duty as long as the Notified Body has no specific indications to suspect the necessity of an unannounced audit.

This assessment will, however, change with the introduction of the new Medical Device Regulation as it expressly mandates a Notified Body to conduct unannounced audits.

By confirming the Medical Device Directive has protective effect, the CJEU indeed opened the way for a liability of Notified Bodies under German Law.

Patients who have come to harm may be entitled to damages from Notified Bodies by virtue of contractual principles; if the certification contract between the manufacturer and the Notified Body is confirmed to have a protective effect on the patient, the Notified Body could be held liable for breaching a contract protecting others.

Besides, a duty to act in order to protect others, owed by a Notified Body to a patient, could be grounded in law, particularly the German Medical Devices Act. A violation of this duty to act in order to protect others (in this case, patients and other end users) might constitute a tortuous liability of the Notified Bodies.

Following the same line of reasoning, in the future the regulatory authorities designated to supervise Notified Bodies might also be liable if they violated their obligations in order to act to protect third parties.

However, under the German Civil Code, liability of a public entity is excluded to the extent a private entity is liable for the same damage. Consequently, the supervisory authority would not be liable if a Notified Body is held to be liable.

France

The Toulon Commercial Court held in November 2013 that TÜV Rheinland had failed in its duties under the Medical Devices Directive and ordered interim payments to the claimants pending further assessment of their claims. However, that decision was reversed by the Court of Appeal in Aix-en-Provence in July 2015.

In a further twist to the tale, the Toulon Commercial Court again held on 20 January 2017 that TÜV Rheinland had failed in its duties under the Medical Devices Directive and ordered payment of provisional amounts to the claimants (which include former foreign distributors of the implants, foreign clinics, a sales representative of PIP and patients).

However, it should be noted that the the judgment was handed down before the CJEU's ruling and that the Toulon Commercial Court was not bound under French law to follow the decision of Court of Appeal in Aix-en-Provence.

It is interesting to note that the Toulon Commercial Court considered in its 2017 judgment that the obligation and the quality of the control of TÜV Rheinland was weakened over the years it was engaged by PIP and that it did not fulfill its obligation of vigilance pursuant to the Medical Device Directive.

In this respect, it seems that its national court's judgment may not be entirely inconsistent with the ruling of the CJEU.

Indeed, the CJEU considered that Notified Bodies have a duty of vigilance, something that was also underlined by the Toulon Commercial Court. If the Court of Appeal is once again called upon to take a stake on this case – which we understand will be the case – it will have to take into account the ruling of the CJEU in accordance with the principle of supremacy of European Union Law.

In this respect, the CJEU also refers in this ruling to the fundamental principles of equivalence and effectiveness. According to these principles, the enforcement of European Union rights by the national courts cannot lead to jeopardise the uniform application of European Union Law.

Thus, if it falls to national laws and courts to determine the conditions under which a failure by a Notified Body to fulfil its obligations can give rise to liability towards the end users, such national laws and courts remain subject to the respect of the EU principles of equivalence and effectiveness.

United Kingdom

The United Kingdom has three distinct legal jurisdictions:

• England and Wales
• Scotland
• Northern Ireland.

According to English law, a claim for negligence or a breach of a statutory duty that specifies a particular standard of care will only be successful if the following criteria are satisfied:

• the defendant has breached the duty by falling below the required standard
• the harm or loss suffered by the claimant has been caused by that breach.

There must be no break in the chain of causation.

The questions to be asked by the English courts would include: what is the scope of the duties, what is the standard of care to be applied in the relevant circumstances and whether that standard has been complied with.

However, the CJEU's decision recognises that there is a degree of discretion that a Notified Body can exercise when carrying out its duties, which appears to make the concept of a standard of care to be a moving target.

In addition, the standard of care might depend on the class of the relevant medical device – higher risk devices such as Class III devices require greater scrutiny from Notified Bodies and consequently a higher standard of care.

From a contract law perspective, a user of a medical device will not be able to bring breach of contract claim against a Notified Body where the user is not a party to the relevant agreement and if the rights of third parties are expressly excluded.

PIP litigation in the UK was largely commenced against surgeons and cosmetic surgery clinics with respect to breach of implied terms as to quality and fitness for purpose under a Group Litigation Order granted by the High Court in April 2012.

The impact of Brexit is another consideration. The government of the United Kingdom is anticipated to trigger the mechanism under Article 50 of the Treaty on European Union at the end of March 2017, which will start the negotiation process as to the exit of the country from the EU.

Comments

The legislative landscape surrounding medical devices in the EU has been subject to increasing scrutiny over the years since the outbreak of the PIP scandal.

In particular, the current legislative framework, which is governed by EU Directives will be replaced with two new EU Medical Device Regulations, which will introduce (amongst other things) greater supervision of Notified Bodies by Member States.

It is therefore not surprising that the CJEU's judgment is aligned with the Advocate General's opinion finding that Medical Devices Directive has protective effect. However, there are two notable issues:

• The judgment does not appear to be restricted to Class III medical devices. Medical devices are classified according to their risk profile (Class III being the highest under the Medical Devices Directive). The judgment could therefore apply to Notified Bodies in respect to other, lower risk, medical devices.
• The judgment does not detract from the fact that primary liability in respect to medical devices lies with the manufacturer.

It will be interesting to see how this judgment will be applied by national courts in the European Union. A CE mark permits a medical device to be marketed and sold in all Member States of the EU, even though the Notified Body may be domiciled in a particular country.

Therefore, a Notified Body could potentially face litigation in a number of EU countries for the substantially the same matter but with potentially different outcomes.

As outlined above, unannounced audits will be compulsory once the new Medical Device Regulation applies. On 7 March 2017, the European Council issued its position at first reading with a view to the adoption of the Medical Device Regulation. On 9 March 2017, the European Commission informed the European Parliament of its position supporting the European Council`s position.

If the text agreed by European Council is accepted by European Parliament in the next reading, the new medical devices legislation might finally come into force in the second half of 2017. According the latest draft of the Medical Device Regulation dated 22 February 2017, the new framework will apply three years after its entry into force.