Company: BLRX
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001178913-25-001123
Chunk: 204

Company: BioLineRx Ltd.
Filing Date: 2025-03-31
Form: 20-F
Item: Item 4
Chunk 204
---
 for medicines marketed within the EU provided in Regulation (EC) No 726/2004 with respect to EU authorized medicinal products and in Directive 2001/83/EC with respect to nationally authorized medicinal products (including those authorized through the mutual recognition and decentralized systems). Furthermore, EU good pharmacovigilance practice (GVP) rules apply. With the amended pharmacovigilance requirements, the financial and organizational burden on market authorization holders increased significantly, such as the obligation to maintain a pharmacovigilance system master file that applies to all holders of marketing authorizations granted in accordance with Directive 2001/83/EC (as amended on January 1, 2025) or Regulation (EC) No 726/2004 (as amended on January 28, 2022). Marketing authorization holders must furthermore collect data on adverse events associated with use of the authorized product outside the scope of the authorization. Pharmacovigilance for biological products and medicines with a new active substance is strengthened by subjecting their authorization to additional monitoring activities.
 
Another relevant aspect in the EU regulatory framework is the “sunset clause”: a provision leading to the cessation of the validity of any marketing authorization if it is not followed by marketing within three years or, if marketing is interrupted for a period of three consecutive years.
 
Data Privacy in the EU
 
The EU has a strict regime on data privacy under the General Regulation on Data Protection, Regulation 2016/679 (GDPR), as amended on May 4, 2016, that has become applicable on May 25, 2018. The GDPR as an EU regulation does not have to be implemented into member states’ national law but applies directly in all member states. It applies to companies with an establishment in the European Economic Area (EEA) that includes the 27 member states of the EU and Norway, Iceland and Liechtenstein. Furthermore, the GDPR applies to companies not located in the EEA but processing personal data of individuals located in the EEA (e.g., through online business). The GDPR implements stringent operational requirements for controllers of personal data, including, for example, obligations to justify the collection, use and other processing of personal data (e.g., based on the individual’s consent), to notify the individuals concerned about data processing activities, to protect all processed personal data through appropriate technical and organizational measures, and to implement a data protection compliance management. Furthermore, the GDPR defines high data security and compliance standards for the transfer of personal data to third countries