(9)

the following Articles are inserted: ‘Article 39a Confidentiality request 1. When submitting an application, supporting scientific data and other supplementary information in accordance with Union law, the applicant may request certain parts of the information submitted to be treated as confidential in accordance with Article 39(2) and (3). Such request shall be accompanied by verifiable justification that demonstrates how making public the information concerned significantly harms the interests concerned in accordance with Article 39(2) and (3). 2. Where an applicant submits a confidentiality request, it shall provide a non-confidential version and a confidential version of the information submitted in accordance with standard data formats, where they exist, pursuant to Article 39f. The non-confidential version shall not include the information the applicant deems confidential on the basis of Article 39(2) and (3) and shall indicate the places where such information has been deleted. The confidential version shall contain all information submitted, including information the applicant deems confidential. Information requested to be treated as confidential in the confidential version shall be clearly marked. The applicant shall clearly indicate the grounds on the basis of which confidentiality is requested for the different pieces of information. Article 39b Decision on confidentiality 1. The Authority shall: (a) make public the non-confidential version of the application as submitted by the applicant without delay once that application has been considered valid or admissible; (b) proceed, without delay, to a concrete and individual examination of the confidentiality request in accordance with this Article; (c) inform the applicant in writing of its intention to disclose information and the reasons for that, before the Authority formally takes a decision on the confidentiality request. If the applicant disagrees with the assessment of the Authority, the applicant may state its views or withdraw its application within two weeks of the date on which it was notified of the Authority's position; (d) adopt a reasoned decision on the confidentiality request, taking into account the observations of the applicant, within 10 weeks of the date of receipt of the confidentiality request with respect to applications and without delay in the case of supplementary data and information; notify the applicant of its decision and provide information on the right to submit a confirmatory application in accordance with paragraph 2; and inform the Commission and the Member States, where appropriate, of its decision; and (e) make public any additional data and information for which the confidentiality request has not been accepted as justified at the earliest two weeks after the notification of its decision to the applicant has taken place pursuant to point (d). 2. Within two weeks of the notification of the Authority's decision on the confidentiality request to the applicant pursuant to paragraph 1, the applicant may submit a confirmatory application asking the Authority to reconsider its decision. The confirmatory application shall have suspensive effect. The Authority shall examine the grounds for the confirmatory application and shall adopt a reasoned decision on that confirmatory application. It shall notify the applicant of that decision within three weeks of submitting the confirmatory application and shall include in that notification information on the available remedies, namely an action before the Court of Justice of the European Union (the “Court of Justice”) against the Authority pursuant to paragraph 3. The Authority shall make public any additional data and information for which the confidentiality request has not been accepted by the Authority as justified, at the earliest two weeks after the notification of the Authority's reasoned decision on the confirmatory application to the applicant has taken place pursuant to this paragraph. 3. Decisions taken by the Authority pursuant to this Article may be subject to an action before the Court of Justice, under the conditions laid down in Articles 263 and 278 of the Treaty on the Functioning of the European Union (TFEU) respectively. Article 39c Review of confidentiality Before the Authority issues its scientific outputs, including scientific opinions, it shall review whether information that has been previously accepted as confidential may nevertheless be made public in accordance with point (b) of Article 39(4). Should that be the case, the Authority shall follow the procedure laid down in Article 39b, which shall apply mutatis mutandis. Article 39d Obligations with regard to confidentiality 1. The Authority shall make available, upon request, to the Commission and the Member States all information in its possession relating to an application or to a request by the European Parliament, by the Commission or by the Member States for a scientific output, including a scientific opinion, unless otherwise indicated in Union law. 2. The Commission and the Member States shall take the necessary measures so that information received by them under Union law for which confidential treatment has been requested is not made public until a decision on the confidentiality request has been taken by the Authority and has become final. The Commission and the Member States shall also take the necessary measures so that information for which confidential treatment has been accepted by the Authority is not made public. 3. If an applicant withdraws or has withdrawn an application, the Authority, the Commission and the Member States shall respect the confidentiality of information as granted by the Authority in accordance with Articles 39 to 39e. The application shall be considered withdrawn as of the moment the written request to that effect is received by the competent body that had received the original application. Where the withdrawal of the application takes place before a final decision on the confidentiality request has been adopted by the Authority pursuant to, where appropriate, Article 39b(1) or (2), the Commission, the Member States and the Authority, shall not make public the information for which confidentiality has been requested. 4. Members of the Management Board, the Executive Director, members of the Scientific Committee and Scientific Panels as well as external experts participating in their working groups, members of the Advisory Forum and members of the staff of the Authority, even after their duties have ceased, shall be subject to the requirements of the obligation of professional secrecy pursuant to Article 339 TFEU. 5. The Authority shall lay down in consultation with the Commission the practical arrangements for implementing the confidentiality rules laid down in Articles 39, 39a, 39b, 39e and in this Article, including arrangements concerning the submission and treatment of confidentiality requests with respect to information to be made public under Article 38, and taking into account Articles 39f and 39g. As regards Article 39b(2), the Authority shall ensure that appropriate separation of tasks is applied for the assessment of confirmatory applications. Article 39e Protection of personal data 1. With respect to requests for scientific outputs, including scientific opinions under Union law, the Authority shall always make public: (a) the name and address of the applicant; (b) the names of authors of published or publicly available studies supporting such requests; and (c) the names of all participants and observers in meetings of the Scientific Committee and the Scientific Panels, their working groups and any other ad hoc group meeting on the subject matter. 2. Notwithstanding paragraph 1, disclosure of names and addresses of natural persons involved in testing on vertebrate animals or in obtaining toxicological information shall be deemed to significantly harm the privacy and the integrity of those natural persons and shall not be made publicly available unless otherwise specified in Regulations (EU) 2016/679 (*1) and (EU) 2018/1725 (*2) of the European Parliament and of the Council. 3. Regulations (EU) 2016/679 and (EU) 2018/1725 shall apply to the processing of personal data carried out pursuant to this Regulation. Any personal data made public pursuant to Article 38 of this Regulation and this Article shall only be used to ensure the transparency of the risk assessment under this Regulation and shall not be further processed in a manner that is incompatible with these purposes, in accordance with point (b) of Article 5(1) of Regulation (EU) 2016/679 and point (b) of Article 4(1) of Regulation (EU) 2018/1725, as the case may be. Article 39f Standard data formats 1. For the purposes of point (c) of Article 38(1) and in order to ensure the efficient processing of requests to the Authority for a scientific output, standard data formats shall be adopted in accordance with paragraph 2 of this Article to allow documents to be submitted, searched, copied and printed, while ensuring compliance with regulatory requirements set out in Union law. Those standard data formats shall: (a) not be based on proprietary standards; (b) ensure interoperability with existing data submission approaches to the extent possible; (c) be user-friendly and adapted for the use by small and medium-sized enterprises. 2. For the adoption of standard data formats referred to in paragraph 1, the following procedure shall be followed: (a) the Authority shall draw up draft standard data formats for the purposes of the different authorisation procedures and relevant requests for a scientific output by the European Parliament, by the Commission and by the Member States; (b) the Commission shall, taking into account the applicable requirements in the different authorisation procedures and other legal frameworks and following any necessary adaptations, adopt, by means of implementing acts, standard data formats. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 58(2); (c) the Authority shall make the standard data formats, as adopted, available on its website; (d) where standard data formats have been adopted pursuant to this Article, applications as well as requests for a scientific output, including a scientific opinion by the European Parliament, by the Commission and by the Member States, shall only be submitted in accordance with those standard data formats. Article 39g Information systems The information systems operated by the Authority to store its data, including confidential and personal data shall be designed in a way that guarantees that any access to it is fully auditable and that the highest standards of security appropriate to the security risks at stake are attained, taking into account Articles 39 to 39f. (*1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1)." (*2) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).’;"