External whistleblowing policy

The European Medicines Agency (EMA) has put in place a policy for handling alledged breaches within its remit received from external persons, also known as whistleblowers. Such breaches may include allegations of non-compliance with standards of good practices that could have an impact on the evaluation and supervision of human and veterinary medicines. This policy enables EMA to protect the confidentiality of whistleblowers.

The goal is to create an environment where external whistleblowers feel confident to:

• raise concerns on breaches in their area of work;
• submit information or evidence about breaches within EMA’s remit that they may have observed or become aware of.

Policy and procedure

First published in 2017, EMA's whistleblowing policy available below provides a framework for assessing reports from external whistleblowers and coordinating any further investigation, while protecting the confidentiality of the reporting person.

EMA revised the policy in April 2022, with changes in the following areas:

• Definitions of breaches, which include more examples of allegations
• Reporting process, which includes an interim report that whistleblowers can receive if a longer investigation is required
• Acknowledgement of receipt for external reports, which is shortened from 15 to 7 days
• Clarification of the roles of the European Anti-Fraud Office (OLAF) and the European Public Prosecutor's Office (EPPO) in investigating suspected fraud 

The revision also aligned the policy with Directive (EU) 2019/1937 on protecting persons who report breaches of EU law.

EMA has a separate whistleblowing policy for its staff, including seconded national experts, trainees and interims.

Revised policy: EMA's handling of information from external reporting persons about alleged breaches related to the authorisation, supervision and maintenance of human and veterinary medicinal products or other EMA activities

Reference Number: Policy/0072

For more information, see:

• European Anti-Fraud Office (OLAF)
• European Public Prosecutor's Office (EPPO)

How to report a concern

Anyone external to EMA who becomes aware of breaches that might have an impact on EMA's activities may report these allegations to EMA, by writing to [e-mail].

They should preferably use the template below:

Template to report an allegation concerning breaches in an area of EMA’s responsibility (authorisation, supervision and maintenance of human and veterinary medicinal products)

They can also send a letter to EMA.

For information on the EMA's postal address, see:

• Contacts at the European Medicines Agency

What will EMA do

EMA sends an acknowledgement of receipt, by letter or email, within 7 days after receiving the report. Additional information might be requested from the reporting person, if needed.

The Agency always informs the reporting person of the outcome of the assessment, unless they have chosen to remain anonymous.

EMA notifies whistleblowers if it transfers the report to another competent authority for investigation. This happens when the reported breach falls outside of EMA's remit.

Type of medicine concerned

If the allegations concern a centrally authorised medicine, EMA coordinates an investigation. If there are any concerns that the allegations may affect the balance of benefits and risks of the medicine, EMA's scientific committees may consider taking regulatory action.

If the allegations concern a nationally authorised medicine, EMA may, following a case-by-case basis assessment, refer the matter to the national competent authority in the European Union Member State where the concerned medicine is authorised. It will be up to the national competent authority concerned to further investigate the case and take any necessary action, as appropriate, and to inform the Agency of the outcome.

Fraud

If there is a suspicion of fraud, the Agency refers the case to the European Anti-Fraud Office (OLAF) or to the European Public Prosecutor's Office (EPPO).

For more information, see: 

• Anti-fraud strategy

Data protection

EMA keeps the identity of the reporting person strictly confidential, whether the information provided leads to further investigation or not.

When transferring a report to another authority, the Agency only includes personal data if the external reporting person agrees to this.

EMA treats all personal data that it collects from external whistleblowers in accordance with the Regulation for data protection for EU institutions (Regulation (EU) 2018/1725), also known as the EU DPR. 

For more information, see: 

• Data protection and privacy