With the entry into force of Regulation 2017/745 (MDR), all doubts have been removed as to whether medical devices can also be sold online. Indeed, Article 6 states as follows: ‘A device offered by means of information society services, as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535, to a natural or legal person established in the Union shall comply with this Regulation‘.

However, the Regulation does not provide further indications on how to carry out distance sales: neither the channels that can be used or the possible recipients, nor specific authorisation procedures to be followed are identified (as instead required for the online sale of medicines). Consequently, in abstract, medical devices can be sold online through e-commerce sites of one of the economic operators involved in the supply chain (manufacturer, distributor or importer) and in generic marketplaces. Both channels can be directed at consumers and professionals, without distinction. Within this completely liberal framework, however, there are other laws and regulations in force in Italy, different from the MDR, that must be respected in the online sale of medical devices. In particular:

• Regulation 2019/1020 on market surveillance and compliance of products (and the indications of the Blue Guide 2022)
• Legislative Decree 70/2003 and Consumer Code;
• The legislation on the advertising of medical devices;
• The EU Data Protection Regulation 679/2016 known as the GDPR.

Regulation 2019/1020 (and the Blue Guide on the Implementation of EU Product rules 2022)

Let’s start with the vigilance over devices sold online and therefore the assessment of when a device is considered to be placed on the EU market. On this point (somewhat critical in the case of online sales), the Blue Guide to the implementation of EU product regulations, in its most recent version updated in July 2022, comes to the rescue. The Blue Guide is a document of the European Commission whose aim is to contribute to a uniform interpretation and application of the various EU product regulations, including the MDR. With regard to products offered online (or by other means of distance selling), they are only considered to be made available on the European market if “the offer is targeted at end users in the Union”. This is the case when ‘the relevant economic operator directs, by any means, its activities to a Member State’, according to Article 6 of Regulation 2019/1020. In other words, the mere possibility of accessing the e-commerce site in a given Member State does not automatically result in the medical device sold on that platform being made available in that European State.

Instead, it must be assessed on a case-by-case basis whether there are concrete indicators that prove that the product is aimed at the European market: for example, the language in which the website is displayed in the Member State (e.g. if the e-commerce site is accessible from Germany in German) or the currency in which it is possible to pay. Understanding when a medical device offered on an e-commerce site is considered to be made available on the European market is highly relevant: in fact, it is at the time of placing on the market that the device must comply with the relevant legislation, currently MDR or MDD in the case of legacy devices (Article 120 MDR). Moreover, only if actually made available on the EU market will these products be subject to Regulation 2019/1020 and thus to the supervisory activities of the competent authorities. This implies for the economic operator offering the products on the e-commerce site the obligation to cooperate with the competent authority and thus to be in possession of all technical and conformity documentation of the offered product (or to be able to retrieve it quickly).

Legislative Decree 70/2003 and the Consumer Code

Online sales are regulated in Italy by Legislative Decree 70/2003 implementing Directive 2000/31/EC on certain legal aspects of information society services, in particular electronic commerce, in the internal market. Furthermore, if the recipient of the offer is a consumer, the Consumer Code (Legislative Decree 206/2005) also applies. First of all, therefore, in order to be able to sell medical devices online correctly, it will be necessary to clarify whether one is addressing a professional or a consumer and, only in the latter case, to also comply with the Consumer Code. On this, in fact, will depend:

• the correct drafting of the general purchase conditions of products. In fact some clauses, which are valid when included in a contract with a healthcare professional, may be considered unfair under the Consumer Code, and therefore null and void, when included in a contract with a consumer;
• the proper design of the e-commerce site itself. For example, if a device, on the basis of the instructions for use provided by the manufacturer, is intended solely for healthcare professionals, the e-commerce site must be built in such a way as to prevent or at least limit the possibility for the non-professional consumer to purchase it, for example by creating reserved areas, requiring users to declare that they are ‘healthcare professionals’, publishing disclaimers clarifying that the devices are for use only by healthcare professionals, etc.

The EU Regulation 679/2016 (GDPR)

When building the e-commerce site, the site owner must then also take into account the GDPR and all the obligations it imposes, to ensure the full protection of users’ personal data and compliance with the principles of processing, in particular that of privacy by design and by default. The site will obviously have to be accompanied by the information notice pursuant to Article 13 of the GDPR and the possibility of granting the appropriate consent (or denying it) in the event that the data are to be used for purposes other than mere buying and selling, such as marketing.

Advertising legislation

Finally, it should be noted that every e-commerce site must also take into account the regulations on the advertising of medical devices. The MDR has addressed this matter for the first time (Article 7-Declarations), stating that: “In the labelling, instructions for use, making available, putting into service and advertising of devices, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the user or the patient with regard to the device’s intended purpose, safety and performance:

• ascribing functions and properties to the device which the device does not have;
• creating a false impression regarding treatment or diagnosis, functions or properties which the device does not have;
• failing to inform the user or the patient of a likely risk associated with the use of the device in line with its intended purpose;
• suggesting uses for the device other than those stated to form part of the intended purpose for which the conformity assessment was carried out.”

In addition to the MDR provision, with regard to medical device advertising, it should be noted that the Circular of the Italian Ministry of Health of 12 November 2021 reaffirmed the applicability of Article 21 of Legislative Decree 46/97, which provides for the obligation to request prior authorisation from the Ministry of Health in order to advertise medical devices. Moreover, the draft MDR harmonisation decree (implementation of Delegated Law No. 234 of 22/4/2021) preliminarily approved on 5 May 2022 (but still under discussion) prohibits in Article 26 the advertising to the public of the following medical devices:

• custom-made devices referred to in Article 2(3) of the MDR;
• devices for the use of which the assistance of a physician or other health professional is prescribed as mandatory by the regulations in force;
• devices for the use of which, according to the manufacturer’s indications, the assistance of a physician or other health professional is mandatory;
• medical devices the sale of which to the public is subject, under the regulations in force, to prescription by a physician.

However, prior authorisation is required for all other medical devices (as is already the case for Article 21 of Legislative Decree 46/97). It is therefore foreseeable that, except for except for websites carrying out only the activity of selling medical devices, in all cases where promotional content is also involved, it will have to be subject to ministerial authorisation.

Controls on online sales activity

Article 6(4) of EU Regulation 745/2017 then stipulates that each Member State has the power to restrict the exercise of information society service activities, for reasons of public health protection. The current version of the draft legislative Decree harmonising the Italian framework to the MDR (as mentioned above, still under discussion) in Article 24 prescribes:

“In order to guarantee the safety of medical devices offered for distance sale to the public by means of the information society services referred to in Article 2(1)(a) of Legislative Decree No 70 of 9 April 2003, the Ministry of Health is the authority responsible for issuing measures to prevent access to the Internet addresses of websites identified as promoting illegal practices by users, through Internet connection requests from the Italian territory, pursuant to Articles 14(3), 15(2) and 16(3) of the same decree”.

“The Ministry of Health shall order, also following the inquiry of the conference of services referred to in paragraph 2, by means of a reasoned act and as a matter of urgency, the cessation of commercial practices consisting in the offer of medical devices through information society means in violation of the provisions of the regulation”.

Therefore, vigilance over online sales of medical devices will (quite presumably) be entrusted to the Ministry of Health in collaboration with the Italian anti-adulteration units (NAS). The Ministry, therefore, will have the power not only to supervise the correctness of the distance sale of medical devices, but also to order their termination if it detects violations or safety issues with the medical devices offered for sale.