1. The EU Health Threats Decision as a public health security and crisis management measure

Formally, the Health Threats Decision is a public health law measure based on Article 168(5) of the Treaty on the Functioning of the European Union (“TFEU”). This provision delineates the EU’s overall competence to support, coordinate or supplement the actions of the Member States in the area of public health, and provides that it should complement national policies in monitoring, early warning and combatting serious cross-border threats to health.^{Footnote 8}

The Decision is the newest EU act in the history of public health policy and disease prevention and control which has continued since the late 1980s and the early 1990s. This history has been characterised by several processes, namely the responsiveness to transboundary disease outbreaks requiring common solutions linked to the neoliberal aspirations to protect the integrity of the EU internal market; the gradual adoption of rules establishing tools for epidemiological surveillance, risk information, sharing and knowledge production, and the operation of early warning networks; as well as the so-called “agentification”: the gradual empowerment of several EU agencies (ECDC, European Food Safety Authority: “EFSA”; European Medicine Agency: “EMA”) with relevant competence in the field.^{Footnote 9} The origins of the act can be traced back not only to the claims for a better EU-wide co-ordination of preparedness systems and responses to diverse types of health threats, but also to the demands for actions against various bio-threats to health (eg pandemics, bio-terrorism) which coincided with international developments of a global health regime, especially of the International Health Regulations (“IHR”) of the World Health Organisation.^{Footnote 10}

As a result, the nature of the Decision actually reaches beyond the area of EU public health law. It is both a disease control measure and one of the central legislative acts within a complex system of instruments in the area of EU crisis management which strengthened significantly after the Treaty of Lisbon.^{Footnote 11} Its objective is to support EU multi-level and horizontal cooperation and coordination, both between Union actors and national authorities, in order to improve the prevention and control of the spread of severe human diseases and to combat other serious, transboundary health threats, and, hence, to contribute to a high level of public health protection. This is implemented, to a large extent, through the transnational mechanisms of information detection, collection, analysis, and dissemination.^{Footnote 12} The Decisioin lays down specific provisions regulating mechanisms for information exchange, epidemic surveillance and monitoring to complement national policies and, further, clarifies powers of both EU and national bodies, including of the European Commission and the ECDC; and institutionalises the Health Security Committee (Member States’ high-level policy officials), to reinforce mutual coordination.^{Footnote 13} These elements of the governance system established by the Decision also respond to the requirement to effectively deal with complex crisis management, including a collaborative and joint capacity of authorities to process relevant information about various threats and their risks.^{Footnote 14}

The Health Threats Decision is thus an exemplary illustration of a recent trend in EU TCM to increase the EU-level capacity to respond to crises: it aims to overcome fragmentation of EU capabilities in different policy-sectors, and consolidates the institutional structure for all threats that have a cross-cutting dimension of impacting on health. The Decision is also a very strong case of the “collective” securitisation of health in the EU by normative means: it is based on the “integrated approach” to health and security, and it is designed to use public health networks for disease surveillance and other measures of information exchange also for security purposes.^{Footnote 15} This is confirmed by the risks of threats covered by the Decision, which can be natural or man-made; and also by the special clauses to ensure the confidentiality of classified security information exchanged on the basis of the act.^{Footnote 16} The act reflects the EU strategic aim of enhancing its role in global health security.^{Footnote 17}

Finally, the Decision is also an example of the “all-hazards approach” to public health security for it applies to a wide range of “serious, cross-border threats” to health.^{Footnote 18} The material scope of this notion encompasses: biological threats including contagious diseases, antimicrobial resistance and healthcare-associated infections, bio-toxins or other harmful biological agents, as well as threats of chemical, environmental and unknown origin.^{Footnote 19} In order to further implement this approach, the Decision aims to link several alert systems, which earlier operated separately, with the early warning system for health, and modifies the structure of instruments designated for information collection, transfer and analysis together with the reinforcement of powers of the relevant EU agencies (ECDC, EFSA).^{Footnote 20} In effect, it means connection of the earlier separate policies and instruments through the mechanisms of information exchange.

2. A need for interdisciplinary conceptualisation

Most of the transnational crises and disasters which occurred in Europe in past decades had an impact on health. However, the literature analysing the common core norms and values of the EHCDM is limited.^{Footnote 21} First, there is a relative shortage of pertinent legal studies of EU public health law.^{Footnote 22} Second, several recent volumes considering legal frameworks for disasters, crises, threats, and risk regulation of emergencies mostly, or maybe even entirely, neglect the health dimension.^{Footnote 23}

At the same time, EU public health policy, its measures and tools have been much more extensively explored in the crisis management research, typically as one of the case studies where the EU has developed instruments and means of transboundary crisis management protecting against health threats, and has performed the role of a crisis manager at large.^{Footnote 24} These studies devote a lot of attention to the mechanisms of collection, transfer and dissemination of information and knowledge, as well as to their operation and functioning in the context of crises and disasters. The EU alerting and reporting systems for health have also been analysed in the health and environmental security studies, in particular from the perspective of the chemical, biological, radioactive and nuclear (CBRN) security, and in the field of international relations.^{Footnote 25} Specifically, several works exploring information management systems in EU health threats policy and their operation and technical aspects have recently been published in the framework of the so-called new “material” turn in new security studies.^{Footnote 26} For the purposes of this article, TCM and IR scholarship is helpful in unveiling the nature of tools regulated by the Health Threats Decision and EHCDM. The lens of “distributed sense-making”, which has been explored by Ansell, Boin and Keller as one of the boundary-spanning mechanisms essential for an effective response to transboundary crises, will be specifically referred to.^{Footnote 27}

The works of Giandomenico Majone are equally useful in theorising the role of information in performing a regulatory function.^{Footnote 28} The policy area to which Majone’s work principally refers is risk regulation of product safety, but his claims can provide the equally applicable heuristic means to unpack EHCDM because it too is an area underpinned by deep uncertainty and risks of threats where provision of risk assessment and analysis of scientific knowledge are central to decision-making processes.^{Footnote 29}

Finally, the multi-level governance of health in the EU has been a subject of inquiry not only in the risk regulation literature, but also in general EU administrative law, especially in the context of the role of EU agencies, and the so-called EU “integrated administration” and “composite administrative procedures”.^{Footnote 30} These works encompass normative and institutional analyses of EU/national networks of authorities, including their powers and decision-making procedures, often based on electronic tools of information-exchange.^{Footnote 31} For the case under analysis, ie the cross-border, electronic mechanisms and networks sharing information on health threats, these perspectives can offer frameworks of appraisal in light of the EU principles and fundamental rights, in addition to the criteria for the assessment of policy credibility, especially, regarding independence and reputation of institutions, transparency of decision-making processes and accountability.^{Footnote 32} It means that both the scholarship of EU administrative law and risk regulation can provide helpful yardsticks for the analysis of possible problems in the functioning of tools established by the Health Threats Decision.^{Footnote 33}

In sum, it is evident from this section that it is necessary to engage with interdisciplinary conceptualisation to assess the complexity of the EU health crisis and disaster governance. Accordingly, it is important to repeat that the transdisciplinary conceptual lens contributes to the situating of the Health Threats Decision in a broader regulatory context, but, above all, it helps to uncover the nature of the mechanisms for information exchange embedded in it, and, finally, allows for their appraisal.

1. Exchange of information on national preparedness plans

The first type of mechanism of information exchange is an example of the so-called “structured information exchange” between national authorities and the Commission.^{Footnote 41} Pursuant to the provisions of the Health Threats Decision, the following information must be provided by Member States to the Commission: core capacity standards for preparedness and response as required by the IHR; a description of the measures (arrangements) which ensure interoperability between the health sector and other sectors identified as critical in case of an emergency (eg coordination structures for cross sectoral incidents); and business continuity plans.^{Footnote 42} The information on preparedness planning must be updated when the arrangements are substantially revised at the national level, and in any case every three years. The scope of information which goes beyond the IHR requirements is applicable only if such measures are part of national plans. At the same time, Member States must ensure that handling of the information provided by any person in their territory is covered by national security regulations, which offer a degree of protection at least equivalent to the respective EU/Euratom rules.^{Footnote 43}

The format for the required information has been standardised by means of a template laid down in the implementing rules.^{Footnote 44} The templates ensure the quality of submitted data, ie their comparability and relevance to the objectives of the coordination of preparedness and response efforts to transnational health threats, as required by the Decision.^{Footnote 45} Those objectives include: sharing best practice and experience; promoting the interoperability and addressing the inter-sectoral dimension of preparedness; as well as supporting the implementation of core capacities as required by the IHR. The information based on the templates forms a basis for reports submitted to, and discussed within, the Health Security Committee, its permanent working group on preparedness and the Commission.

With regard to implementation of the provisions, the Commission reported in 2015 that the information was provided by national authorities via a dedicated “EUSurvey” website in order to allow for secure, user-friendly and coherent reporting.^{Footnote 46} In fact, nine Member States only submitted their replies on time through an electronic survey, and a further 17 states submitted their replies late, only after the Commission had reminded them several times.^{Footnote 47} Finally, despite the delays in submitting the replies, the required exchange of information on preparedness and response planning took place. Similar electronic surveys were used to gather relevant data on national preparedness to detect, identify, confirm and manage patients with suspected or confirmed Ebola virus disease, MERS-corona-virus patients and cases of new avian influenza strains.^{Footnote 48} The Commission had also suggested that a further development of a dedicated and shared IT platform to facilitate information flow among stakeholders would be desirable, but this plan has not yet been implemented.^{Footnote 49} The ECDC has developed a self-assessment tool to support states in their health emergency preparedness and has published relevant reports, but they are not interactive platforms that would be based on comparative data.^{Footnote 50}

2. Epidemiological surveillance

The first tools of epidemiological surveillance were established in the EU in the late 1990s.^{Footnote 51} After the reform in the Health Threats Decision was introduced, it is now Article 6 which provides a legal basis for the establishment of a network for the epidemiological surveillance of communicable diseases and of related special health issues. Further, pursuant to the provisions of the Decision, the scope of surveillance covers all threats from biological agents, with the exception of bio-toxins which are not related to infectious diseases.

The function of the network is to ensure “permanent communication” between the Commission, the ECDC and Member States’ competent authorities. In practice, it functions on the basis of numerous IT tools, which include communication platforms of national/EU experts within different disease clusters (“Disease Programmes”) and databases accessible to EU/national designated authorities (eg National Focal Points for Surveillance and Disease Group-specific National Focal Points). The following types of IT tools operate within the network, hosted, operated and coordinated by the ECDC:^{Footnote 52}

• (a)TESSy (The European Surveillance System) is a database for EU/EEA communicable disease control which allows for “web-based data submission, data storage and dissemination”; it is a “fully anonymised database”.^{Footnote 53} Access to the database is restricted and password protected. The input comes from the reporting by national authorities of indicator-based information and statistics collected at national level.^{Footnote 54}

• (b)EPIS (Epidemic Intelligence Information System) is “a web-based communication platform that allows nominated public health experts” to internationally exchange epidemiological (technical) information in order “to assess whether current and emerging public health threats have a potential impact” in the EU. “It aims to ensure transparent and timely information sharing among the participating public health authorities in order to detect public health threats at an early stage and facilitate their reporting” and the coordination of response activities, as required by the Decision.^{Footnote 55} Access to EPIS is also restricted and it is composed of five different platforms for different groups of diseases in accordance with the ECDC specific Disease Programs (see Table 1 below).^{Footnote 56}

  Table 1:

  The comparison between EPIS and EWRS (source: the ECDC Internal Procedure on Response Operation, ECDC/IP/98 and own analysis)

  

• (c)Surveillance Atlas of Infectious Diseases is a further extension of EPIS. The aggregated data of the EPIS database are disseminated via this tool in a form of publically accessible reports and simulations with a geographical/temporal/disease-specific focus. It is also integrated with molecular surveillance for Food- and Waterborne Diseases. The reports are either traditional: (i) disease-specific surveillance reports; and (ii) cross-cutting annual epidemiological reports; or novel cross-sectorial reports, such as the one on antimicrobial consumption and resistance in humans and animals to secure cross-sectoral data feedback.^{Footnote 57}

• (d)MedISys is “a media monitoring system providing event-based surveillance to rapidly identify potential public health threats using information from media reports”.^{Footnote 58} The system displays the information and articles of interest to public health; it also analyses news reports and warns users with automatically generated alerts. The information processed by MEDISYS is derived from the Europe Media Monitor developed and operated by the EU Joint Research Centre.^{Footnote 59}

The system of epidemiological surveillance and its IT tools, especially the TESSy database, and the EPIS-system of communication networks and its Atlas of Infectious Diseases, represent a “shared database” category among the information management typology.^{Footnote 60} It is the most advanced form of information exchange and it enables national and EU authorities to directly access information entered into the system by other authorities or experts, in particular, without a prior request to another (data controlling) authority for mutual data transmission in every single case. The advantage of these IT tools is that stored data are exchanged horizontally and directly available for a longer time. Further, they can be retrieved and re-analysed, and, moreover, data from various EPIS platforms and networks can be linked and re-considered (Figure 1).

Figure 1:

ECDC Surveillance Atlas of Infectious Diseases: EU reported measles cases: 08.2018-08.2019 (source: https://atlas.ecdc.europa.eu/public/index.aspx)

In practice, it is the ECDC Response Team and every-day Round Tables of the Surveillance and Response Teams who seem to play a key and leading role in the management of the information and its cooperative evaluation. The information systems are the basis for the risk assessments produced by the ECDC (urgent, rapid, and standard).^{Footnote 61} The process usually includes internal and external experts (reviewers), with an expertise within a specific disease programme or health threat.^{Footnote 62}

3. Early Warning and Response System

The Early Warning and Response System (“EWRS”) is an electronic platform with access limited to international/EU/national competent authorities because of the possible processing of either personal data or other sensitive information about public health security. The process of sending alerts and the exchange of any information is always undertaken via designed electronic means (standard and selective messaging functionalities). The origins of the EWRS trace back to 1998.^{Footnote 63} Now, the details of the EWRS functioning, and its operational procedures, are regulated by the Health Threats Decision, or are awaiting further regulation, in the implementing acts of the Commission.^{Footnote 64}

EWRS is a rapid alert system and, as such, it constitutes an information management tool which is based on a duty to inform other authorities in the circumstances specified in the provisions of the Decision. It is said to be a manifestation of shared administrative responsibilities in the EU where a basic legislative act (here the Health Threats Decision) regulates the scope of powers, quality standards and form of the information to be exchanged, addressees of the process, their rights and duties, and when applicable, also all the relevant legal issues relating to data protection.^{Footnote 65}

Thus, a key obligation of the designated EWRS competent authorities at the national level, the ECDC and the Commission, is to “notify an alert in the EWRS where the emergence or development of a serious cross-border threat to health” fulfils the legal criteria cumulatively (the statutory conditions).^{Footnote 66} This must be done within 24 hours once the authorities become aware of a threat.^{Footnote 67} They are obliged to warn the EWRS partners in case of risk to health when: (1) “more than one Member State” is concerned (geographical criterion); (2) there is a high probability of risk based on any one of four possible indicators: an unusual character of event; a level of morbidity/mortality; pace of spreading; or an overall extent (risk factor); (3) “it requires or may require” a coordinated response at the EU level (the subsidiarity principle).^{Footnote 68} The understanding of a “cross-border” and “serious” character of a threat is defined broadly as “a life-threatening or otherwise serious hazard to health” which spreads or entails a significant risk of spreading across the Member States, and thus requires EU level response. Article 9 alert notification constitutes a key act of national and EU authorities within the EWRS. Regarding its implementation, the EWRS has been operational and useful in many cases of the need for response to infectious disease threats in the EU.^{Footnote 69}

Since June 2017, the EWRS has been undergoing an updating process, to be made compatible with the newest IT technologies, and to integrate features which allow the system to be used more efficiently for notification and crisis management, including a planned reform (eg connection to other, relevant EU-level alert systems).^{Footnote 70} To this end, the Commission (especially the Directorate General responsible for Health and Food Safety: DG SANTE) has been working closely with the ECDC and the ad hoc Health Security Committee working group on the EWRS update: the first version of the updated EWRS went live in October 2018. This included all the operable functionalities that were available in the previous platform, as well as new characteristics and functionalities, including a structured notification template, a search function, and a new tool to notify and monitor public health measures in response to serious cross-border threats to health.^{Footnote 71} The essence of a change related to transforming the previous “message-oriented” platform into a new, “threat-oriented” platform as well as to establishing the two new, important modules: (i) one interlinking with other EU alert and information systems; and (ii) one for maintaining a real-time overview of national public health measures taken for dealing with a serious cross-border health threat, that is, a dedicated “situation awareness” module.^{Footnote 72} The systems are due to be released in 2019.^{Footnote 73}

4. No implementation yet: ad hoc monitoring

Finally, the Health Threats Decision introduced a new tool, named “ad hoc monitoring”, but so far little has been known about its application and practical operation. The regulation in the Decision is quite concise (Article 7). It says simply that it applies to health threats other than infectious diseases, that is, in case of bio-toxic, chemical, environmental or unknown danger. It is activated following the Article 9 alert notification concerning one of those health threats. Member States and the Commission are then required to inform each other about the development of those threats at the national level and on the basis of information from national, internal monitoring systems.^{Footnote 74} Pursuant to Article 7, para 2, the mandatory information “shall include, in particular”: change in geographical distribution, spread and severity of the threat concerned and of the means of detection, if available.

This tool is supposed to function as a means of ad hoc surveillance for the above health threats, and for this reason it requires the mutual co-operation of Member States and the Commission via the channels of EWRS or the Health Security Committee. The implementation of this system has been so far unclear, especially with reference to the exact scope of shared data, its relation to the EWRS, and the protection of exchanged personal data (if any).

1. Regulating serious, cross-border health threats through information exchange

In order to demonstrate the nature of the systems of information exchange as a key tool in the EHCDM, their principal functions are analysed below. Three of these functions are key to the present analysis: integrative, regulatory, and sense-making functions.

a. Integrative function for the EU public health law and administration

To begin with, it should be said that the information systems embedded in the Health Threats Decision aim to compensate for the abolition of limits on cross-border traffic, to assist in overcoming spatial, territorial and linguistic barriers, and, as a result, to function as an important aspect of the ongoing process of European integration.^{Footnote 75} At the same time, their alerting and knowledge-providing functions operate as a safety net in case of health threats.^{Footnote 76}

Further, the IT tools described above constitute typical examples of a complex form of policy implementation by information exchange and knowledge production via administrative and expert networks in the so-called composite administrative proceedings, where a central decision to be taken is whether or not an alert should be made to all Member States and responsible EU institutions.^{Footnote 77} Notwithstanding the limited EU competence in the area of public health, the electronic mechanisms form a part of the shared and integrated EU administration where the Health Threats Decision (a legal text) provide for common rules. Their scope includes: joint gathering, exchange and management of information; duties to co-operate and consult between EU and national authorities; and, finally, a prescription of normative consequences of the alert which is sent in the EWRS (as regulated in Article 9 of the Health Threats Decision).^{Footnote 78}

With regard to its legal nature, Article 9 alert notification is a sui generis electronic act and an EU transnational administrative act which can cause several legal effects both at EU and national level, although technically competent authorities send it through simply starting a new case thread of information exchange within the system.^{Footnote 79} In accordance with the provisions of the Decision, it can trigger a risk assessment by the ECDC (or other EU agency), an obligation to assess risks, co-ordinate actions and manage risks by national competent authorities, and, moreover, the ad hoc monitoring and individual contact tracing measures, which can also entail the exchange of personal data.^{Footnote 80} Further legal consequences of an EWRS alert include: an obligation for authorities to communicate relevant information (Article 9); to inform other Member States of the need for action in case of non-biological health threats and further monitoring (Article 7); mutual consultation and co-ordination of national responses and risk and crisis communication (Article 11), including coordination within the Health Security Committee (Article 17).

The scope of information which authorities are obliged to provide in an Article 9 alert notification is the widest possible, to include “any available relevant information in their possession that may be useful for coordinating the response”.^{Footnote 81} The Health Threats Decision provides a detailed, non-exhaustive list of information which must be provided for the full characterisation of a health threat event and an organisation of an appropriate response. That is: (i) the type and origin of a (pathogenic) agent; (ii) the date and place of the incident or outbreak; (iii) the means of transmission; (iv) the methods of detection and confirmation; (v) toxicological data; (vi) public health risk; (vii) implemented/planned public health measures; and (viii) personal data.^{Footnote 82}

Finally, it is the ECDC who hosts and operates the information systems under the Health Threats Decision. This EU body is entrusted with a mandate of surveillance, detection and risk assessment of threats to human health of biological origin, including communicable diseases and related special health issues, as well as outbreaks of unknown origin.^{Footnote 83} ECDC risk assessments are stored in a database (but also made publicly available), so that they can constitute a common knowledge base and provide a further reference point in any future crisis for all EU/national authorities and stakeholders in a public health policy field.^{Footnote 84} The ECDC (together with the Commission and the Health Security Committee) is thus an EU agency at the centre of the integrated administration system which works to improve coordination between decision-makers, and to minimise uncertainties when detecting and managing crises. It is observed that both the EWRS threads of information exchange and the ECDC risk assessments contribute to the shared understanding of a nature of a particular health threat which is shaped in the Health Security Committee and in the Communicators’ network (see Table 2).^{Footnote 85}

Table 2:

Types of electronic systems of information exchange under Health Threats Decision

2. Distinctive features of mechanisms of information exchange within EHCDM

The analysis of the functions performed by the systems of information exchange in the EHCDM allows for the identification of their distinctive features determining their uniqueness in the present context. It can further be helpful in closer characterisation of the EHCDM as a field in its own right. They are presented below.