Photo of Azim Chowdhury

Azim Chowdhury and Sam Jockel have been published in the latest Issue of Food and Drug Law Institute Update Magazine, “Spotlight on Tobacco – Future Developments in the Regulation of Electronic Nicotine Delivery Systems: Potential Over-the-Counter Pathway.” Update is open access online. To read the article, click here. This article is republished with the permission of FDLI.

Photo of Azim ChowdhuryPhoto of Kristina DiPano

On May 23, 2018, Bill S-5 (“An Act to amend the Tobacco Act and the Non-smokers’ Health Act and to make consequential amendments to other Acts”) became law in Canada, representing a major shift in Canada’s regulatory framework, as the Bill establishes a nationalized approach to the regulation of vaping products and tobacco products through the implementation of the Tobacco and Vaping Products Act (TVPA).

This legislation represents a milestone for vaping products. Prior to the TVPA, vaping products were not expressly acknowledged as legal at the federal level in Canada. Further, vaping products containing nicotine were regulated under the Food and Drugs Act and required premarket approval. Canada’s modernized approach seeks to strike a balance between the goals of restricting access to tobacco and vaping products for minors, while allowing adult smokers to access vaping products and less harmful alternatives to traditional tobacco products.

 General Overview of the TVPA and Related Legislation

Under the new TVPA framework, vaping products that are not marketed with therapeutic claims are now legal and may be manufactured, distributed, and sold in Canada.[1] A “vaping product” is defined in Section 2 (Interpretation) of the TVPA as: (a) a device that produces emissions in the form of an aerosol and is intended to be brought to the mouth for inhalation of the aerosol; (b) a device that is designated to be a vaping product by the regulations; (c) a part that may be used with those devices; and (d) a substance or mixture of substances, whether or not it contains nicotine, that is intended for use with those devices to produce emissions.  Therefore, e-liquids, including zero-nicotine e-liquid, fall within this definition.

While vaping products will be permitted under the TVPA, they will be subjected to substantial regulation. The Act addresses the manufacture, sale, labeling, and promotion of tobacco products and vaping products, and major provisions will:

  • Largely apply existing tobacco regulations to vaping products[2];
  • Prohibit the sale of vaping products to minors[3];
  • Place heavy restrictions on advertising and promotion of vaping products by restricting lifestyle advertising, use of testimonials, and related claims[4];
  • Restrict the promotion of certain flavors—especially those that may allegedly appeal to minors, e.g., dessert flavors[5]; and
  • Empower Health Canada to implement regulations, including plain and standardized tobacco packaging.[6]

Certain provisions of the TVPA became effective upon Bill S-5 receiving Royal Assent on May 23, 2018 (e.g., prohibition on sale to youth), while other provisions give manufacturers and importers 180 days to comply, following Royal Assent (e.g., provisions that prohibit the manufacture and sale of vaping products containing an ingredient set out in Schedule 2, such as “colouring agents”).

Promotional Claims

Stakeholders and Health Canada are working together to ensure that the various restrictions set out in the TVPA, including those impacting promotional claims and advertising, are not overly burdensome.[7] Health Canada has acknowledged competing interests that push back on its obligation to ensure that the public is not misled by promotional practices, including a strong interest in allowing adults to access the information needed to make informed decisions about the vaping products available on the market (especially adults who are working to quit the use of tobacco products). One example is the current dialogue between Health Canada and stakeholders related to TVPA Section 30.43. Specifically, while TVPA Section 30.43 seeks to prohibit the use of certain promotional statements, e.g., statements that could lead a consumer to believe that certain health benefits will result from vaping, Health Canada has distributed a draft list of relative risk statements about vaping products that would be permitted under the TVPA, if finalized.[8] The September 4, 2018 draft of the “List of Statements for Use in the Promotion of Vaping Products” was circulated, and Health Canada accepted comments until September 17, 2018.[9] The list is now under review with the Scientific Advisory Board on Vaping Products (SAB). The seven proposed statements are:

  1. If you are a smoker, switching completely to vaping is a much less harmful option;
  2. While vaping products emit toxic substances, the amount is significantly lower than in tobacco smoke;
  3. By switching completely to vaping products, smokers are exposed to a small fraction of the 7,000 chemicals found in tobacco smoke;
  4. Switching completely from combustible tobacco cigarettes to e-cigarettes significantly reduces users’ exposure to numerous toxic and cancer-causing substances;
  5. Completely replacing your cigarette with a vaping product will significantly reduce your exposure to numerous toxic and cancer-causing substances;
  6. Switching completely from smoking to e-cigarettes will reduce harms to your health; and
  7. Completely replacing your cigarette with an e-cigarette will reduce harms to your health.

While the list has not yet been finalized, the collaborative effort between Health Canada and stakeholders in bringing clarity to the TVPA through exemptions and other regulatory measures evidences an effort to balance the goals of the legislation. This is in stark contrast to the Tobacco Control Act in the United States, which bans all “modified risk” claims made with FDA authorization. As we have previously blogged about here, this provision of the Tobacco Control Act is being challenged by the vapor industry.

Related Legislation

Additional legislation, such as Canada’s Food and Drugs Act and the Non-smokers’ Health Act, will play a role in the approval of vaping products that contain therapeutic claims and will address other issues, such as exposure to second-hand smoke in public spaces and workplaces. The Canada Consumer Product Safety Act (CCPSA) will also play a role in the regulation of vaping products as a whole.

The CCPSA sets forth mandatory reporting and document retention requirements, as well as a prohibition on the manufacture, import, advertisement, or sale of any consumer product that is a “danger to human health or safety,” as defined by Paragraphs 7(a) and 8(a) of the CCPSA. Further, the CCPSA empowers Health Canada to order recalls (including less severe actions, depending on degree of risk), as well as to order that testing be conducted on the consumer product of interest.[10]

Health Canada intends to introduce regulations under the CCPSA to address health and safety risks posed by vaping products. While there are currently no product-specific regulations for vaping products under the CCPSA, the CCPSA and applicable regulations, including the Consumer Chemicals and Containers Regulations, 2001 (CCCR), will apply until regulations specific to vaping products are implemented.  After specific regulations take effect, general provisions of the CCPSA will continue to apply.

Canada’s Guidance Document, Vaping Products not Marketed for a Therapeutic Use (July 12, 2018), provides an overview of the health and safety requirements that exist under the CCPSA and related CCCR regulations that relate to vaping products marketed without therapeutic claims (i.e., vaping products that are not regulated as drugs under Canada’s Food and Drugs Act). The CCCR sets forth a classification-based approach to rules for consumer chemicals, including a prohibition on the sale of very toxic substances and requirements for labeling.  Child-resistant containers are also required for toxic substances.

Importantly, Section 3 of Health Canada’s Guidance Document summarizes the classifications related to nicotine that are applicable to vaping products “manufactured, imported, advertised, or sold as consumer products.” The summary from the Guidance Document states the following:

  1. Vaping liquids containing equal to or more than 66 mg/g nicotine meet the classification of “very toxic” under the CCCR, 2001 and are prohibited from being manufactured, imported, advertised, or sold under Section 38 of the CCCR, 2001.
  2. Vaping liquids containing between 10 mg/g and less than 66 mg/g nicotine meet the classification of “toxic” under the CCCR, 2001.  Stand-alone containers of these liquids must meet the CCCR, 2001 requirements for “toxic” chemicals, including child-resistant containers and hazard labelling.
  3. While the CCCR, 2001 excludes ingredients present between 0.1 mg/g and 10 mg/g when calculating a chemical product’s toxicity, Health Canada has determined that nicotine is potentially toxic via oral exposure in this concentration range. Therefore, vaping liquids containing nicotine between 0.1 mg/g and 10 mg/g or under 1% (m/m) (representations of nicotine concentration in mg/mL and mg/g are not necessarily interchangeable as mass varies with the density of the vaping liquid) that do not meet the requirements for the “toxic” classification under the CCCR, 2001 are a violation of the general prohibition set out in Paragraphs 7(a) or 8(a) of the CCPSA and are subject to enforcement action.

Section 4.3 of the Guidance Document (“Vaping Liquid Considerations”) describes additional considerations regarding whether a consumer product that is a “danger to human health or safety,” as defined by Paragraphs 7(a) and 8(a) of the CCPSA. As noted above, products that are considered to be a “danger to human health or safety” may not be manufactured, imported, advertised, or sold as a consumer product. Specific considerations for e-liquids include those related to nicotine, as described above, diluents, additives and flavors, impurities and thermal degradations products, and microbial contamination. Considerations for vaping devices focus on electrical and mechanical aspects of the product, batteries, and chargers.

Importing E-liquids into Canada from the United States

Under the TVPA, vaping products such as e-liquids may now be imported into Canada, according to Customs Notice 18-05.[11] A step-by-step guide to importing commercial goods into Canada is available here, which serves as a valuable tool.

While many manufacturers and distributors have looked to Canada as a potential market, navigating the process of importing vaping products does not come without its challenges. In addition to licensing and permits, tariff classification numbers are needed for each item, and duties and taxes must be determined prior to shipping the goods and having them released from customs. Further, provincial or territorial legislation may impose additional requirements that retailers must follow. We expect that additional guidance will be forthcoming in this regard.

Joint Efforts to Regulate Vaping Products in North America

The North American Vapor Alliance (NAVA) recently emerged as an outlet to ensure practical regulation of vaping products, and to create a unified approach to standards and regulatory regimes across the U.S. and Canada. On September 5, the American E-Liquid Manufacturing Standards Association (AEMSA), the Smoke-Free Alternatives Trade Association (SFATA), and the Canadian Vaping Association (CVA) announced that they would be engaging in this joint effort. For a copy of the press releases, see here and here.

We will continue to provide updates regarding the evolving regulatory landscape that will impact vaping products in Canada.

For more information, contact Azim Chowdhury (+1 202.434.4230, chowdhury@khlaw.com). For more information on our tobacco and e-vapor regulatory practice in general, visit khlaw.com/evaporFollow Keller and Heckman Tobacco and E-Vapor Partner Azim Chowdhury on Twitter.

 

__________________________________

[1]              We note that vaping products that make therapeutic claims continue to fall within the scope of Canada’s Food and Drugs Act and require premarket approval.

[2]              See TVPA, Part I.1 (Vaping Products); see also Part III (Labelling).

[3]              TVPA, Part II (Access).

[4]              TVPA, Part IV (Promotion), Division 2 (Vaping Products).

[5]              See TVPA, Sections 30.48 and 30.49 and the “Flavours” table set out in Schedule 3.

[6]              See Canada Gazette, Part I, Volume 152, Number 25: Tobacco Products Regulations (Plain and Standardized Appearance.

[7]              See, e.g., TVPA, Sections 30.1 through 30.8.

[8]              In preparing the list of statements, Health Canada considered public opinion from the 2018 Public Health Consequences of E-Cigarettes report, prepared by the U.S. National Academies of Sciences, Engineering and Medicine (report highlights are available here), and consulted with the external Scientific Advisory Board on Vaping Products (SAB).

[9]              The draft list of statements was circulated in a September 4, 2018 email from Mathew Cook, Manager of the Regulations Division of the Tobacco Products Regulatory Office, which is part of Health Canada’s Tobacco Control Directorate.

[10]             See Sections 12(a), 31, and 32 of the CCPSA.

[11]             “Commercial shipments of vaping products with no health claims and no health product ingredients (can contain nicotine as a sole ingredient) may now be imported into Canada under the TPVA [sic].”  (See Customs Notice 18-05 (May 24, 2018), Paragraph 5).

Registration is open for Keller and Heckman’s 3rd Annual E-Vapor and Tobacco Law Symposium being held January 29-30, 2019 in Miami, Florida. Click here to register.

This comprehensive 2-day course will address regulatory and business issues relevant to e-vapor, e-liquid and tobacco product manufacturers, distributors and retailers including, among other things:

  • FDA enforcement and inspections – how to prepare and protect your business;
  • Product compliance – including advertising and labeling compliance, and preparing for Premarket Tobacco Product Applications (PMTAs);
  • Testing for Harmful and Potentially Harmful Constituents (HPHCs) – how to comply before the November 2019 deadline;
  • Going global – Presentations by experts on EU TPD, Canada, Asia and more;
  • State law update – Overview of new state and local laws, permitting/licensing and tax requirements, local flavor bans;
  • Environmental, hazardous waste and OSHA compliance;
  • Update on Deeming Rule appeal – Modified Risk Claims, PMTA and free samples;
  • Potential product standards including flavors and online sales;
  • Getting into CBD – how to stay legal; and
  • Business and intellectual property issues to protect your growing business.

A detailed agenda will be provided soon.  Register now for the early bird rate!

Seminar Details
Dates:
January 29 – January 30, 2019

Location:
Miami Marriott Biscayne Bay

Price:
$899 early rate
$1,099 regular rate

More information on speakers and a final agenda will be available soon. We look forward to seeing you at the program!

Take a look at highlights from this year’s conference:

 

For additional information, please contact:

Sara Woldai
Manager, Meetings and Events
Keller and Heckman LLP
woldai@khlaw.com

Photo of Azim ChowdhuryPhoto of Benjamin Wolf

On Tuesday October 2, at 2PM EST, Azim Chowdhury and Ben Wolf will present a webinar, “Ingredients Listing: Walk Through” sponsored by the Smoke-Free Alternatives Trade Association (SFATA). Ingredient listing reports for small-scale tobacco product manufacturers are due by November 8, 2018. This program is recommended for manufacturers of deemed tobacco products, including e-liquids, their management, and staff who are responsible for regulatory compliance. Participants will learn how to prepare and submit ingredient listing reports to FDA. The floor will also open for questions regarding FDA compliance. For more information and to register, click here.

 

Photo of Azim ChowdhuryPhoto of Adam Susser

On September 12, 2018, in a self-described “blitz”, FDA announced a deluge of enforcement actions, including more than 1,300 warning letters and fines to retailers aimed at addressing youth use of e-cigarettes, which FDA asserts has reached “epidemic” proportions, based on new, not-yet-released survey data.[1]  FDA also requested manufacturers of five “national brands,” whose cartridge (pod) based e-cigarettes the Agency claimed make up 97% of the “current e-cigarette market” (but apparently excluding the open-system vapor products market), and allegedly represent the majority of e-cigarettes sold to minors, to provide detailed plans to curtail youth use of their products.  FDA also threatened drastic action that could impact the entire vapor industry, and millions of former smokers that rely on a variety of vapor products, if adequate responses are not received.

Addressing Increase in Underage E-Cigarette Use; Stopping Access at the Retail Level

In its press release, FDA clarified that these enforcement actions were part of a “large-scale, undercover nationwide” crack down on the sale of e-cigarettes to minors at both brick-and-mortar and online retailers.  FDA Commissioner Dr. Scott Gottlieb further stated that FDA had failed “to predict what [he] now believe[s] is an epidemic of e-cigarette use among teenagers.”  While he reiterated that FDA is “fully committed to the concept that products that deliver nicotine exist on a continuum of risk, with combustible products representing the highest risk, and [e-cigarettes] perhaps presenting an alternative for adult smokers who still seek access to satisfying levels of nicotine, but without all of the harmful effects that come from combustion,” he was unequivocal with respect to underage use, emphasizing FDA’s Youth Tobacco Prevention Plan launched earlier this year, and stating that he “won’t tolerate a whole generation of young people becoming addicted to nicotine as a tradeoff for enabling adults to have unfettered access to these same products.”  On September 18, 2018, FDA issued another press release announcing that it would be advancing “The Real Cost” Youth E-Cigarette Prevention Campaign to educate teens about the dangers of using e-cigarettes.

Notably, all of the cartridge-based e-cigarettes now being targeted by FDA (and the Big Tobacco brands in particular) are sold primarily in convenience stores, gas stations and similar outlets (along with cigarettes and other tobacco products), and appear to be the main source of youth access, as well as the focus of FDA’s retailer enforcement efforts.  Indeed, the vast majority of the 1,300 warning letters and civil monetary penalties were sent to these types of retailers, rather than to vape shops dedicated to open-system vapor products.  While dozens of vape shops and online vape retailers have also been cited by FDA for selling products to minors, those instances appear to represent just a fraction of the millions of transactions that occur annually in the 10,000+ dedicated vape shops across the country.[2]

FDA Focuses on JUUL and JUUL-Like E-Cigarettes; Distinguishes Youth Concerns Between Closed and Open System Vapor Products

Although FDA’s recent announcement refers simply to the “e-cigarette market”, the vapor industry is actually very diverse and complex. Closed-system and cartridge-based e-cigarettes (like JUUL), the adolescent use of which FDA has made clear is its primary public health concern, is only a portion of the overall U.S. vapor products market, along with open-system vapor products (e.g., tanks, mods, e-liquids, etc.).

Indeed, FDA has been focusing on youth-use of cartridge-based e-cigarettes, and JUUL in particular, for several months, as stories about rampant teenage use have been heavily reported in the media, and the focus of Congressional inquiries.

Back on April 24, 2018, FDA announced its first set of 40 warning letters to retailers for underage sales of JUUL e-cigarettes and that it was examining the youth appeal of these products in an effort to end their sale to minors.  FDA used its authority under Section 904(b) of the Family Smoking Prevention and Tobacco Control Act (TCA) to request JUUL Labs submit information regarding its marketing and research studies, and any other information it had on how certain product features might appeal to different age groups.  Subsequently, in May 2018 FDA sent a second set of requests to several manufacturers seeking information on their JUUL-like products, including information on product marketing and design (as it may relate to the appeal or addictive potential for youth and youth-related adverse experiences), and consumer complaints, among other things.[3]

FDA has now announced that it is targeting five national brands that dominate the closed-system e-cigarette market –  JUUL and four other cartridge-based e-cigarettes, all of which are marketed by large tobacco companies: Vuse (Reynolds American), MarkTen XL (Altria), blu e-cigs (Fontem Ventures), and Logic (Japan Tobacco International, USA).  Importantly, Gottlieb indicated that these specific e-cigarettes make up “the majority of products sold to minors,” while noting that “the biggest youth use seems to be among cartridge-based e-cigarettes, and not open-tank vaping products.” (Emphasis added.)

The Agency has requested these five manufacturers submit within 60 days detailed plans describing how they will address and mitigate widespread youth use of their products.  For example, the FDA stated that such a plan may include:

  • Discontinuing sales to retail establishments that have been subject to an FDA civil monetary penalty for sale of tobacco products to minors within the prior 12 months;
  • Developing or strengthening any internal program in place to check on retailers, and reporting to FDA the name and address of retailers that have sold products to minors;
  • Eliminating online sales, whether through Internet storefronts controlled by the company or other retailers, or providing evidence to demonstrate that the company’s online sales practices do not contribute to youth use of e-cigarette products;
  • Revising current marketing practices to help prevent use by minors; and
  • Removing flavored products from the market until those products can be reviewed by FDA as part of a PMTA.

The requests that the companies eliminate all online sales and remove flavored products from the market are extremely onerous and effectively require the companies to cease sales of legal products.  FDA further noted that these actions are only examples of things the manufacturers might do to demonstrate FDA should continue to defer enforcement of the premarket review requirement with respect to their products, as discussed below, and encouraged the companies to “provide additional youth use prevention tools” for the Agency’s consideration.

Warning Letters to E-Liquid Manufacturers

Beyond illegal underage sales at the retail level, open-system vapor products have not been free from FDA scrutiny.  In May 2018, FDA and the Federal Trade Commission (FTC) issued 17 warning letters to e-liquid manufacturers for marketing products the agencies claimed were both misbranded under Sections 903(a)(1) and 903(a)(7) of the FDCA and false and misleading under Section 5 of the FTC Act, for being packaged and/or labeled in a manner that imitated “kid-friendly” foods such as apple juice, candy, whipped cream and cereal.  On August 23, 2018, FDA announced that all 17 companies that were warned have cooperated and have ceased all sales of the offending products.  FDA has now issued 12 additional warning letters to retailers for continuing to sell those e-liquids, making clear that any existing inventory of the misbranded products must be removed from commerce.

Drastic Action by FDA Could Destroy the Vapor Industry

a. Premarket Compliance Policy

Commissioner Gottlieb has made clear that the recent increase in youth use may force FDA to revisit its premarket review compliance policy, pursuant to which manufacturers of deemed noncombustible tobacco products (such as vapor products) that were on the market as of August 8, 2016, when the Deeming Rule went into effect, have until August 8, 2022 to submit PMTAs, and can remain on the market through that date.[4]  Moreover, under this compliance policy, if an application is timely submitted and accepted for scientific review, the subject product is permitted to remain on the market pending FDA review.  This compliance policy was first announced in July 2017 as part of the Agency’s comprehensive plan for tobacco and nicotine regulation, and extended the original compliance policy in the Deeming Rule, which only gave e-cigarette manufacturers until August 8, 2018 to submit PMTAs for their existing products.[5]

As noted, FDA’s letter to JUUL and the other large manufacturers indicates that it is seriously reconsidering its compliance policy, at least for cartridge-based e-cigarettes, due to widespread youth use (emphasis added):

To fulfill our public health mandate to address youth addiction to nicotine, FDA is reconsidering its compliance policy for submission of PMTAs for [the JUUL e-cigarette] and other similar products that were illegally sold by retailers during this blitz, including whether earlier enforcement of the premarket review provision might be warranted.

FDA further noted it is “seriously considering a policy change that would lead to the immediate removal of these flavored products from the market.”

Critically, Commissioner Gottlieb stated that if the five companies referenced above do not submit plans to combat youth use of their products, or if those plans are insufficient to address the problem, the companies “face a potential decision by FDA to reconsider extending the compliance dates for submission of premarket applications.”

If FDA does decide to modify the compliance policy for cartridge-based e-cigarettes because of their apparent unique impact on youth compared to other types of vapor products, such action does have precedent.  In its comprehensive plan, for example, FDA required deemed combustible products, such as cigars and hookah, on the market as of August 8, 2016 to submit premarket review applications by August 8, 2021, because of the known-health risks of combustible tobacco.

However, open-system vapor product manufacturers should be aware that Gottlieb did note in his statement that FDA’s “policy reconsiderations apply to the entire category” and that FDA is “also re-examining the enforcement discretion we currently exercise for other e-cig products currently on the market without authorization.”

While it remains unclear what, if anything, FDA might do with respect to its current compliance policy, any move to shorten the PMTA grace period for the vapor industry at-large will have devastating consequences not only for thousands of small businesses that would effectively be banned, but also for the public health.  These impacts were recently summarized in an amicus brief submitted by the Right to be Smoke-Free Coalition in the federal lawsuit filed by the public health groups challenging FDA’s compliance policy.  You can read about that lawsuit and the amicus brief, which makes clear that the vapor industry needs at least until August 2022 to prepare applications given the need for long-term clinical data, on our previous blog post here.

b. Flavored Products

Also of concern for the vapor industry is the potential targeting of flavored products, which the industry has argued are, in fact, appropriate for the protection of the public health (see here). It is important to first recognize that there is no such thing as an unflavored e-cigarette or vapor product. Unlike combustible cigarettes or other tobacco-containing products, there is simply no “natural” tobacco or other flavors inherent to e-liquids.  Rather, all flavors for these products are chemically synthesized and added to the base propylene glycol/vegetable glycerin solution.  Thus, unlike cigarettes, a ban on characterizing flavors would effectively result in a ban of all vapor products.

Moreover, numerous published studies demonstrate, and FDA has acknowledged, that flavored vapor products and e-liquids can help adult smokers reduce their cigarette use and/or switch completely to vapor products.  For example, a recently-released survey of almost 70,000 U.S. vapers found that 87.3% of respondents who quit smoking with e-cigarettes said that flavors were “extremely” or “very” important to their quit attempts.[6]

Remaining Compliant in a Rapidly Changing Regulatory Landscape

The new FDA enforcement actions and broader threats against the industry raise the possibility of dramatically altering the regulatory landscape for e-cigarettes and other vapor products.  FDA’s September 12 letters to the large manufacturers of cartridge-based e-cigarettes threaten to potentially end the premarket review compliance policy for those types of products, but it is not clear if FDA would extend this to all vapor product manufacturers.  Indeed, the stock market appears to have recognized this possibility, as legacy tobacco stocks rallied after FDA’s announcement.  Apparently, the markets have concluded that if adults are not going to be permitted to vape, they could return to traditional combustible tobacco cigarettes – the most harmful nicotine delivery system.  From our vantage point, and to the detriment of public health, it is hard to argue with this conclusion.

Accordingly, in view of FDA’s enforcement blitz and the Agency’s current focus on manufacturer advertising, marketing, and manufacturing practices, we recommend vapor product companies:

  • Start preparing premarket applications (including PMTAs) sooner rather than later (and attend FDA’s public hearing on October 22-23, 2018).
  • Work with retailers (both brick-and-mortar and online) that have age and photo-ID verification procedures that comply with requirements applicable to tobacco retailers, including requirements that:
    • the retailer checks the photo ID of everyone under age 27 who attempts to purchase any tobacco product;
    • the retailer only sells tobacco products to customers age 18 or older (consider whether age-gating may be appropriate for online retailers); and
    • the retailer does not sell tobacco products in vending machines unless in an adult-only facility.
  • Work with legal counsel to ensure that your product labeling and marketing would not cause the product to be misbranded or misleading (i.e., by imitating potentially “kid-appealing” foods).
  • Make sure your advertising and product labeling fully comply with the nicotine addiction warning (and other labeling requirements).
  • Comply with TCA requirements, including registration and listing for U.S. establishments, ingredient listing, and health document disclosures.
  • Do not introduce new products after August 8, 2016 without receiving FDA premarket authorization.
  • Comply with all sales and marketing restrictions, including use of any modified risk claims and the ban on free samples.
  • Prepare to be inspected by FDA and other authorities (sign up for our audit and inspection program here).
  • Consider developing an internal audit program to evaluate the procedures used by retail partners to avoid youth-access to your products.

If you have any questions about FDA’s announcements contact Azim Chowdhury (202.434.4230, chowdhury@khlaw.com). For more information on our Tobacco and E-vapor Practice in general, visit www.khlaw.com/evapor. Follow Keller and Heckman Tobacco and E-Vapor Partner Azim Chowdhury on Twitter.

[1]              See U.S. Food & Drug Admin., FDA News Release, FDA Takes New Steps to Address Epidemic of Youth E-Cigarette Use, Including a Historic Action Against More Than 1,300 Retailers and 5 Major Manufacturers for Their Roles Perpetuating Youth Access (Sept. 12, 2018).

[2]              Christopher Groskopf, What Yelp Data Reveal About the Sudden Rise of Vape Shops in America, Quartz, (Feb. 10, 2016), https://qz.com/608469/what-yelp-data-tells-us-about-vaping/.

[3]              The first set of letters were sent on May 17, 2018 to J Well, of Paris, France, for Bo Starter Kit; YGT Investment LLC and 7 Daze LLC, of Baldwin Park, California, for Zoor Kit; Liquid Filling Solutions LLC, of King of Prussia, Pennsylvania, for Myle Products; and SVR Inc., of Las Vegas, for SMPO Kit. Subsequently, in late May additional letters were sent to Myle Vape Inc. regarding Myle Products, and to MMS ECVD LLC regarding the Bo Starter Kit, to reflect additional relevant companies in the manufacturing and distribution chain.

[4]           Guidance for Industry: Extension of Certain Tobacco Product Compliance Deadlines Related to the Final Deeming Rule (Revised) (August 2017), available at: https://www.fda.gov/downloads/TobaccoProducts/Labeling/RulesRegulationsGuidance/UCM557716.pdf.

[5]              The original Deeming Rule compliance policy also had a sunset period that only permitted manufacturers who submitted timely PMTAs to continue to market those products for an additional year, i.e., until August 8, 2019. Unless an application was authorized during that year, it would have to be removed from the market at that time, and could only be re-introduced if it received FDA authorization.

[6]              Konstantinos F., M.D., MPH, et al., Patterns of flavored e-cigarette use among adult vapers in the United States: an internet survey (2018), at 6, 20.

Photo of Azim Chowdhury

On June 18, 2018, U.S. Food and Drug Administration (FDA) Commissioner Dr. Scott Gottlieb delivered remarks on “FDA’s Nicotine and Tobacco Regulation and the Key Role of Regulatory Science” at the Tobacco Regulatory Science Program Meeting.[1] While addressing the importance of regulatory science to inform FDA’s Center for Tobacco Products (CTP) regulatory efforts, Commissioner Gottlieb focused a portion of his remarks on the use of Electronic Nicotine Delivery Systems (ENDS) as tobacco harm reduction or smoking cessation tools and FDA’s role in their regulation.

“Preservation of E-Cigarettes”

According to Commissioner Gottlieb, utilizing scientific evidence and supporting new research to inform tobacco regulatory actions that protect public health is one of the primary missions of FDA’s CTP. Utilizing regulatory science to better understand e-cigarettes, Commissioner Gottlieb confirmed again that not all tobacco products are equally harmful, but that a “continuum of risk” exists, stating, “[w]e believe in the concept of a continuum of risk related to tobacco products, and we believe there is a role for modified risk products. Further, we want to preserve e-cigs as one among a number of possible options for adult smokers and believe that fully transitioning smokers to ENDS can reduce the morbidity and mortality associated with tobacco use.” Preservation of e-cigs as a possible option for adult smokers entails better understanding “the potential benefits of electronic nicotine products as smoking cessation tools.”

In his remarks, the Commissioner highlighted a recent report by the National Academies of Sciences (NAS), entitled “Public Health Consequences of E-Cigarettes.” You can read a summary of that report in a previous blog post here. Commissioned by FDA, the report makes clear, among other things, the reduced harm of e-cigarettes compared to smoking cigarettes and that completely switching from regular use of combustible cigarettes to e-cigarettes results in reduced short-term adverse health outcomes in several organ systems.[2]

Acknowledging those findings, Commissioner Gottlieb noted, “[p]otentially less harmful products – including the wide diversity of ENDS and other novel tobacco products – must be put through an appropriate series of regulatory gates to fully evaluate their risks and maximize their potential benefits.”

The Commissioner’s praise of vapor products as a potential reduced harm alternative for smokers, however, apparently does not apply to adolescents, for whom FDA maintains there is never a good reason to use any tobacco product, reduced harm or not – a position that has been criticized in some public health circles.

“Appropriate Series of Regulatory Gates” in the Context of the Deeming Rule Appeal

The Commissioner’s remarks on e-cigarettes were delivered in the midst of a lawsuit filed by Nicopure Labs, LLC and the Right to be Smoke-Free Coalition (appellants) challenging aspects of the Tobacco Control Act (TCA) and FDA’s Deeming Rule now pending before the U.S. Court of Appeals for the D.C. Circuit. This blog has been closely following the litigation, previously summarizing Appellants’ opening brief, as well as FDA’s brief and appellants reply brief. A list of all briefs can be found at the end of this blog post.

The Commissioner’s June 18 remarks, acknowledging the benefits of e-cigarettes as tools for adult smoking cessation, follow previous statements by Commissioner Gottlieb, the agency itself, the American Cancer Society (ACS), and an FDA-commissioned report acknowledging the lower risk associated with e-cigarettes in comparison to combustible tobacco and e-cigarettes’ potential public health benefits. As set forth at the outset of appellants’ final reply brief in the Deeming Rule appeal, those statements and findings include:

  • FDA stated numerous times during the rulemaking that vapor products are less harmful than traditional cigarettes.[3]
  • In announcing its Comprehensive Plan for regulating tobacco and nicotine, FDA recognized it must “strik[e] an appropriate balance between regulation and encouraging development of innovative tobacco products that may be less dangerous than cigarettes.”[4]
  • FDA Commissioner Gottlieb and Mitch Zeller, Director of FDA’s Center for Tobacco Products, wrote in the New England Journal of Medicine that vapor products, when combined with measures to reduce nicotine levels in cigarettes, “represent[] a promising foundation for a comprehensive approach to tobacco harm reduction.”[5]
  • One of FDA’s supporting amici, the ACS, recently determined, “[b]ased on currently available evidence, using current generation e-cigarettes is less harmful than smoking cigarettes,” and concluded “switching to the exclusive use of e-cigarettes is preferable to continuing to smoke combustible products.”[6]
  • A recent NAS report commissioned by FDA, which the Commissioner mentioned in his June 18 remarks, confirms vaping is less risky than smoking.  The report, which is based on a review of over 800 articles, found: (i) conclusive evidence that completely substituting vaping with smoking reduces exposure to numerous toxicants and carcinogens; (ii) current evidence shows vapor products are less harmful than cigarettes; (iii) substituting vaping for smoking significantly reduces levels of biomarkers of exposure to toxicants; and (iv) vaping exclusively might be useful as a cessation aid in smokers.”[7]

Despite these recent statements, FDA continues to take a hard line in the pending appeal, where the agency argues: (1) the Modified Risk Tobacco Product (MRTP) provision in Section 911 of the TCA does not violate the First Amendment of the U.S. Constitution; (2) the free sample ban is a “price regulation,” so it is not subject to First Amendment protections; and (3) the Premarket Tobacco Application (PMTA) process was statutorily required and did not authorize nor require FDA to modify those requirements for vapor products. Each of these positions, as explained by appellants in the appeal, work against promoting continuum of risk and achieving risk reduction:

  1. Modified Risk Tobacco Product (MRTP) Claims: FDA’s defense of the MRTP provision will ultimately prevent vapor companies from making truthful statements and conveying information that would help adult consumers make informed decisions regarding vaping. As set out in appellants’ briefs, the incredibly onerous and expensive MRTP authorization process, which no company has been able to achieve yet, is ultimately a restriction on the First Amendment rights of consumers in the marketplace to obtain product-related information so they can make educated decisions.
  2. Free Sample Ban: Similarly, FDA downplays free samples as a mere “price regulation,” which are not subject to First Amendment challenge. To the contrary, and as demonstrated by appellants in their briefs, free samples allow manufacturers to pass on product information that adult consumers demand when contemplating a switch from more harmful cigarettes, and are thus protected under the First Amendment.
  3. The Premarket Tobacco Application (PMTA): FDA’s one-size-fits-all PMTA process for vapor products, which involves satisfying all pre-market review requirements for less risky vapor products, will also force the vast majority of vapor companies and less harmful vapor products out of the market absent some tailoring of certain requirements.

Oral arguments in the Deeming Rule appeal have been scheduled for September 11, 2018 before the U.S. Court of Appeals for the D.C. Circuit.

Links to all appeal briefs:

  • February 12, 2018: Appellants Nicopure and Right to be Smoke-Free file opening brief
  • February 20, 2018: Amicus briefs in support of appellants filed by: Washington Legal Foundation, NJOY, State of Iowa and CASAA
  • May 2, 2018: Appellee FDA’s brief filed
  • May 9, 2018: Amicus briefs in support of FDA filed by: Public Citizen, Yale Law School Scholars, Public Health Law Center, and various public health groups (American Academy of Pediatrics, American Cancer Society Cancer Action Network, American Heart Association, American Lung Association, American Thoracic Society, Campaign for Tobacco-Free Kids, and Truth Initiative)
  • May 16, 2018: Appellants Nicopure and Right to be Smoke-Free file reply brief
  • June 5, 2018: Appellee FDA files a final copy of its opening brief with updated citations to the administrative record
  • June 6, 2018: Appellants Nicopure and Right to Smoke-Free file final copies of their opening and reply briefs with updated citations to the administrative record

The Right to be Smoke-Free Coalition and Nicopure Labs are represented in the appeal by Keller and Heckman LLP Partners Eric Gotting and Azim Chowdhury. For more information on the lawsuit and to contribute to the appeal efforts, visit www.r2bsmokefree.org.

[1] Gottlieb, S. (2018, June 18). FDA’s Nicotine and Tobacco Regulation and the Key Role of Regulatory Science. Speech presented at Tobacco Regulatory Science Program Meeting, White Oak, MD. Available at https://www.fda.gov/NewsEvents/Speeches/ucm611033.htm.

[2] National Academies of Science, Engineering and Medicine: Committee on the Review of the Health Effects of Electronic Nicotine Delivery Systems, The Public Health Consequences of E-Cigarettes (eds. Kathleen Stratton et al., 2018), available at https://tinyurl.com/ya4w37kb.

[3] Opening brief of appellants at 7. Available at Gottlieb, S. (2018, June 18). FDA’s Nicotine and Tobacco Regulation and the Key Role of Regulatory Science. Speech presented at Tobacco Regulatory Science Program Meeting, White Oak, MD. Retrieved from https://www.fda.gov/NewsEvents/Speeches/ucm611033.htm.

[4] FDA News Release, FDA Announces Comprehensive Regulatory Plan to Shift Trajectory of Tobacco-Related Disease, Death (July 28, 2017), https://tinyurl.com/y7bybf6c.

[5] Scott Gottlieb, et al., Perspective: A Nicotine-Focused Framework for Public Health, New Eng. J. Med. (Sept. 21, 2017), https://tinyurl.com/yatrpq68.

[6] ACS, Position Statement on Electronic Cigarettes (Feb. 15, 2018),  https://tinyurl.com/ybadn9cl; see also a summary of ACS’s most recent position statement in a previous blog post, available at https://www.thecontinuumofrisk.com/2018/06/american-cancer-society-acknowledges-reduced-harm-electronic-nicotine-delivery-systems-warns-dangers-misleading-consumers/.

[7] NAS, PUBLIC HEALTH CONSEQUENCES OF E-CIGARETTES, at S-9, 18-2, 18-13, 1823, https://tinyurl.com/ycxlymgf.

Photo of Azim ChowdhuryPhoto of Benjamin Wolf

 

 

Tobacco product manufacturing establishments in the United States must register with the Food and Drug Administration (FDA) immediately upon beginning manufacturing operations (e.g., the manufacture, preparation, compounding, or processing of a tobacco product).  As part of the registration process, establishment operators must submit a detailed list of products manufactured at the establishment, along with copies of all labeling (see our full summary of the registration requirement here).  This registration must be renewed annually before midnight on December 31 (Eastern time) every year, and product lists must be updated bi-annually: by midnight June 30 and December 31 every year.

This means that operators of manufacturing establishments of newly deemed products (e.g., vapor, cigars, hookah, etc.) on the market as of August 8, 2016 that have made changes to their product offerings must update their product lists with FDA by tomorrow, June 30, 2018, or as soon as possible to avoid FDA enforcement (considering the likelihood that FURLS may crash, the sooner you start this process, the better). Specific examples of changes that need to be updated (in FURLS, if you used that system to register online) include (1) discontinuing products on your product list that you are no longer actively manufacturing, (2) adding new products that are now being manufactured (e.g., co-packers now manufacturing pre-August 8, 2016 products that were not on the co-packers’ initial product list), (3) adding a new manufacturing location for products already listed by another establishment, or (4) labeling changes (including rebranding) of existing products.

Note that if you are planning to update your labels to comply with FDA’s nicotine addiction warning and other labeling requirements (that go into effect on August 10, 2018) after June 30, you have until December 31, 2018 to update your product listing with the revised labels.

If you have any questions about Registration and Product Listing or any of the other Tobacco and Control Act requirements, contact Azim Chowdhury (202.434.4230, chowdhury@khlaw.com) or Ben Wolf (202.434.4103, wolf@khlaw.com). For more information on our Tobacco and E-vapor Practice in general, visit www.khlaw.com/evapor. Follow Keller and Heckman Tobacco and E-Vapor Partner Azim Chowdhury on Twitter.

Photo of Azim Chowdhury

On June 11, 2018, the American Cancer Society (“ACS”) released a statement entitled, “The American Cancer Society Public Health Statement on Eliminating Combustible Tobacco Use in the United States’ (“Statement”).[1] The Statement sets forth the ACS’s goal of eliminating exposure to combustible tobacco smoke and provides three strategies for the ACS to enhance its approach in tobacco prevention and control.

This Statement follows its earlier “Position Statement on Electronic Cigarettes,” released on February 15, 2018, which acknowledged, for the first time, that e-cigarettes, also known as Electronic Nicotine Delivery Systems (ENDS), play an important role in helping certain smokers quit.[2] In that prior position, ACS suggested that physicians should encourage individuals that will not use FDA-approved cessation medicines to switch to using ENDS.[3] This latest Statement takes that position further, as the ACS commits to joining in on efforts to better understand how or whether ENDS might be integrated into evidence-based cessation options, and the organization also warns about the misinformation given to consumers about those products.

 “Rapidly Changing Tobacco Marketplace” and the Consumer Misperception about ENDS

The ACS’s stated highest priority is to eliminate cancer caused by tobacco use as cigarette smoking is the leading cause of mortality in the U.S.[4] Placing its Statement in the context of what is calls, “the rapidly changing tobacco marketplace today,” the ACS acknowledges that tobacco control has increasingly become a social justice issue, as the percentage of smokers at the greatest risk (e.g. because of their low socioeconomic status, lower educational attainment, etc.) has risen markedly.[5]

Given today’s landscape, the Statement highlights the need for consumers to receive accurate information about different tobacco products and the role that nicotine plays in disease.[6] Citing numerous studies and reports, the Statement posits that although the “current generation ENDS are markedly less harmful than combustible tobacco products,”[7] “[m]any adults believe, erroneously, that ENDS are as harmful as combustible tobacco products, and the level of public understanding has deteriorated overtime.”[8] The Statements cites the Monitoring the Future study, which reported that as of 2017, “e-cigarettes have one of the lowest levels of perceived risk for regular use of all drugs, including alcohol,” among adolescents.[9] And to contrast e-cigarette use with combustible (burned) tobacco products, the Statement notes that while ENDS delivers nicotine, flavor additives and other chemicals, they do not actually burn tobacco – a process that yields an estimated 7000 chemicals, including at least 70 carcinogens.[10]

Three Strategies to Eliminate All Combustible Tobacco Use: Lending Support to Further Utilizing ENDS for Tobacco Cessation

The Statement outlines three separate strategies to eliminate all combustible tobacco use-all of which involve some component linked to ENDS.

  • Promote Increased Access and Utilization of Cessation Options for Smokers, With an Emphasis on Preventing Dual Use

As part of its first strategic effort, the ACS will work to promote tobacco-cessation strategies and develop health care provider and consumer-facing materials with information on the risks associated with tobacco products and cessation treatment options.[11] As a part of this communications strategy, the ACS notes that it intends to communicate to consumers that current-generation ENDS are less harmful than combustible tobacco products, and it provides that the ACS will contribute to research to determine how or whether ENDS might be integrated into evidence-based cessation options.[12]

  • Prevent Initiation of ENDS by Youth and Other High-Risk Demographic Groups

Despite noting the lesser risks associated with ENDS relative to combustible tobacco use, the Statement still holds that protecting youth from cigarette smoking and the use of novel tobacco products remains a priority.[13] The ACS will advocate for tobacco-free policies, including ENDS in all cases, as well as for policies to raise the minimum age for sale of all tobacco products, including ENDS.[14] The ACS makes clear that it will continue to oppose what it calls, “the widespread exposure of youth to e-cigarette advertising.”[15]

  • Promote and Support a Comprehensive Tobacco and Nicotine Regulatory Framework

As part of its broader regulatory strategy, the Statement describes a “continuum of risk” for tobacco products, noting that while science is mixed, ENDS are likely to be much less harmful that combustible tobacco products.[16] Among other proposals, the Statement again commits to conduct further scientific research, including research related to the short-term and long-term risks of using ENDS and the impact of ENDS on tobacco use behavior.[17]

Conclusion

Taking its February 15, 2018 statement on electronic cigarettes one step further, this latest announcement by the ACS makes clear that the organization intends to contribute to further research on whether e-cigarettes may be utilized for tobacco cessation strategies. However, the ACS continues to advocate for tobacco-free policies, which include the use of ENDS, and the organization remains concerned about preventing youth initiation of ENDS, which has fallen dramatically since 2015, along with all tobacco use.

[1] The American Cancer Society Public Health Statement on Eliminating Combustible Tobacco Use in the United States (Clifford E. Douglas, et al., 2018) available at https://onlinelibrary.wiley.com/doi/full/10.3322/caac.21455 (hereinafter, referred to as the “Statement”).

[2] American Cancer Society Position Statement on Electronic Cigarettes (2018) available at https://www.cancer.org/healthy/stay-away-from-tobacco/e-cigarette-position-statement.html.

[3] Id.

[4] Statement, supra n.1. at 1.

[5] Id., supra n.1. at 5.

[6] Id., supra n.1. at 2.

[7] Id., supra n.1. at 4.

[8] Id., supra n.1. at 1.

[9] Johnston LD, Miech RA, O’Malley PM, Bachman JG, Schulenberg JE, Patrick ME. Monitoring the Future: National Survey Results on Drug Use, 1975‐2017. Overview, Key Findings on Adolescent Drug Use. Ann Arbor, MI: Institute for Social Research, The University of Michigan; 2018. monitoringthefuture.org/pubs/monographs/mtf‐overview2017.pdf.

[10] Id., supra n.1. at 1.

[11] Id., supra n.1. at 2-3.

[12] Id., supra n.1. at 3.

[13] Id., supra n.1. at 3.

[14] Id., supra n.1. at 4.

[15] Id., supra n.1. at 4.

[16] Id., supra n.1. at 4.

[17] Id., supra n.1. at 5.

Photo of Azim ChowdhuryPhoto of Tracy Marshall

The new European Union (EU) General Data Protection Regulation (GDPR) replaces the Data Protection Directive on May 25, 2018 and will directly impact all companies, including vapor product retailers and businesses, that market and sell products to consumers in the EU and/or employ residents of the EU. The reforms will give European consumers new rights and control over the personal data collected from and about them, and impose new obligations on businesses within and outside of the EU that collect personal information from EU citizens, regardless of where they reside, or from individuals who reside in the EU, regardless of their nationality.  Given the magnitude of potential penalties for violations of the GDPR (supervisory authorities are authorized to impose fines of up to 4% of global annual turnover for serious infringements and 2% for less serious infringements), it is imperative that vapor product retailers and others selling into the EU or handling data about Europe-based individuals ensure they are GDPR-ready.

The new rules empower individuals by, among other things, (1) providing easier access to personal data and more information on how data is processed, (2) facilitating data portability, or transfers of personal data between service providers, (3) clarifying the fundamental “right to be forgotten” for individuals who no longer wish for their data to be processed, and (4) requiring expedited notifications to the national supervisory authority by companies that experience a data breach affecting personal data.

Most companies operate with multiple streams of data, such as HR data, consumer data, vendor/supplier data, and the like. A good starting point is for businesses to assess their current data collection practices and identify gaps, and use that to map out a step-by-step compliance plan specific to their data collection practices that fully prepares them for the new GDPR world.

We provide below a summary of the key requirements in the GDPR and a compliance checklist for businesses. Please note that the summary and checklist are provided for informational purposes only, and do not constitute legal advice regarding specific facts or circumstances.

GDPR KEY REQUIREMENTS
Personal Data The term “personal data” means “any information concerning an identified or identifiable natural person.” An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or to one or more factors specific to the individual’s physical, physiological, genetic, mental, economic, cultural or social identity.
Extraterritorial Effect The Regulation applies not only to the processing of personal data by controllers and processors in the EU, but also the processing of personal data of data subjects who are in the EU by a controller or a processor not established in the EU, if the processing activities are related to offering goods or services to the data subjects or monitoring their behavior within the EU.
Lawfulness of Processing To be lawful, at least one of the following must apply:

  • The data subject consents;
  • Processing is necessary for the performance of a contract to which the data subject is a party;
  • Processing is necessary for compliance with a legal obligation to which the controller is subject (under EU or Member State law);
  • Processing is necessary to protect the vital interests of the data subject or another natural person;
  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (under EU or Member State law);
  • Processing is necessary for legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Consent Consent to processing must be unambiguous, specific, informed, and freely given (for example, checking a box at a website or choosing technical settings). Pre-checked boxes do not constitute consent. For sensitive data (for example, data revealing race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation), consent must be explicit. When processing has multiple purposes, consent should be given for all of them. Consent may be withdrawn.
Data Processing Processing of personal data must be lawful, fair, and transparent. Individuals should be made aware of the risks, rules, safeguards and their rights in relation to the processing of personal data. The specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection. Personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. Time limits should be established for erasure or periodic review. Personal data should be processed in a manner that ensures appropriate security and confidentiality.
Right to be Forgotten Individuals have a right to request deletion of data, with some exceptions (for example, if retention is legally required).
Data Portability Individuals have the right to easily transfer personal data between different service providers.
Children Special rules apply to children’s data. Where a child is below age 16, processing is lawful only if parents or guardians consent. Member States may establish a lower age for these purposes, so long as the age is not below age 13.
Controller Responsibility Personal data must be processed under the responsibility and liability of the controller, who must ensure and document compliance for each processing operation. Controllers should only use processors who provide sufficient guarantees in terms of expert knowledge, reliability and resources to implement technical and organizational measures that will meet the requirements of the Regulation. Adherence to an approved code of conduct or certification mechanism may be used to demonstrate compliance. There must be controller-processor agreements in place that describe the subject matter, duration, nature and purposes of the processing, type of personal data, and categories of data subjects. Upon completion of the processing, the processor must, at the controller’s election, return or delete the data, unless the processor is required by law to store it. Joint and several liability for controllers and processors.
Data Protection Impact Assessments

Data controllers must conduct Data Protection Impact Assessments (DPIAs) for “risky” processing. DPIAs should be completed before beginning any type of processing which is “likely to result in a high risk.” This means even though the actual level of risk may not have been assessed, a DPIA may be necessary based on identifying factors that point to the potential for a widespread or serious impact on individuals. Some jurisdictions may impose DPIA requirements on specific types of processing.

 

If the DPIA indicates that processing involves a high risk that cannot be mitigated, controller should consult supervisory authority (DPA) prior to the processing.

Data Protection Officer Organizations must appoint a data protection officer (DPO) in three situations: the processing is carried out by a public authority; the core activities of the controller or processor consist of processing operations which require regular and systematic processing of data subjects on a large scale; or the core activities involve processing sensitive data or criminal convictions on a large scale.
Documentation Controllers and processors must document all processing and make documentation available to DPA on request.
Data Breach Notification Controllers must notify DPA within 72 hours of learning of a breach, where feasible; no notification is required if a breach is unlikely to result in risk to the rights or freedoms of individuals. Controllers must notify data subjects without undue delay, where the breach is likely to result in a high risk to their rights or freedoms. Notifications to data subjects should describe the nature of the breach and recommendations for individuals to mitigate potential adverse effects. Processors must notify controllers.
Streamlined Approvals A single DPA can be designated the lead, enabling multiple DPAs to handle cases in a more streamlined manner.
Codes of Conduct and Certification Codes of conduct are encouraged, and are subject to approval by the Commission, and compliance should be monitored by an appropriate expert, accredited body. Approved codes of conduct will be registered and published. Data protection certification mechanisms, seals and marks are encouraged.
Transfers to Other Countries Transfers to other countries are permitted based on a determination that the country provides adequate protection of privacy; transfers are subject to adequate safeguards (for example, binding corporate rules, standard contractual clauses, an approved code of conduct, approved certification mechanisms, explicit informed consent).
Reduced Notifications Supervisory notifications about data processing are no longer required, but permission is required to process certain categories of data.
Art 29 Working Party (WP29) WP29 will be “upgraded” to an independent European Data Protection Board.
WP29 Guidance WP29 has issued guidance on several aspects of the GDPR that provide clarification and recommendations:

DPA Enforcement DPAs have enhanced enforcement powers, including expanded investigatory authority.
Complaints and Remedies EU citizens can lodge complaints with local DPAs, even where data is processed extra-territorially, and have the right to a judicial remedy against supervisory authorities who fail to act and against controllers and processors.
Penalties DPAs are authorized to impose fines of up to 4% of global annual turnover for certain serious infringements; 2% for less serious infringements.


GDPR Compliance Checklist 

Types of Personal Data Collected
Identify types of data collected
Identify sensitive data
Identify data collected from children/ whether parental consent is required
Data Processing
Appoint data protection officer (DPO)
DPOs must be appointed if:

  • The processing is carried out by a public authority;
  • The core activities of the controller or processor consist of processing operations which require regular and systematic processing of data subjects on a large scale; or
  • The core activities involve processing sensitive data or criminal convictions on a large scale.
  • May also be Operating/established in a jurisdiction (such as Germany) with more stringent requirements.
  • WP29 guidance on DPOs
  • “Core activities”: defined by WP29 as those that are integral to “the controller’s or processor’s activity.”
  • “Large scale”: WP29 recommends that businesses consider the number of data subjects concerned; the volume of data or range of data items; and the duration and the geographical extent of the processing.
  • “Regular and systematic monitoring”: WP29 states this would “include all forms of tracking and profiling on the internet, including for the purposes of behavioral advertising.”
Confirm the lawful basis for the processing:

  • Consent
  • Necessary for compliance with a legal obligation to which the controller is subject
  • Necessary for the performance of a contract to which the data subject is a party
  • Necessary to protect an individual’s vital interest
  • Legitimate interests of the controller (i.e., providing client services or preventing fraud)
  • Transfers of personal data among controllers within an affiliated group for internal administrative purposes
  • Strictly necessary and proportionate for ensuring network and information security
If consent is the basis for the processing:

  • Must be unambiguous, specific, informed, and freely given
  • Must obtain consent for each processing activity/purpose
  • Explicit consent required for sensitive data
Confirm that personal data collected is adequate, relevant and limited to what is necessary for the purpose(s)
Determine whether a data protection impact assessment (DPIA) is required (high-risk processing)

  • Systems that analyze a person’s economic situation, location, health, personal preferences, reliability or behavior
  • Video surveillance systems
  • Data in large scale filing systems on children, genetic or biometric data
DPIA, if required, should address

  • Contemplated processing and purposes
  • Necessity and proportionality of the processing in relation to the purposes
  • Risks to the rights and freedoms of data subjects
  • Safeguards and security measures to address the risks
If DPIA indicates that processing would result in high risk, then consult DPA prior to processing
Data subjects must be informed about:

  • Identity and contact information for controller and DPO
  • Purposes of the processing and legal basis
  • Recipients/ categories of recipients of personal data
  • Period for which personal data will be stored
  • Right to request access to and correction or erasure of personal data or to restrict processing
  • Right to withdraw consent at any time
  • Right to file complaint with supervisory authority
Review privacy policies and update as necessary
Establish system for documenting processing operations
Amendments to third-party contracts to ensure compliance with GDPR and e-Privacy Directive (and eventually e-Privacy Regulation)
Data Storage
Determine where and how data is stored
Establish limits for erasure of data and periodic reviews
Review data retention policies to ensure data only kept for as long as necessary
Establish and/or review processes for rectifying or deleting inaccurate data
Prepare template responses for data access requests
Data Transfers to Other Countries
Review and analyze global data flows
Assess validity of current mechanisms for transfers of personal data from the EU to the U.S. or other countries, for example:

  • Adequacy determination
  • Binding corporate rules
  • Standard contractual clauses
  • EU–U.S. Privacy Shield
  • Codes of conduct
  • Certification mechanisms
  • Explicit, informed consent in limited circumstances
Assess feasibility/benefits of approved codes of conduct and certification mechanisms
Assess need for controller-controller and/or controller-processor agreements; review content for compliance with new requirements
Data Security
Review technical and organizational measures in place to prevent unlawful destruction, loss, alteration, disclosure of/ access to personal data

  • Pseudonymization and encryption
  • Ability to ensure ongoing confidentiality integrity, availability, and resilience of processing systems and services
  • Ability to restore availability and access to data in timely manner in the event of a physical or technical incident
  • Process for regularly testing, assessing and evaluating the effectiveness of the security measures in place
Ensure that processors are employing adequate technical and organizational measures; address in contracts
Establish and/or update data breach response plan

For more information on the GDPR or other privacy or data security matters, and how they affect businesses involved in e-liquid and vapor products, please contact Tracy Marshall (+1 202.434.4234, marshall@khlaw.com), Azim Chowdhury (+1 202.434.4230, chowdhury@khlaw.com), or Nathan A. Cardon (+1 202.434.4254, cardon@khlaw.com).

Photo of Azim ChowdhuryPhoto of Daniel Rubenstein

At yesterday’s meeting with the U.S. House Subcommittee on Agriculture and Rural Development to discuss FDA’s Fiscal Year 2019 budget, Food and Drug Administration (FDA) Commissioner Scott Gottlieb discussed the Agency’s regulation of the tobacco industry and noted, among other things, that when all the requirements for the newly deemed products, including vapor products, went into effect last year, FDA now has authority to inspect and impose GMP standards and enforce age restrictions.  Gottlieb indicated that FDA would be “stepping into this fight in a vigorous way in the coming weeks.”

Being prepared for an FDA inspection is critical to maintaining compliance.  Just a few weeks ago, FDA’s recently-issued Request for Proposal (RFP), Vape Inspection Services (FDA-RFP-18-1190619), was extended on March 22, 2018 to allow for additional time for FDA to receive, review and consider responses from government contractors submitting bids to conduct inspections of establishments engaged in the retail sale of FDA-regulated tobacco products.

The RFP provides valuable insight into the Agency’s current thinking with regard to the scope of inspections that are expected to begin shortly, as mandated by the Tobacco Control Act.

Specifically, the RFP indicates that the contractor(s) shall, in the course of a facility inspection:

  • Complete and provide FDA with a signed Form FDA 482 (“Notice of Inspection”);
  • Complete an inspection form, detailing:
    • Administrative information;
    • The scope of the facility’s business (e.g., manufacturing, retail, import/export of products);
    • A list of potential violations of the Federal Food, Drug, and Cosmetic Act; and
  • Be prepared to testify on behalf of FDA in any regulatory or judicial proceeding.

The RFP focuses extensively on the type of evidence collection and storage permissible under the Agency’s guidelines – including the collection of photographic and physical evidence.  The RFP further requires that the contractor complete required Agency training regarding the permissibility of collecting reports, data, documents, and photos (including limitations on Confidential Business Information (CBI), sales data, and personnel data).

The RFP describes the scheduling of inspections on a continuing, quarterly basis, in accordance with designated quotas.  The program allocates funding for one full-time program manager, approximately 10 program coordinators, and 20 inspectors (based on 2,080 annual hours per full-time equivalent).

Keller and Heckman continues to monitor developments relating to FDA’s forthcoming inspections of tobacco and vapor manufacturing establishments, and, to help companies prepare, recently launched the Audit and Inspection Program (AIP).  The AIP provides establishments with an opportunity to conduct advance, client-confidential, independent auditing to identify and remedy any deficiencies.  In addition, the AIP provides establishments with training regarding FDA’s inspection authority, the permissibility of Agency collection of business information, and optional environmental and occupational health and safety components.  For additional details on the AIP Program and to register, click here.

On May 2, 2018 (3:00 PM ET), attorneys Azim Chowdhury and Daniel Rubenstein will be participating in a free webinar hosted by the Smoke-Free Alternatives Trade Association (SFATA), “The FDA is Coming – Are You Ready” and will be discussing Keller and Heckman’s AIP and how manufacturers and retailers can prepare for an FDA inspection. Register for the webinar here.