A legal risk assessment of bringing U.S. neurotech into the EU market.

1.                INTRODUCING SOMNEE

The WSJ Tech News Briefing on Spotify is a helpful podcast to stay informed about the latest technological advancements worldwide. One of these innovations is Somnee, a “smart sleep headband”, by StimScience’s, whose goal is to assist users in falling asleep more quickly and achieving longer, uninterrupted sleep. How does it do that? According to its website, the headband uses EEG sensors and algorithms to maps the user’s brain and perform a therapeutic stimulation session using transcranial electrical stimulation (tES). The full potential of the product is realised when it is paired with its own app, which tracks and analyses the user’s sleep. At the time of writing, the product is only available for shipping to the US and Mexico, but what if StimScience were to enter the European Union (EU) market?

This report aims to act as a legal advisor to StimScience and carry out a Legal Risk Assessment on Somnee’s technological application, using that hypothesis, by identifying the possible legal risks involved, to ascertain whether their decision to expand into the EU market is appropriate. One critical piece of legislation to be analysed is the Medical Device Regulation (MDR), to determine whether the product qualifies as a medical device, and if so, to outline the necessary steps for compliance. Additionally, an evaluation will be conducted to ascertain whether their intellectual property rights (patent) might conflict with existing EU patents for similar technologies, potentially posing infringement risks. Lastly (but surely not exhaustively), we will assess whether the product complies with the General Data Protection Regulation (GDPR), since the product processes personal data.

2.                THE MDR

Somnee is classified as a “medical device” (Article 2(1)) under this Regulation, since the headband is intended for medical use and claims therapeutic benefits for sleep quality. It therefore needs to be classified based on the potential risk to users, as set out in Annex VIII. In this case, based on Rules 9 and 22, the device will most likely be in Class IIb (Active Therapeutic Device), as it involves neurostimulation and claims to “improve sleep efficiency and duration”. Consequently, for Somnee to enter EU Market, it must comply with the obligations stated in this Regulation to avoid regulatory penalties or product recalls. Regarding this specific technology, even though research was conducted in the US to substantiate the device’s effectiveness and safety, clinical investigation^[1] must be analysed further because these claims must comply with EU standards, such as ISO 4155. Otherwise, StimScience must re-evaluate their device, which can be costly and time-consuming, but would still be a better than having their product recalled. It is also advisable to consult with an EU Notified Body to determine whether additional research is required.

Also, about claims in the labelling or advertising, Article 7 states that they must not be misleading, To mitigate risks in this area, StimScience should avoid overstating benefits and choose careful wording. For example, it would be unwise to claim that the product “will cure insomnia”.

3.                PATENT MATTERS

StimScience already holds several patents for its technology, including one for its process for intracranial measurement, stimulation, and generation of brain state models filed with the United States Patent and Trademark Office (USPTO). A patent is an intellectual property right that grants the right holder an exclusive monopoly (for a limited duration–20 years from the filing date)^[2] on an invention by preventing third parties from exploiting it without the owner’s consent.^[3] However, since this intellectual property right is territorial, protection is not guaranteed in the EU.

Could they still file a patent and gain protection in the EU market? According to the TRIPS Agreement (1994) and the European Patent Convention (EPC, 1973,), Somnee’s eligibility for patent protection in the EU depends on meeting 3 criteria:^[4] novelty,^[5] inventive step and industrial applicability. Regarding the first criterion, there is not only the potential risk of competitors having similar products on the market, e.g. other neurostimulation devices that are already registered, but the actual problem is that StimScience already had their patent granted in the US in 2021, with their priority date established in 2019. Therefore, they can no longer use their right of priority^[6]– which allows inventors to secure patent protection in multiple countries without the need to file separate applications immediately in each country – because the 12-month grace period has expired.

In summary, a new patent application would not be recognised in the EU, and as a result, the invention would enter the public domain within the EU. This means that any competitor could use the innovation without facing legal consequences in that regard. It is important to note that, in the Trademark front, “Somnee” has a valid EU trademark (registered by StimScience), therefore they can prosecute competitors that use their mark without authorisation.

4.                GDPR

For this technology to work, it must gather data on the user’s brain activity in order to promote their brain’s natural sleep pattern through electrical stimulation. Therefore, it falls under the material^[7] and territorial scope^[8] of the GDPR, which establishes stricter measures regarding “sensitive data” under Article 9. Prima facie, the GDPR prohibits the processing of personal data concerning health, unless specific exceptions apply, such as the data subject’s explicit consent. Firstly, therefore, StimScience must ensure that they have a legitimate legal basis for processing data in compliance with Articles 6 and 9 of the GDPR. They must also comply with the GDPR principles, including data minimisation and purpose limitation.

Another potential risk involves international data transfers: if StimScience chooses to process its clients’s data in the US (and not in the EU), it will have to comply with Article 44 of the GDPR and establish a legal framework, whether it be through Standard Contractual Clauses, Binding Corporate Rules or an adequacy decision.^[9] Lastly, it is recommended that StimScience carries out a Data Protection Impact Assessment (Article 35 of the GDPR).

5.                CONCLUSION

As a hypothetical legal advisor, I believe that there are no evident impediments to their intended expansion. Their product, which uses transcranial electrical stimulation, does not pose a high-risk for their company. While StimScience’s decision to expand Somnee into the EU market is feasible, it will require careful preparation to navigate the complex regulatory landscape under the MDR and GDPR. Therefore, they should invest in addressing these legal challenges, particularly by engaging with regulatory experts and ensuring compliance at every stage.

^[1] Annex XV; Article 2 (44); Article 62 MDR.

^[2] Article 33 TRIPS Agreement

^[3] Article 28(1)(a) TRIPS Agreement.

^[4] Article 27(1) TRIPS Agreement

^[5] Article 54 EPC.

^[6] Article 87-89 EPC; Articles 2 and 4 TRIPS Agreement.

^[7] Article 3 (2) (a) GDPR.

^[8] Article 2 GDPR.

^[9] In this case, the EU-US Data Privacy Framework, that was declared adequate by the European Commission in 2023.