Personalised Nutrition: The EU’s Fragmented Legal Landscape and the Overlooked Implications of EU Food Law

Abstract

Personalised nutrition, the tailoring of nutrition products, services or advice to individual characteristics such as genetics, phenotype, nutritional intake and/or exercise routine, is increasingly attracting the interest of industry, consumers and researchers. This article provides an overview of the current European Union (EU) regulatory framework as applying to personalised nutrition and draws attention to the important role of EU food law in the regulation of this innovative approach to nutrition. It is argued that personalised nutrition challenges the regulatory borderline between health and lifestyle products or services and, furthermore, also pushes the boundaries of current food safety and health claims legislation.

I. Introduction

The personalisation of health is a game changer in the health sector at large. Amidst this trend, “personalised nutrition” became a buzzword, both for individual consumers and for the industry. The number of offers for personalised nutrition advice and products are ever-increasing, from a personalised nutrition programme developed on the basis of continuous glucose monitoring and tracking of eating habits,¹ to personalised muesli that is mixed based on an at-home blood and/or DNA test.² Where, historically, nutrition was mainly used to prevent hunger, people today are increasingly interested in using foods to stay healthy, or even to prevent diseases.³ From the scientific perspective, variations in responses to nutrition were already a topic of interest in the 1950s, but advancements in scientific methods such as the possibility of human whole-genome sequencing since 2001 have made large contributions to the fields of nutrigenetics (how the genotype – the DNA sequence – affects an individual’s response to foods) and nutrigenomics (what the effect of food is on gene expression), and thereby enhanced the development of personalised nutrition.⁴

Today, dietary advice is very general and targets the full population: it gives one-size-fits-all advices to address risk factors in the development of chronic diseases, including obesity and diabetes type II,⁵ with limited impact so far.⁶ Personalising such strategies has been suggested as more effective for changing behaviour.⁷ Therefore, scientists concentrate on the development of methods to analyse inter-individual differences between people in their response to food products and how this can be translated into nutrition advice.⁸ In this regard, the personalisation of nutrition indicates a move away from dietary advice for the general public to more tailored products and services that are offered for groups of people or individuals to meet their nutritional needs.⁹

Therefore, personalised nutrition is not only gaining traction in the more lifestyle- and wellness-orientated food industry, but in a public health context personalised nutrition is presented as a promising contributor to alleviating non-communicable diseases.¹⁰ Currently, personalised nutrition is something that is available to a narrow group of highly motivated and financially affluent consumers¹¹ or those who engage in personalised nutrition approaches due to certain specific circumstances like a career in professional sports. Nevertheless, since personalised nutrition could succeed in providing significant and sustainable changes to health, it is argued that it is very desirable to make it accessible to the population at large,¹² especially for low-income citizens, as the burden of a developing a disease is the highest on them.¹³

The scientific progress in health and nutrition and the way in which it is translated into services and goods also entails challenges from a legal and regulatory perspective. However, so far, research into the regulatory framework for personalised nutrition has mainly focused on data protection and medical testing devices, as well as the regulation of personalised nutrition services.¹⁴ After defining the phenomenon of personalised nutrition (Section II), this article will also provide an overview of the most important legal requirements in these areas (Sections III and VI) by addressing the basic requirements of consumer protection on health and lifestyle advice and the legal requirements for gathering data and information on consumers or patients. However, the role of food law in the regulation of personalised nutrition has only been addressed to a limited extent.¹⁵ Where the advancements in personalised nutrition will also lead to the production and marketing of personalised foods, European Union (EU) food law and its requirements regarding health protection and consumer information creates significant legal boundaries (Section V), which so far have not been intensively studied.

The aim of this article is, therefore, to provide a comprehensive overview of the current regulatory framework established by EU law as it can be applied to personalised nutrition and to provide novel insights into to the important role of EU food law in the regulation of this innovative approach to nutrition. It will be demonstrated that the current legal framework is very fragmented, which is also attributable to the multifaceted nature of the phenomenon: various stages of the development and marketing of products have to comply with a range of legal requirements that will be addressed in detail. Furthermore, within personalised nutrition, the borderlines between health and lifestyle and the corresponding regulatory frameworks fade. Generally, whereas a lifestyle offering would aim at maintaining or optimising the status quo of the well-being of the person concerned, it becomes a health offering where it is meant to alleviate or prevent illness. With personalised nutrition, as this paper will show, the legal status of a personalised offering is dependent on the type of information collected as well as the combination and use of this information and, additionally, the aim and claim raised by the product or service. Therefore, it will be argued that, within this already fragmented regulatory framework, the fact that personalised nutrition is in-between health and lifestyle gives rise to several challenges for the application of the existing legislation in the areas concerned and leads to uncertainty concerning the applicable set of rules. Where these rules aim to facilitate innovation in the area but also ensure health and consumer protection, personalised nutrition is blurring the borderline between the highly regulated medicines sector and less regulated wellness and lifestyle products and services. Moreover, personalised food products push at the boundaries of the existing framework for food safety and permitted health claims.

II. Personalised nutrition: a definition

Although personalised nutrition is still a relatively young phenomenon, what is already clear is that its exact contents can be multifaceted, ranging from testing services and nutrition advice to the personalisation of different kinds of food, with varying “levels” of personalisation from mere questionnaires to personalisation of advice and products via gene and/or blood tests.¹⁶ What unites these various offerings is the core thinking that personalised nutrition is more effective than general nutrition advice and that individuals are shown to respond differently to dietary advice.¹⁷ Differences that are experienced by individuals can, for example, be related to the individual genetic variation that affects their ability to absorb, distribute, metabolise or excrete a compound (kinetics).¹⁸

Generally, three layers of information can be used to increase understanding of individual responses to food ingredients, foods and the overall diet: (1) demographic and lifestyle-related information, such as age and frequency of food consumption; (2) phenotypic information,¹⁹ such as body mass index (BMI) and cholesterol levels, all of which are observable characteristics that are the expressed result of how the genetic make-up (DNA) interacts with environmental factors (eg diet); and (3) information based on an individual’s genotype (the DNA structure in itself),²⁰ including the genetic predisposition for certain diseases or the (in)capacity to absorb or metabolise a specific nutrient. These three information layers originate from data gathered through different more or less invasive methods: data describing food intake and eating habits via (online) questionnaires, activity tracking via wearables, phenotypic data (gender, weight, etc.), measures of blood pressure, sampling of blood or urine such as blood glucose levels or genetic data, which are usually collected through buccal swabs.²¹

The first type of information, demographics and lifestyle, can be used to provide stratified or tailored advice to specific subgroups of the population. Stratified, tailored or targeted nutrition describes the aim of grouping people together based on their personal information.²² And even though this first layer of information could already be used to provide more individualised dietary information, the second level of individualisation – “individualised” or “personalised” nutrition – mainly refers to the use of phenotypic data. The third level of individualisation – “genotype-directed” nutrition – focuses on using the genotypic data of an individual as the basis for their personalised nutrition plan.²³ These three levels of individualisation can all be used separately to develop personalised nutrition products and services.²⁴ Interestingly, the potential for integrating data from different sources has resulted in the trend to focus on combining data obtained through all three of these layers.²⁵ The addition of genotypic data to the information obtained through analysing demographics, lifestyle, food behaviour, (deep) phenotyping and metabolomics is now known as “precision nutrition”.²⁶ It is the combination and blending of the obtained insights and the symbiosis that this creates that provide more insights into individual nutrition benefits.

These levels of individualisation can be marketed to consumers in various forms. The umbrella term “personalised nutrition” can be used to refer to products, services and advice.²⁷ In this definition, personalised nutrition “products” refer to food products that can be or are already personalised by or for consumers based on specific individual data. “Service” concerns the gathering and analysis of personal data to obtain information that allows for the individualisation of the diet. The most common example of such a service is carrying out a genetic test; however, it may also include other or additional sources of personal data, such as a questionnaire-based analysis of dietary habits. Even though personalised nutrition advice can be addressed separately,²⁸ the line between service and advice is not clear cut. “Advice” is generally considered to entail the advice given after providing some type of information (based on the service) and how to optimise the diet based on the analysed results.²⁹ Both “service” and “advice” can therefore be grouped together to relate to all steps in offering, identifying, processing and advising upon the obtained information.³⁰ Finally, at least certain personalised nutrition products, in their development and production, will be based on or combined with prior services and advice, as described above.

Therefore, to provide a working definition, personalised nutrition encompasses products, services and/or advice (or a combination of these) that offer the personalisation of individuals’ nutrition based on their needs and preferences, using demographic and lifestyle-related phenotypic and/or genotypic information.

III. The fragmented regulation of personalised nutrition

Having described the multifaceted definition of what constitutes personalised nutrition in Section II, it is not surprising that the phenomenon raises various legal and regulatory concerns. Personalised nutrition entails risks for consumers that go beyond the traditional general nutrition advice: personalisation per se requires data, including very sensitive health data, that deserve adequate protection; these data might be collected through at-home tests without professional supervision; consumers might be more likely to believe false, not scientifically substantiated claims if the advice and products are personalised. Subsequently, the question arises as to whether personalised nutrition products are safe when consumed by someone to whom they were not targeted.

In general, the EU’s regulatory approach to new technologies is risk-based and follows the precautionary principle, which implies that it focuses on trying to identify the risks that a technology entails for humans or the environment and subsequently puts into place procedures to assess and manage the respective risks.³¹ Currently, at the EU level, personalised nutrition and the risks it entails are not regulated in a sui generis form such as a specific Regulation or Directive. This seems to also hold true for the legislation of the Member States.³² The European Commission in 2016 conducted a workshop on “smart personalised nutrition” (SPN) and concluded that it is necessary to “establish a legal and ethical framework for SPN and promote its international harmonization. This should encompass data sharing frameworks, privacy laws, information law and food legislation”.³³

Nevertheless, the absence of a specific regulatory framework does not mean that the phenomenon is unregulated. On the contrary, personalised nutrition falls within the scope of various existing legal instruments, the application of which will differ with regard to the type of personalised nutrition product, service or advice in question. The application of existing legislation to emerging technologies, or “recombinant regulation”,³⁴ as Ellen Stokes calls it, is not a rare occurrence in risk regulation and the approach to new technologies in the EU.³⁵ This does not necessarily require the adoption of new legislation.³⁶ For example, in the regulation of nanotechnologies, the “incremental approach” was chosen, where the existing legislation was reviewed and adapted where this was deemed necessary.³⁷

Although in the context of personalised nutrition no formal process has been carried out to assess the applicability and effectiveness of the various existing legal provisions in place, it is clear that many of the risks identified with regard to personalised nutrition fall within the remit of existing legislation. With regard to personalised nutrition, next to the EU law applying to the provision of personalised nutrition services and general consumer protection measures, the risks associated with the gathering of personalised nutrition data and the development of food products are also subject to existing EU law (Table 1).

Table 1. Personalised nutrition activities and regulatory frameworks applicable to these activities.

FIC = Food Information to Consumers; GDPR = General Data Protection Regulation; IVDD = In Vitro Diagnostic Medical Device.

This means that companies interested in developing personalised nutrition services or products are faced with a multitude of legal requirements arising from various legal sources. For companies developing a product, it is essential to know which legal framework will apply to them, because the regulatory requirements and, therefore, the hurdles of proving the safety and the efficacy of the product are diverging. Especially in precision nutrition, development costs are expected to be high,³⁸ and it will be essential for companies to understand the regulatory requirements and the costs that they give rise to early in the research and development process.³⁹ From a consumer protection perspective, it is important to understand the regulatory mechanisms in place and to question how the existing legislation ensures the safety of the products and prevents misleading claims.

IV. Personalised nutrition: blurring the borderline between health and lifestyle in the existing regulatory framework

As discussed in the previous section, personalised nutrition is subject to various pre-existing regulatory measures. In this section, we will provide an overview and analysis of the application of EU law to personalised nutrition in more detail. We will examine the legislation that is applicable to gathering data for the personalisation of nutrition, the provision of nutrition advice and services on the internal market and the marketing of personalised nutrition. What will become evident in the analysis is that personalised nutrition can be categorised between healthcare and lifestyle-related products and services,⁴⁰ which affects the question as to which legal framework will be applicable.

1. Gathering data: data protection and privacy

The whole premise of personalised nutrition – the personification of nutrition advice, services and products – depends on obtaining information about individuals. The ever-increasing ability to process data is a catalyst for the personalisation of nutrition, and it is very likely that online tools (such as apps)⁴¹ will play a big role in this developments in collecting information and in providing services to consumers.⁴² The legal and ethical questions of data protection and privacy in the context of personalised nutrition are extensive, which is why this section only provides an overview.⁴³

In the EU, the rights to privacy and data protection are fundamental rights: Article 7 of the Charter of Fundamental Rights of the European Union grants the right to respect for private and family life, while Article 8(1) of the Charter and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide the correlated right to the protection of personal data. Concrete norms on how to handle data can be found in the General Data Protection Regulation (GDPR),⁴⁴ which applies when personal data are processed, which includes collecting, storing, disseminating and combining data.⁴⁵

Information constitutes personal data if it relates to an identified or identifiable natural person,⁴⁶ which in times of Big Data and technological processes becomes an increasingly broad category, as it becomes more and more likely that, through a combination of available data, certain information can be traced back to an individual.⁴⁷ Personalised nutrition depends on the processing of personal data: obviously, the name of a person is personal data, but also information such as height and weight can be personal data if they can lead to identifying a person (eg when combined with other data). It is also important to stress that DNA can constitute personal data in itself (person X has this DNA), while it may also establish a link between another piece of information and the individual, as the individual DNA is specific to an individual and may be used to identify the person.⁴⁸ In addition, for human tissue samples, it has been made clear that extracting information from such samples constitutes the collection of personal data.⁴⁹

Where personal data are processed in the context of personalised nutrition, several protection mechanisms apply. The GDPR in Article 5 lays down several key principles applying to the processing of personal data, such as lawfulness, fairness and transparency, purpose limitation and data minimisation. The lawfulness in terms of the grounds of the processing can be based on freely given, informed, specific and unambiguous consent, or on several other grounds, to be found in Article 6 of the GDPR.⁵⁰ Next to the responsibility that the GDPR assigns to companies that control the data in accordance with these principles, the GDPR also gives rights to the data subject (the person who’s data are processed), including rights of information, access, rectification, erasure, object, data portability and a protection against certain types of automated decision-making.⁵¹ The GDPR in Chapter IV also places several other obligations on companies that would process personal data in the context of offering personalised nutrition.

The personalisation of nutrition products, advice and services will not only require the processing of personal data, but might also presuppose the processing of data concerning the health of a person. Such data are sensitive data and subject to the even stricter protection of Article 9 of the GDPR. According to Article 4(15) of the GDPR, data concerning health are defined as: “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status”. This applies to data which “reveal information relating to the past, current or future physical or mental health status of the data subject”,⁵² and Recital 35 explicitly mentions “information derived from the testing or examination of a body part or bodily substance, including from genetic data and biological samples … and any information on, for example, a disease, disability, disease risk …”.⁵³

This type of data, as well as genetic data and biometric data,⁵⁴ cannot be processed unless this is authorised under the conditions of Article 9(2). Article 9(2) then lists several circumstances under which such processing is allowed, the most important in the context of personalised nutrition being explicit consent (Article 9(2)(a)) and the processing for purposes of preventative or occupational medicine, carried out by a professional subject to the obligations of profession secrecy (Article 9(2)(h) and 9(3)). Notably, the necessity for the performance of a contract is not an acceptable exception in the processing of health data. The GDPR does not further specify which additional requirements apply to explicit consent as opposed to regular consent, which has to be “freely given, specific, informed and unambiguous”, as defined in Article 4(11) GCPR. Guidelines by the Article 29 Working Party indicate that “explicit” is referring to the way in which consent is given, in the sense that it must be an express statement of consent, preferably in writing and potentially even signed or via two-staged verification in the digital context.⁵⁵

Ultimately, the borderline between personal data and health data is fluid:⁵⁶ data about the health status of a person as generated in a professional medical context are clearly health data and so are especially protected.⁵⁷ However, information that pertains to a scientifically proven risk indicator (eg high blood pressure or obesity) also constitutes health data.⁵⁸ Furthermore, data such as the tracking of the sport activities of a person or dietary information are not in themselves health data, although they can become health data where they are combined with other information and conclusions can be drawn on the person’s health status.⁵⁹ This means that in the processing of data in the context of personalised nutrition offerings, the extent of data protection – and the corresponding rights and duties – depend not only on the nature of the data processed, but also on the question of how they are combined. It does not matter whether, for example, an app is marketed more as a lifestyle app than making explicit health benefit claims – it still might process health data. For the consumer, it might not always be obvious that they are volunteering sensitive health data, especially if the nutrition advice is offered outside of the medical context. Moreover, the understanding of the risks attached to sharing these data might not be entirely clear to them.⁶⁰

2. Collecting data: medical devices and the regulation of genetic testing

Offering personalised nutrition can require the use of devices, such as the tools used to collect samples for blood or buccal cell swabs. Some of the equipment and technology used in the personalisation of nutrition will qualify as medical devices and, therefore, will be subject to EU law. In this regard, “medical device” refers to a broad range of products such as instruments, appliances or software, which are produced with the intention of medicinal use, thus for the purpose of diagnosis, prevention, monitoring, treatment or alleviation of disease.⁶¹ The additional category of in vitro diagnostic devices, which are devices such as test kits, intended for the collection and examination of specimens (including tissue and blood) taken from the human body to examine the physiological state of someone or to monitor therapeutic treatment, is subject to a separate piece of legislation with specific requirements.⁶²

Therefore, the manufacturing and marketing of medical devices is subject to EU harmonisation.⁶³ However, the legislation itself is limited to establishing essential requirements regarding the safety and performance of the devices, containing minimum requirements concerning the reduction of risks to patients and the efficiency of the products. In order to demonstrate that a medical device conforms with these essential requirements, it will have to fulfil the technical specifications that are adopted in the form of harmonised standards by private standardisation bodies. Their compliance will be assessed by so-called notified bodies. Manufacturers must apply for assessment with a notified body in order to obtain certification, while some low-risk products can even be self-certified. A product that has shown compliance with the standards – and therefore the essential requirements in the legislation – will be certified, can bear the CE mark and subsequently can be sold in the EU.

As personalised nutrition services will often be offered outside of the classical healthcare setting, the defining question for the qualification of a piece of equipment or a technology as a medical device will be whether the personalisation of nutrition in a general or specific case would qualify as a medical purpose or would be seen as lifestyle related. This is especially difficult to determine with regard to software such as apps or algorithms to support dietary advice, which can constitute medical devices, but this depends very much on its intended use. A similar problem in the distinction between health and lifestyle is also present with regard to genetic testing kits.⁶⁴ Nevertheless, this characterisation problem is partially addressed by a recent revision of the medical device legislation. Currently, the EU is in a transition phase between the three previous Medical Device Directives,⁶⁵ which have been replaced in April 2017 by two new Regulations.⁶⁶ The two new Regulations were meant to apply after a transition period in May 2020 (medical devices) and May 2022 (in vitro diagnostic devices); however, this has now been delayed by a year due to the COVID-19 crisis.⁶⁷ The new Medical Device Regulation includes the prediction of diseases as a medical purpose and therefore means that the tools used in personalised nutrition services will be covered by the legislation if they are used to predict the disease predisposition of a person.⁶⁸ Moreover, the new In Vitro Diagnostic Medical Device (IVDD) Regulation also includes devices aimed at “providing information … concerning the predisposition to a medical condition or a disease”⁶⁹ in its definition. The IVDD Regulation also specifically addresses genetic testing in Article 4 and requires the informed consent of the person being tested. Thus, under the new legislation, tests that are performed outside of the classical health setting but are aimed at providing information on disease predisposition also qualify as (in vitro) medical devices and will have to be manufactured and marketed in accordance with the applicable Regulation.

While the medical devices used in genetic testing are regulated at the EU level, this does not hold true for the different methods in which genetic testing can be offered or by whom it is offered. Questions relating to medical supervision or informed consent are subject to national legislation and are hardly harmonised at the EU level.⁷⁰ Traditionally, genetic testing took place in a medical or clinical setting for health-related reasons, whereas with personalised nutrition genetic testing is not restricted to a clinical setting, but also includes a lifestyle-related offer that commercial parties directly market to interested consumer. Member States are free to restrict and regulate direct-to-consumer genetic testing and have done so in very diverging ways.⁷¹ Generally, we can distinguish between whether or not a country prohibits genetic testing outside of medical supervision and whether or not (professional) counselling is required, and there is variation in the rules concerning informed consent. Some countries, such as France and Germany, restrict genetic testing for health purposes to the medical supervised used, which essentially constitutes a prohibition of direct-to-consumer testing.⁷²

3. Offering advice and services on the internal market

EU law also affects who can offer personalised nutrition services, such as carrying out tests regarding nutrition deficits, gene tests or the provision of nutrition advice and under which conditions. Thus, on a case-by-case basis, depending on the nature of the service and the professional providing it, either the Services Directive⁷³ or the Patients’ Rights Directive⁷⁴ will be applicable, but only where the service is provided cross-border, as otherwise the national legislation will govern the provision of the service. The main importance of EU law in this regard is that it simplifies offering personalised nutrition services outside of the Member State where the service provider is established by guaranteeing the freedom to provide services.⁷⁵ This is further specified in the Services Directive, which minimises administrative burdens on service providers. From a consumer protection perspective, the Directive is relevant because it entails certain rights for the recipient of a service, minimum information to be provided to the customer and rules on professional liability.⁷⁶

However, personalised nutrition can, under certain circumstances, fall outside the Services Directive and into the remit of the Patients’ Rights Directive which applies to cross-border healthcare.⁷⁷ According to Article 3(a) of the Patients’ Rights Directive, healthcare is defined as “health services provided by health professionals to patients to assess, maintain or restore their state of health, including the prescription, dispensation and provision of medicinal products and medical devices”. Therefore, depending on who is involved in the provision of personalised nutrition services, this might qualify as healthcare. In this regard, doctors and nurses fall under the definition of health professionals as regulated professions in the healthcare sector.⁷⁸ Notably, many countries have regulated the profession of dieticians, which means that the title can only by carried and the respective tasks can only be executed by persons who have obtained the required professional qualification.⁷⁹ In Germany, for example, a “Diätassitent(in)” is someone who “(a)dministers dietary and nutritional therapies as prescribed by or upon prescription of a medical practitioner; helps prevent and treat medical conditions; offers nutritional advice to patients and runs courses on nutrition; accepts full responsibility for his/her work”.⁸⁰ Thus, providers of personalised nutrition services will have to carefully examine whether they can offer their specific service in a Member State that might regulate dietary advice. The Patients’ Rights Directive mostly concerns questions of facilitating cross-border healthcare and regulating its reimbursement; for consumers/patients, it is mainly relevant due to the minimum information it requires to be provided in order to enable informed decision-making.⁸¹

4. Marketing: contracts and advertising

Finally, EU law also places limits and conditions on the marketing of personalised nutrition services and products and grants certain consumer protection rights. First of all, Directive 2005/29/EC on unfair business-to-consumer commercial practices, the enforcement of which currently has been strengthened, prohibits misleading commercial practices, including deceiving information.⁸² As argued by Ballke and Meisterernst, if a personalised nutrition product or service offered would, for example, fall short of providing the state-of-the-art genetic analysis concerning predisposition for certain diseases that the consumer would legitimately expect through the information provided about the product, this would be a misleading practice.⁸³ In such cases, the Directive grants rights to proportionate and effective remedies, which might be in the form of damages, but the exact nature of this is dependent on national law.⁸⁴

Additionally, Directive 2011/83/EU on consumer rights harmonises the protection of consumers in contacts between them and traders, including distance sales contracts but excluding contracts for healthcare.⁸⁵ It provides for minimum information that needs to be given to the consumer before the conclusion of a contract and grants a 14-day withdrawal right for distance contracts.⁸⁶ In case a personalised nutrition product or service is offered via the Internet, the E-Commerce Directive 2000/31/EC applies as lex specialis, requiring for certain information to be provided and regulating contractual matters.⁸⁷ Article 8 of the Directive particularly specifies that services provided by members of regulated professions need to be performed in accordance with the applicable regulations for this profession.

V. The missing piece: developing and selling a food product – safety and consumer protection

The discussion of personalised nutrition in the literature often focuses on the technical and technological regulation discussed in Section IV; however, it fails to address the regulation of personalised nutrition products: foods that are personalised by or for the consumer, such as the muesli mentioned in Section I. As will be discussed in this section, the development of such products challenges the existing legal framework for foods, which is aimed at ensuring a balance between internal market values, including the free movement of goods, while guaranteeing a high level of human health and maintaining consumer protection against misleading practices.⁸⁸ First, personalised foods blur the borderline between foods and medicinal products. Second, as will be argued in this section, while the scientific progress allows for personalisation of nutrition products and services, the legal framework is focused on general safety protection, ensuring that only food products that are proven to be safe and have health benefits for the general population are allowed. Therefore, personalised nutrition is pushing at the boundaries of EU food law and the norms established for the science-based decision-making in the field.

1. Blurring the food–medicine borderline

From a regulatory perspective, foods and medicines are two strictly separate categories of products, with diverging legal frameworks and requirements. Article 2 of the General Food Law (GFL) contains a very broad definition of food encompassing “any substance or product, whether processed, partially processed or unprocessed, intended to be, or reasonably expected to be ingested by humans”. This has to be opposed with cases in which the (claimed) effect on health is so prominent that it would fulfil the definition of a medicinal product. Article 1(2) of Directive 2001/83/EC defines medicinal products as any substance or combination of substances that either is “presented as having properties for treating or preventing disease in human beings” or that “may be used in or administered to human beings either with a view to restoring, correcting or modifying physiological functions by exerting a pharmacological, immunological or metabolic action, or to making a medical diagnosis”. Thus, the qualification as medicinal product either follows from the presentation of the product or from its function. The Directive also clarifies that, in cases where it is unclear whether a product might be qualified as a medicinal product or as another regulated product (eg a food product), then the application of the pharmaceutical legislation takes precedence.⁸⁹ This hierarchy of regulatory frameworks is also confirmed in the GFL, which in Article 2(d) excludes the application of the GFL to medicinal products.

In simpler terms, food can play a role in maintaining and possibly also improving health, whereas a product is a pharmaceutical where it is (claimed to be) used to prevent, treat or cure a disease.⁹⁰ However, some personalised nutrition products will be difficult to characterise as either food or medicinal product. Where personalised nutrition products are aimed at preventing someone from developing a disease to which that person is genetically predisposed or where it is targeted at remedying someone’s serious nutrient deficiency, this borderline is difficult to determine. Generally, it has been argued that foods and nutrition can play a preventative role and provide their benefits only over a certain amount of time, whereas pharmaceuticals provide an immediate effect.⁹¹ However, certain foods also have immediate effects (eg polysterol-enriched foods reducing blood cholesterol levels).⁹² Today, the scientific and technological advances in phenotyping and genomics as used in personalised nutrition are further blurring the borderline between food and medicinal products.⁹³

Moreover, the qualification of the product as one or the other has regulatory consequences and, once a product crosses the fine borderline from foodstuff to a medicinal product, it is subject to an even heavier regulatory burden and has to obtain a marketing authorisation before it can be sold.⁹⁴ When the presentation or function of the personalised food does not make it a medicinal product, it remains a food for the purposes of EU law, which does not imply that it is not regulated. On the contrary, the GFL and other more specific secondary legislation also impose several obligations that have to be honoured at every stage of food production and processing, as well as during its distribution.⁹⁵

2. Pushing the boundaries: safety – for whom?

First and foremost, like any other food, personalised nutrition products must not be injurious to health and not be unfit for human consumption (eg through decay), according to Article 14 of the GFL.⁹⁶ While food safety is generally concerned with the safety of food for the general population,⁹⁷ how does it address a situation where a personalised nutrition product is beneficial for a person or groups of persons, while potentially unsafe for the public at large?

In case a product is created to serve the nutritional needs of a certain individual or group of individuals, it might be possible that its consumption by the average consumer would have negative effects on health. This is exemplified by plant sterols, which are added to products such as margarine and can claim to lower cholesterol, which reduces a risk factor in the development of coronary heart disease.⁹⁸ However, at the same time, consumption can also lead to an increase in plasma concentrations of phytosterols (for which the consequences on cardiovascular risk are unknown) and a reduction in plasma concentrations of β-carotene (which is likely to increase cardiovascular risk).⁹⁹ In this case, the EU introduced a mandatory warning label stating that the product is not intended for people that do not need to control their blood cholesterol level.¹⁰⁰ In particular, pregnant and breastfeeding women and children are recommended not to consume food fortified with phytosterols.¹⁰¹

When examining whether the GFL would cover a situation where a personalised nutrition product would be harmful if consumed by someone other than the intended consumer, it should be considered that the GFL does not require a food to be safe, but rather requires is not to be unsafe.¹⁰² Generally, European food law operates on the presumption that food is safe and that, by controlling hazards in the supply chain (through food safety management systems), risks are minimised.¹⁰³ This changes where a food business operator realises or has reason to believe that food is unsafe (Article 19(1) GFL). Moreover, for specific foods where the legislator has deemed the presumption of safety not to exist, such as novel foods where no history of consumption would vouch for their safety, the food business operator will have to prove the safety of the food.¹⁰⁴ Therefore, certain studies need to be conducted (eg sub-chronic toxicity studies) or specific end points need to be reported to show that such foods are safe for the general population.¹⁰⁵

What is essential when assessing the (un)safety of food are the conditions of use that are normally to be expected.¹⁰⁶ A personalised food that is specifically made for one person could therefore presumably be expected to be consumed by this person or a group of consumers sharing specific similarities and no one else. Where a food is intended for a certain category of consumers, the health sensitivities of this specific consumer segment, such as infants or elderly people, need to be taken into account.¹⁰⁷ However, when such a product would be sold in a normal supermarket, it could be expected that someone else would buy it (much like in the fortified margarine example above). Where a product is harmful to a group of people with health sensitivities that it was not marketed for, it is not automatically injurious in the sense of Article 14.¹⁰⁸

Finally, the information provided to consumers is also taken into account in determining the potential unsafety of food (Article 14(3)(b)). Overall, if a personalised nutrition product is accessible to the public at large, for products that have known unwanted side effects in the general population or any non-target group, additional information on the packaging is probably necessary. For specific sensitive groups of the population (eg those suffering from allergies), this additional information is already provided: foods that contain one of the fourteen specified allergens or that could be contaminated with such allergen need to carry a warning on their label or the related information on the food.¹⁰⁹ In addition, other specific food legislation recognises the need to inform vulnerable groups about risk (as exemplified for non-intended consumer segments for fortified margarine), although not classifying such foods as unsafe.¹¹⁰

In summary, although personalised nutrition pushes at the boundaries of the rules regarding food safety, personalised nutrition does not seem to raise safety risks that would be so new that they are either not adequately addressed in the current legal framework or could not already be contained within existing risk mitigation measures such as adequate labelling.

3. Pushing the boundaries: claims made on personalised nutrition

In addition to food safety, EU food law also aims to protect consumers against false claims, such as unsubstantiated statements about the health effects of a food product. In this regard, most important in the context of the debate surrounding personalised nutrition – the sometimes unproven claims made¹¹¹ – is the obligation that the labelling, advertising and presentation, including packaging and information provided, shall not be misleading.¹¹²

This is further specified in the Food Information to Consumers (FIC) Regulation, which covers any information that is provided to the final consumer concerning a food, including the label and packaging, but also any other accompanying material, advertising and technological tools (eg QR codes, apps or websites).¹¹³ The Regulation not only prohibits information that is misleading to consumers concerning the characteristics of the food, such as its composition or the quantity of the product, but also entails prohibitions on “attributing to the food effects or properties which it does not possess”, and most importantly in the area of personalised nutrition, it prohibits any information that will “attribute to any food the property of preventing, treating or curing a human disease, nor refer to such properties”.¹¹⁴ This provision reinforces the food–medicine borderline, and, as explained by Ballke and Meisterernst, will significantly limit the marketing options, especially in areas such as personalised nutrition products based on nutrigenomics, which are (allegedly) meant to prevent diseases to which the person in question is genetically predisposed.¹¹⁵

The only viable route to making a health-related statement on food is through a so-called health claim, which has to comply with the requirements of the Nutrition and Health Claims Regulation.¹¹⁶ This Regulation was introduced in the early 2000s in the wake of the rising trend of functional foods (ie foods that have a positive effect on one or more body functions beyond nutritional effects) to harmonise national regulation and to ensure that consumers are protected against false claims and given sufficient information to make an informed choice.¹¹⁷ The use of health claims is prohibited unless it concerns an authorised claim and conforms to the additional requirements of the Regulation.

The Regulation distinguishes between nutrition claims (beneficial nutritional properties given a food’s energy and calorific value or the quantity, presence or absence of nutrients)¹¹⁸ and health claims (which either explicitly or implicitly link a food/food category/one of the food’s constituents with health effects).¹¹⁹ An example of a nutrition claim is “fat-free”, whereas a health claim would be “includes vitamin C, which supports your immune system”. Any of these claims will only be acceptable where the nutritionally or physiologically positive effect has been proven by generally accepted scientific evidence; where the nutrient or substance in question is actually present (or absent) in the final food in a quantity that allows for the beneficial effect; where the nutrient or substance is contained in a form that is bioavailable; and where it can be reasonably expected for a consumer to actually ingest enough of the food to generate the positive effects.¹²⁰

For most personalised foods, health claims would be the most commercially interesting statement to make, as personalised nutrition is aimed at maintaining or improving the health of an individual.¹²¹ The legislation makes a distinction between different types of health claims, which either are function claims (Article 13), disease risk reduction claims (Article 14(1)) or children’s development claims (Article 14(1)). Any information to final consumers referring to the impact of a nutrient or substance contained in the food on (1) growth, development and functions of the human body; (2) any psychological as well as behavioural functions; or (3) losing or controlling bodyweight or hunger reduction/suppression, as well as reductions of energy (in the sense of caloric value), will constitute function claims under Article 13. These claims can only be used where they are contained in the list of authorised health claims,¹²² while the inclusion of additional claims has to be applied for on the basis of newly generated scientific evidence (Article 13(5)).

Disease risk reduction claims (Article 14(1)) are claims that explicitly or implicitly attribute the significant reduction of a risk factor for the development of a human disease to consuming a food (ingredient).¹²³ Especially with regard to these disease risk reduction claims, one has to again refer to the borderline with medicinal products: since most diseases are multifactorial – they are likely to be caused by a combination of factors – a food or functional ingredient can only claim to positively affect one risk factor in disease development. The positive effect on this risk factor for the development or progress of the disease can then be connected to the reduced risk of developing the disease itself. Thus, coming back to the plant sterol example, the claim may not be that “plant sterols prevent heart disease”, but that “plant sterols have been shown to lower/reduce blood cholesterol. High cholesterol is a risk factor in the development of coronary heart disease”.¹²⁴ If the consumption of the food (ingredient) would be immediately suggested to reduce the risk of disease (without clearly stipulating the single risk factor affected by the food), the product would be seen as a medicinal product by presentation. Related to this food–medicine borderline is the requirement for any disease risk reduction claim to be accompanied by a statement that clarifies whether a disease is always multifactorial and whether changing one of these factors can but does not necessarily have a beneficial effect.¹²⁵

The use of a nutrition or health claim is only possible in a specifically delimited setting, providing that a health claim cannot be “false, ambiguous or misleading”, but also comparative statements about other foods cannot be made in a way that makes consumers question the safety or nutritional value of the other foods.¹²⁶ In addition to the requirements stated above, for health claims specifically, it is prohibited to imply that not consuming the food in question would negatively affect health, to indicate an amount or rate of weight loss and, finally, to make claims referring to statements of individual doctors or other health professionals.¹²⁷ Further requirements include that the following need to be included on the label: a statement on the importance of a varied and balanced diet; how much of and in which way the food in question needs to be consumed in order to achieve the effects claimed; if applicable, information on who should not consume the food; and, finally, a statement on potential health risks.¹²⁸ Any reference to the benefits of the product to health in general (eg “good for you” or “healthy”) or health-related well-being can only be made where they are accompanied by a health claim included in the list.¹²⁹

Thus, with regard to personalised food, the remit to make claims on positive health effects is severely limited. Overstepping these limits would mean that the claims made would be illegal, or might even push the product over the borderline, such that it would then need to be regulated as a medicinal product. Moreover, whereas personalised foods can already make use of currently authorised health claims, and an authorisation request can be submitted under Article 13(5) or Article 14(1)(a) for specific nutrients that affect bodily functions or a risk factor for disease in the general population, some questions with regard to the approval of health claims remain, specifically related to single effects highlighted in claims, the use of genetic predisposition as risk factor for disease development and target groups for claims.

Firstly, personalised nutrition focuses on developing foods that are tailored towards positively affecting a group of consumers or an individual based on their personal needs, which are therefore expected to not just affect one but rather multiple biomarkers. However, health claims can only address one relationship between a single nutrient and a single effect currently.¹³⁰ Whereas personalised nutrition should make use of a combination of different insights (eg into genetic, phenotypic, clinical and dietary information),¹³¹ it can thus be questioned whether such information can be transferred to consumers within one health claim.

Health claims can address how an ingredient can positively affect a bodily function or how it can reduce a single risk factor in the development of a disease. To substantiate the effect of a personalised nutrition product on a bodily function under an Article 13(5) claim, scientific evidence should be generated regarding how an ingredient would affect genes in such a way that normal functions are maintained or supported.¹³² For disease risk reduction claims (Article 14(1)) on personalised nutrition, the effect of a nutrient on the genetic predisposition for a disease would need to be accepted as a risk factor for disease development. Other currently authorised disease risk reduction claims focus on the role of a nutrient in affecting the nutritional status of an individual (eg bone mineral density) or blood plasma levels of nutrients (lowering low-density lipoprotein cholesterol), both of which are seen as risk factors in the development of a specific disease. No claim has yet been submitted that suggests that a nutrient can affect the genetic predisposition to the development of a specific disease, and thus it is unknown whether this will fall within the remit of disease risk reduction claims or again will be interpreted as a medicinal claim. However, as has been put forward by Ballke and Meisterernst, communicating the health benefits of a product based on this nutrigenomic information seems to be essential for the success of such personalised products.¹³³

Furthermore, personalised products are meant to be for specific individuals (or groups of individuals with similar traits) that would benefit from a product. Importantly, for any food, it is prohibited to explicitly state or in some form imply that sufficient nutrients cannot be derived from a balanced and varied diet, unless it concerns nutrients that have been identified as lacking (eg in a specific region) in the context of the Regulation.¹³⁴ Meisterernst, however, describes that this prohibition refers to the required quantities of nutrients in a balanced and varied diet in general, but that claims of nutritional deficiency or “extra needs” may be permissible in special situations.¹³⁵ This would open the door for such claims in the context of personalised nutrition for people in specific situations such as sportspeople or pregnant women.

This relates to the use of target groups for claims: when the described health benefit is not necessarily beneficial for the general population but merely addresses a specific subgroup, this needs to be specified in the conditions of use of a proposed claim.¹³⁶ The Member State to whom the authorisation request is submitted is responsible for reviewing whether a certain subgroup of the population can be seen as a target population for a claim.¹³⁷ However, neither in the Nutrition and Health Claims Regulation nor in any other legislative documents are specifications provided for when a certain subpopulation would be admissible as a target group for a claim.

When in a claim’s conditions of use a target group is specified, it affects the assessment of its scientific substantiation. In those cases where the health effect is deemed relevant for a specific target population based on age, sex, lifestyle or physiological conditions, the scientific evidence for the claim must be gathered by studying the proposed health effect in individuals who are representative of this subpopulation.¹³⁸ Only when health effects are reported in the subpopulation or when the results can be extrapolated to this subpopulation can the findings be used to support a proposed claim.¹³⁹ The European Food Safety Authority’s (EFSA) guidance seems to imply that a subgroup can be based on different characteristics or traits. Various references to subgroups relate to demographics (including age), lifestyle characteristics (being an athlete) and sometimes phenotypic traits (suffering from mild to moderate hypercholesterolaemia). Nonetheless, there is no indication of whether (and when) individual differences such as genotypic traits would be accepted as the basis for a subgroup by the risk manager. Claims that are even more personalised – purely individual health claims – do not seem to be foreseen by the current regulation at all.

In addition to the Nutrition and Health Claims Regulation, Regulation 609/2013 provides the opportunity to target food products to special groups, regulating foods intended for infants and young children, foods for special medical purposes and products for weight reduction that can replace the full diet.¹⁴⁰ However, this is limited to food products that are used in the dietary management of medical conditions, when individuals due to their condition cannot meet their nutritional requirements by consuming normal foods.¹⁴¹ However, no nutrition and health claims can be made regarding foods for special medical purposes,¹⁴² and the product must be used under medical supervision.¹⁴³ Even though such products may be of interest for specific patient groups, the use of this Regulation for personalised nutrition is limited, as it is unlikely that a group of healthy people who share common phenotypic or genotypic traits will be treated as a relevant target group for foods for special medical purposes. Sportspeople and diabetics have expressly been described as not relevant to being defined as specific target groups for food categories,¹⁴⁴ and thus they are excluded from the scope of this Regulation.

The Nutrition and Health Claims Regulation therefore places strict conditions on the communication of the health benefits of foods. While personalised foods could use health claims relating to single nutrients targeting larger subgroups of the population, it can be questioned to what extent the actual health benefits of a fully personalised product can be communicated to individual consumers. In this regard, further regulatory and scientific clarification is required regarding the possibility of communicating effects on multiple biomarkers and genetic predisposition to diseases. Moreover, uncertainty persists concerning the definition of potential target groups.

VI. Conclusion

Personalised nutrition is a multifaceted phenomenon that encompasses testing services, nutrition advice as well as the personalisation of different kinds of food, and sometimes even a combination of all of these components. Moreover, the personalisation can follow varying “levels” of individualisation, using demographic and lifestyle-related phenotypic and/or genotypic information. The broad definition of personalised nutrition and the fact that a wide range of activities and products come into play in personalised nutrition have resulted in quite fragmented legislation. Many legal requirements address the separate aspects that fall within the remit of personalised nutrition: consumer protection on health and lifestyle advice is dealt with in distinct legal acts, and the gathering and handling of data and information on consumers (and patients) is regulated by separate Regulations and Directives. In the dimension of personalised nutrition advice and services (and the data and information required for them), the boundaries between health and lifestyle start to blur. This leads to uncertainty for those working in the field, for whom it might not necessarily be clear which rules and regulations to follow.

Many legal requirements address the separate aspects that fall within the remit of personalised nutrition. Nevertheless, the boundaries between health and lifestyle products and services are not always clear, which challenges the rigid legal division between a highly and a less regulated area. This leads to uncertainty for those working in the field, for whom it is not necessarily clear which rules and regulations to follow. In the gathering of data needed for personalised nutrition, the GDPR applies and introduces a special regime for health data, which are deemed to be sensitive data. Nevertheless, producers, service providers and also consumers might not be as vigilant as in a more lifestyle-related context than a clearly medical one. Moreover, with the increase in personal data being shared, processed and combined, more and more information allows for the drawing of conclusions about a person’s health status, therefore constituting health data. In addition, for the medical devices used to gather information, even if they are extensively regulated, their characterisation as medical devices hinges on an intended medical use, which creates a grey area for devices used in personalised nutrition.

When analysing the product level of personalised nutrition, it is the borderline between food and medicine that is blurring. Our food law analysis shows that it is not always clear cut when certain nutrigenomic or nutrigenetic effects should be considered to be health optimising or health maintaining, or rather be defined as preventing diseases. The latter would lead a product to be regulated as medicinal product by presentation, instead of falling under food law. It is especially this difficulty that deserves the attention of those working on the development of personalised nutrition. And even though the safety of products could be of concern for specific non-target groups of personalised foods, the information requirements currently established in EU food law should be able to ensure that “health-sensitive” and vulnerable consumers are sufficiently informed. Information is also key when ensuring that the communicated health benefits are sufficiently targeted to those groups that have been proven to benefit from consuming the product, but the risk of misleading health claims is greatly reduced by the claims regulation already in place. However, our analysis also reveals that although the regulatory framework itself sets clear delimitations concerning the efficacy of personalised nutrition and the potential use of health claims for such products, the approach to the underlying scientific evidence required to obtain health claims needs to be developed further and adjusted to the unique challenges of personalised nutrition.