FAQ 14 -- Pharmaceutical and Medical Products

Q1: If personal data is are collected in the EU and transferred to the United States for pharmaceutical research and/or other purposes, do Member State laws or the safe harbor principles apply?

A:  Member State law applies to the collection of the personal data and to any processing that takes place prior to the transfer to the United States. The safe harbor principles apply to the data once they have been transferred to the United States. Data used for pharmaceutical research and other purposes should be anonymized as appropriate.
 

Q2:Data Personal data developed in specific medical or pharmaceutical research studies often play a valuable role in future scientific research. Where personal data collected for one research study are transferred to a U.S. organization in the safe harbor, may the organization use the data for a new scientific research activity?
 

A: Yes, if appropriate notice and choice have has been provided in the first instance. Such a notice should provide information about any future specific uses of the data, such as periodic follow-up, related studies, or marketing.It is understood that not all future uses of the data can be specified, since a new research use could arise from new insights on the original data, new medical discoveries and advances, and public health and regulatory developments. Where appropriate, the notice should therefore include an explanation that personal data may be used in future medical and pharmaceutical research activities that are unanticipated. If the use is not consistent with the general research purpose(s) for which the data was originally collected, or to which the individual has consented subsequently, new consent must be obtained.
 

Q3: What happens to an individual's data if a patient decides voluntarily or at the request of the sponsor to withdraw from the clinical trial?

A: Patients may decide or be asked to withdraw from a clinical trial at any time. Any data collected previous to withdrawal could still be processed along with other data collected as part of the clinical trial, however, if this were made clear to the participant in the notice at the time he or she agreed to participate.

Q4: Pharmaceutical and medical device companies are allowed to provide personal data from clinical trials conducted in the EU to regulators in the United States for regulatory and supervision purposes. Are similar transfers allowed to parties other than regulators, such as company locations and other researchers?

A: Yes, consistent with the principles of notice and choice.

Q5: To ensure objectivity in many clinical trials, patients, and often investigators, as well, cannot be given access to information about which treatment each patient may be receiving. Doing so would jeopardize the validity of the research study and results. Will participants in such clinical trials (referred to as "blinded" studies) have access to the data on their treatment during the trial?

A: No, such access does not have to be provided to a data subject if this restriction has been explained when the data subject entered the trial and the disclosure of such information would jeopardize the integrity of the research effort. Agreement to participate in the trial under these conditions is a reasonable forgoing of the right of access. Following the conclusion of the trial and analysis of the results, subjects should have access to their data if they request it.They should seek it primarily from the physician or other health care provider from whom they received treatment within the clinical trial, or secondarily from the sponsoring company.

Q6: Does a pharmaceutical or medical device firm have to apply the safe harbor principles with respect to notice, choice, onward transfer, and access in its product safety and efficacy monitoring activities, including the reporting of adverse events and the tracking of patients using certain medicines or medical devices (e.g. a pacemaker)?

A: No, to the extent that adherence to the principles interferes with compliance with regulatory requirements.This is true both with respect to reports by, for example, health care providers, to pharmaceutical and medical device companies, and with respect to reports by pharmaceutical and medical device companies to government agencies like the Food and Drug Administration.

Q7: Invariably, research data are uniquely key-coded at their origin by the principal investigator so as not to reveal the identity of individual data subjects. Pharmaceutical companies sponsoring such research do not receive the key. The unique key code is held only by the researcher, so that he/she can identify the research subject under special circumstances (e.g. if follow-up medical attention is required). Does this constitute a transfer of personal data that is subject to the safe harbor principles?

A: No. This would not constitute a transfer of personal data that would be subject to the principles.

1. This FAQ is not agreed; the Member States only recently received this FAQ and are in the process of reviewing it.