The Honorable David L. Aaron
Under Secretary for International Trade Affairs
International Trade Administration
Department of Commerce
14th and Constitution Avenue, N.W.
Washington, DC 20230
Dear Ambassador Aaron:
On behalf of the Pharmaceutical Research and Manufacturers of America (PhRMA), I am writing with our views concerning the April 19, 1999 draft of the International Safe Harbor Privacy Principles. We would like to express our appreciation for the efforts the Department of Commerce has made to address the potential problems posed by the European Union Data Privacy Directive. PhRMA member companies have a vital interest in the ability to transfer data between Europe and the United States, and we are pleased that the U.S. government recognizes the critical nature of this issue.
PhRMA would also like to thank you and your staff for working with us to develop an annex to clearly delineate how research and development and regulatory activities of the pharmaceutical industry would not be impeded by the safe harbor principles. As you are aware, we believe that such clarification is required, not only to prevent disruptions to the global business environment, but, more importantly, to promote public health by enabling our member companies to continue to lead the way in developing innovative medicines. We look forward to reaching an agreement on language in that annex to both satisfy the European Commission and EU Member States and allow critical biomedical research activities to continue.
Although we are focusing our attention on the pharmaceuticals annex, we nevertheless have the following comments and concerns on the draft documents developed by your office.
1. Retroactivity. One issue not directly addressed by the safe harbor principles (nor by the EU Directive itself) is that of retroactive application. Will the principles apply to data collected and processed prior to the effective date of the EU Data Privacy Directive, or prior to the effective date of the safe harbor principles? Such a retroactive application of the rules could be particularly harmful to biomedical research. In many cases, biomedical research relies on valuable databases developed over time. For example, the General Purpose Research Database (GPRD) under the National Health Service in the UK contains data on more than four million patients. This has been an invaluable resource for many clinical research and public health applications. Retroactive application of the safe harbor principles (on notice and choice) would effectively destroy the ability of the scientific, research, and medical communities to use this database. We would urge the Department of Commerce to clarify within the safe harbor documents that the secondary processing of data collected prior to the effective date of the EU Directive and the principles themselves need not comply with the provisions of the safe harbor regarding notice, access, choice, and onward transfer.
2. General privacy program requirements vs. industry-specific FAQ requirements. One of the ways a company may qualify for the safe harbor is to join a private sector-developed privacy program that adheres to the same principles. While that may be a reasonable requirement for most business activities, it should be noted that private sector privacy programs (such as BBBOnline or the Online Privacy Alliance) have been developed to encompass a broad range of industries. As a result, none of them is likely to specifically address the special needs of the research-based pharmaceutical industry with respect to biomedical research and regulatory activities.
As such, we would appreciate clarification that while research-based pharmaceutical companies may join a private sector privacy program in order to qualify for the safe harbor, their biomedical research activities and compliance with regulatory requirements will be bound by the language in the Frequently Asked Questions (FAQ) annex, which directly addresses those activities.
3. Weight of the FAQs. You have also requested our view on the weight to be given to the FAQs relative to the principles. PhRMA would strongly support having the FAQs carry the same binding effect on Member States and the European Commission as the safe harbor principles.
Again, thank you for the opportunity to provide comments on the draft documents. We look forward to assisting you in any way that we can.
Sincerely,
Alan F. Holmer