The code of conduct, promoted by Farmaindustria, regulates how promoters of clinical trials with medicines and CROs who decide to adhere to the same should apply the data protection regulations
With the voluntary adherence to the code of conduct, data controllers and processors are obliged to comply
This code of conduct responds to the application of data protection rules in clinical and biomedical research and pharmacovigilance.
The Spanish Data Protection Agency (AEPD) has approved the Code of Conduct regulating the processing of personal data in the field of clinical trials and other clinical investigations and pharmacovigilance promoted by Farmaindustria, which becomes the first sectoral code of conduct adopted since the entry into force of the General Data Protection Regulation (GDPR). This code regulates how the data protection rules should be applied by the promoters of clinical trials with medicinal products and the Contract Research Organisations (CROs) that decide to join it. Its scope is national, although it aspires to be a reference at European level as it is the first code in this area that has been approved in Europe.
The GDPR provides that associations and bodies representing categories of data processors or processors may develop codes of conduct to facilitate their effective implementation. These codes constitute an element of voluntary self-regulation that responds to the specific needs of the sector of activity they regulate, provide guarantees for the rights and freedoms of individuals, and represent an added value to the applicable regulations, must be approved by the supervisory authority.
Farmaindustria is the National Business Association of the Pharmaceutical Industry that brings together most of the innovative pharmaceutical companies established in Spain, which accounts for almost all of the sales of prescription drugs under patent in Spain. This new code of Farmaindustria that replaces and adapts the previous one, of 2009, to the current regulation is a step forward in the protection of the data of those who participate and intervene in the activities that it regulates, and will serve to strengthen clinical research and pharmacovigilance.
The target area of application of the code is the processing of personal data in the framework of clinical investigations in general, and clinical trials in particular, as well as those linked to compliance with the obligations imposed by the current pharmacovigilance regulations for the detection and prevention of adverse effects of medicinal products already placed on the market. In the case of clinical trials, it establishes protocols that facilitate the application of the GDPR and offers security to the entities that adhere. These include: the application of data protection principles, impact assessment, data coding, the responsibility of the various participants in a trial, the legitimising bases of the treatments, the regime for international data transfers, obligations arising from security breaches and the exercise of rights.
As regards pharmacovigilance, the code distinguishes between the processing of personal identifiable and coded data, establishing protocols for the collection of information on possible adverse reactions depending on the notifier and the different reporting channels, including social networks.
In addition, the code establishes a voluntary and free mediation procedure, which allows for an expeditious response to possible claims made by interested parties against the affiliated entities.
The GDPR states that all codes of conduct must designate a supervisory body that acts with full independence from both the promoter of the code and the acceding entities, and that it must be accredited by the supervisory authority. In this case, the AEPD has accredited as a body for the supervision and control of the code to the Governing Body of the Code of Conduct (OGCC). The internal OGCC shall be completely independent in the performance of its tasks.
The director of the Spanish Data Protection Agency, Mar España, stressed the importance of the approval of this code of conduct as “a sample of the instruments offered by data protection regulations to promote research in the field of health, guaranteeing the right to data protection of participants”.
For Humberto Arnés, CEO of Farmaindustria, the approval of the new code “represents a further demonstration of the commitment of the Spanish pharmaceutical industry to transparency and respect for the fundamental rights of citizens in the processing of personal data”. “Scientific research in general, and biomedical research in particular, are activities in the public interest, given the benefits they bring to society as a whole. For this reason, the processing of personal data for scientific research purposes, both in the public and private spheres, and in particular in the framework of clinical trials, should be approached from a responsible perspective, so this code is a valuable tool that makes it easier for companies to properly comply with their personal data protection obligations in these areas”.
Barcelona, 31.05.2022 | Download PDF ⬇️