Gail Crawford

Partner, Latham & Watkins

Gail Crawford is a partner in the London office and Global Chair of Latham’s Data & Technology Transactions Practice and Co-Chair of Latham's Privacy & Cyber Practice. Her practice focuses primarily on technology, intellectual property and commercial law and includes technology and Intellectual Property licensing agreements, joint ventures, technology procurement, outsourcing and advising on data protection, e-commerce and consumer protection legislation. Ms. Crawford is an editor of the Latham & Watkins Global Privacy & Security Compliance Law Blog (www.globalprivacyblog.com) and has contributed to a number of publications and conferences in the area of data privacy and security. Ms. Crawford has previously spent time working in-house on secondment to Diageo where she created the information technology and outsourcing legal function and was the legal lead on the project to transform and outsource Diageo's finance and accounting processes on the back of the company's SAP roll-out in more than 45 countries. She has also worked on secondment with the information technology and operations function of the Lloyds Banking Group. Ms. Crawford has been named to BTI Consulting Group’s 2022 Client Service All-Star List, and ranked as a Leading Individual for Data Protection, Privacy, and Cybersecurity in the

Legal 500 UK 2019-2022.

Contributed to

1

Digital health—data protection and privacy case studies

Practice Notes

This Practice Note examines data protection considerations in relation to digital health. It first explains the general concept of digital health, which encompasses mHealth, mobile apps, telemedicine, machine learning, etc, and provides some background on the increasing use of digital health solutions in the life sciences sector. It also provides an overview of the regulatory authorities and key stakeholders in different jurisdictions: EU, UK, France and Germany. This Practice Note then analyses the data protection challenges posed by digital health through three different case studies, covering a wide range of digital health technology applications: wearables (ie devices that remotely monitor patients in real time in non-clinical environments to improve patient care and medical diagnosis), artificial intelligence (AI) diagnostic tools (ie AI tool which analyses mammograms and radiology images to predict diagnosis) and digital health records (ie medical software). Key concepts of applicable data protection laws, including the General Data Protection Regulation (GDPR), are examined through these case studies: role of the relevant parties (controller, processor or joint controller of personal data), applicable legal basis, transparency, accuracy, anonymisation, special category data, secondary use of personal data, security, data transfers, data hosting, data subject rights, and cookies.

Life Sciences