Latham & Watkins

This Practice Note examines data protection considerations in relation to digital health. It first explains the general concept of digital health, which encompasses mHealth, mobile apps, telemedicine, machine learning, etc, and provides some background on the increasing use of digital health solutions in the life sciences sector. It also provides an overview of the regulatory authorities and key stakeholders in different jurisdictions: EU, UK, France and Germany. This Practice Note then analyses the data protection challenges posed by digital health through three different case studies, covering a wide range of digital health technology applications: wearables (ie devices that remotely monitor patients in real time in non-clinical environments to improve patient care and medical diagnosis), artificial intelligence (AI) diagnostic tools (ie AI tool which analyses mammograms and radiology images to predict diagnosis) and digital health records (ie medical software). Key concepts of applicable data protection laws, including the General Data Protection Regulation (GDPR), are examined through these case studies: role of the relevant parties (controller, processor or joint controller of personal data), applicable legal basis, transparency, accuracy, anonymisation, special category data, secondary use of personal data, security, data transfers, data hosting, data subject rights, and cookies.

This Practice Note deals with pharmacovigilance. It sets out the EU regulatory framework and discusses the role of the Pharmacovigilance Risk Assessment Committee (PRAC), EudraVigilance and the guidelines on good pharmacovigilance practices (GVPs). It then takes a more detailed look at the pharmacovigilance processes and requirements set out in the GVP modules, including: how to establish a pharmacovigilance system, the qualified person responsible for pharmacovigilance (QPPV), the pharmacovigilance system master file (PSMF), pharmacovigilance inspections, pharmacovigilance audits, periodic safety update reports (PSURs), and post-authorisation safety studies (PASS). The Practice Note then considers non-compliance with pharmacovigilance requirements, data protection considerations, and outsourcing pharmacovigilance activities.

This Practice Note provides an overview of the EU protection mechanisms and incentives for medicinal products, known as pharmaceutical incentives. They include the supplementary protection certificates (SPCs), regulatory data protection and market protection, market exclusivity for orphan medicinal products and the incentives for paediatric medicines. This Practice Note also discusses how the pharmaceutical incentives interact in practice and the proposals for a review of their regime.

This Practice Note deals with pharmacovigilance. It sets out the EU and UK regulatory framework and discusses the role of the Pharmacovigilance Risk Assessment Committee (PRAC), EudraVigilance and the guidelines on good pharmacovigilance practices (GVPs). It then takes a more detailed look at the pharmacovigilance processes and requirements set out in the GVP modules, including: how to establish a pharmacovigilance system, the qualified person responsible for pharmacovigilance (QPPV), the pharmacovigilance system master file (PSMF), pharmacovigilance inspections, pharmacovigilance audits, periodic safety update reports (PSURs), and post-authorisation safety studies (PASS). The Practice Note then considers non-compliance with pharmacovigilance requirements, data protection considerations, and outsourcing pharmacovigilance activities. Finally, it discusses pharmacovigilance in the UK and the role of the Medicines and Healthcare products Regulatory Agency (MHRA).

This Practice Note looks at Regulation (EU) 536/2014, the EU Clinical Trials Regulation (CTR), which governs clinical trials in the EU. It discusses the key aspects of the CTR that clinical trial sponsors and pharmaceutical companies must be aware of.

This precedent clause is designed to incorporate module four (processor to controller) of the EU Standard Contractual Clauses (also known as the Model Clauses or SCCs) introduced by Commission Implementing Decision (EU) 2021/914 (the 2021 EU SCCs) for the transfer of personal data from a data processor subject to the EU’s General Data Protection Regulation (EU) 2016/679 (EU GDPR) to a data controller outside the EEA that is not subject to the EU GDPR.

This precedent clause is designed to incorporate module one (controller to controller) of the EU Standard Contractual Clauses (also known as the Model Clauses or SCCs) introduced by Commission Implementing Decision (EU) 2021/914 (the 2021 EU SCCs) for the transfer of personal data from a data controller subject to the EU’s General Data Protection Regulation (EU) 2016/679 (EU GDPR) to a data controller outside the EEA that is not subject to the EU GDPR.

This precedent clause is designed to incorporate module three (processor to processor) of the EU Standard Contractual Clauses (also known as the Model Clauses or SCCs) introduced by Commission Implementing Decision (EU) 2021/914 (the 2021 EU SCCs) for the transfer of personal data from a data processor subject to the EU’s General Data Protection Regulation (EU) 2016/679 (EU GDPR) to a data processor outside the EEA that is not subject to the EU GDPR.

This precedent clause is designed to incorporate module two (controller to processor) of the EU Standard Contractual Clauses (also known as the Model Clauses or SCCs) introduced by Commission Implementing Decision (EU) 2021/914 (the 2021 EU SCCs) for the transfer of personal data from a data controller subject to the EU’s General Data Protection Regulation (EU) 2016/679 (EU GDPR) to a data processor outside the EEA that is not subject to the EU GDPR.

This precedent provides provisions for the parties to an agreement to incorporate an addendum approved by the UK’s Information Commissioner’s Office (ICO) as a transfer mechanism for the transfer of personal data from a UK processor to a controller outside the UK that is not subject to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR).

This precedent provides provisions for the parties to an agreement to incorporate an addendum approved by the UK’s Information Commissioner’s Office (ICO) as a transfer mechanism for the transfer of personal data from a controller subject to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) to a controller outside the UK that is not subject to the UK GDPR.

This precedent provides provisions for the parties to an agreement to incorporate an addendum approved by the UK’s Information Commissioner’s Office (ICO) as a transfer mechanism for the transfer of personal data from a processor that is subject to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) to a processor outside the UK that is not subject to the UK GDPR.

This precedent provides provisions for the parties to an agreement to incorporate an addendum approved by the UK’s Information Commissioner’s Office (ICO) as a transfer mechanism for the transfer of personal data from a controller that is subject to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) to a processor outside the UK that is not subject to the UK GDPR.