A stricter regime for profiling07 June 2016
Reflections from Brussels on the Mexico City DPA Conference
This entry comes from Elisabethann Wright, a Partner in our Brussels Office, who presented at the 33d International Congress of Data Protection and Privacy Commissioners in Mexico City last week. Elisabethhann focuses on EU law relating to life sciences, with particular emphasis on pharmaceutical law, medical devices, food law, and the environment. In Mexico, she drew upon her experience assisting clients in clinical trial agreements, adverse event reporting, product withdrawals and challenges to national authority and EU Institution decisions concerning classification and marketing of medicinal products and medical devices.
At the Mexico City gathering of international Data Commissioners, officials from a number of EU Member States expressed disappointment at the low levels of compliance with their data privacy obligations demonstrated by data controllers in their territory. One Data Commissioner estimated that a depressing 95% of data controllers failed to comply with their obligations.
One consequence of this failure will be an apparent change in approach by Data Commissioners. While Commissioners and their officials previously have sought to advise and support data controllers in understanding and fulfilling their role and obligations, the future approach, influenced at least in part by the ambivalence displayed by data controllers, will focus on compliance. Several Commissioners expressed an intention to make enforcement of obligations their priority in the future.
The possibility of a single approach to the protection and use of data generated in relation to clinical trials was the subject of my panel during the Congress. Similarities of approach evidently exist between territories in relation to some aspects of data privacy in clinical trials. This includes the nature and content of patient informed consent forms. However, the suitability of basing secondary investigation on initial informed consent varies widely, as do the restrictions imposed on transfer of clinical data from one territory to another. The possibility that a single acceptable approach to these issues could be found was discussed. However, the general consensus was that, at least from a legislative perspective, a single approach is unlikely to evolve in the near future.
Among the snippets of information demonstrating the evolution of official approaches to data collection that I gathered from the Congress was the fact that, when Neil Armstrong brought back soil and rock samples from the moon in 1969, he was required to complete an import form to bring them on to US territory. “One large step for mankind but still subject to regulation." Future uses of data to benefit mankind likely will be met with similar regulation, and as it appears from the comments of regulators meeting in Mexico, disregard and non-compliance will increasingly be met with enforcement.
The Regulation aims to strengthen the rights of individuals. It does so by retaining rights that already exist under the Data Protection Directive and introducing the new rights of data...06 June 2016
Grounds for processing03 June 2016