UK ABPI transfer of value disclosures: transitioning from consent to legitimate interests

Approach to transfers of value disclosures

Collaboration between pharmaceutical companies and healthcare organisations (HCOs), doctors, nurses, pharmacists, and other health professionals (HCPs) is critical to medical innovation and patient care. Equally, it is important that such cooperation is carried out in a way that ensures transparency, builds trust, and drives high ethical standards  in the industry.

Against this background, all members of the Association of the British Pharmaceutical Industry (ABPI) and any pharmaceutical company that voluntarily follows the ABPI’s Code of Practice are required to disclose annually Transfers of Value (ToV) – certain payments and benefits in kind – made to HCPs, HCOs and other relevant decision makers (ORDM) they work with. Such disclosures are made via Disclosure UK, an industry-led initiative administered by the ABPI to increase transparency.

When making such ToV disclosures, pharmaceutical companies are required to disclose HCPs’ personal data (name and practice address against the value received), and they need to choose a lawful basis before they do so. Historically, the standard approach has been for pharmaceutical companies to obtain HCPs’ consent for individual ToV disclosures. The disclosure rate fluctuates but the estimated percentage of HCPs agreeing to be named on Disclosure UK was 68% in the most recent data for 2020 and, in some years, the rates have been substantially lower (e.g. only 49% in 2017).

Not only is it administratively burdensome for pharmaceutical companies in terms of the process for obtaining consents and maintaining lists of those HCPs that do/don’t consent/withdraw consent, but it is also challenging for companies to comply with the high standards for UK GDPR consent (i.e. consent must be freely given, specific, informed, and indicated by an unambiguous affirmative statement or action signifying agreement).

From consent to legitimate interests

The industry is considering alternative ways to increase disclosure rates, and a growing number of pharmaceutical companies have already adopted or are considering adopting “legitimate interests” as the lawful ground for making ToV disclosures under the ABPI Code. For example, as of disclosure June 2022, Norway expects 100% disclosure due to use of legitimate interests as the lawful basis for disclosure of 2021 data.

Whilst the possibility of relying on legitimate interests has not been formally introduced in the UK, the recently published ABPI Privacy Notice – Disclosure refers to legitimate interests as one of the grounds that are most likely to be relied on by pharmaceutical companies to disclose the data to the ABPI through Disclosure UK. The ABPI has also produced a factsheet which explains legitimate interests in further detail and has communicated to its members that the ABPI “should now strongly encourage companies to begin relying on Legitimate Interests for HCP disclosure”. The ABPI acknowledges that “this is the single most impactful step we can take to further increase the transparency available through Disclosure UK”.

Practical steps

Whilst a pharmaceutical company relying on legitimate interest no longer needs to ask for permission from HCPs to disclose personal data, there are certain steps that need to be taken to switch to legitimate interests as the lawful basis for making such disclosures, namely:

• Conduct a legitimate interest assessment (LIA). This is a risk assessment that will document the company’s balancing of its legitimate interests against the individual data rights of the HCPs. The ICO’s LIA template can be found here.
• Update the privacy notice to explain that the company relies on legitimate interests in connection with ToV disclosures. The privacy notice should also inform the HCPs of their right to object (or opt out) to the processing of their data on this basis, and the updated notice should be issued sufficiently ahead of when the disclosures will be made to provide the HCPs with a reasonable period of time to exercise their right to opt out.
• Set up a process to adequately handle objection requests.

Risks to consider

In considering whether to switch from consent to legitimate interests, pharmaceutical companies should consider the following risks:

• The ICO may not agree with the conclusion reached in a company’s LIA – i.e. that its legitimate interests override the HCPs’ individual data rights. This could lead to regulatory action for the lack of a lawful basis for processing. However, if a LIA is properly conducted and additional safeguards have been considered to mitigate the impact (where necessary), the risk of regulatory action on this basis is likely to be low.
• Article 29 Working Party guidance on consent and ICO guidance on lawful basis for processing suggest that retrospectively switching lawful basis from consent to legitimate interest should be avoided, as this might be seen as fundamentally unfair to individuals. For new HCPs from whom data is being collected for the first time or with whom a new agreement is entered into, the risk here is negligible given they will be informed by the updated privacy notice that their data will be processed on the lawful basis of legitimate interest and that they have the right to object. However, this is a material risk for companies which seek to switch lawful basis from consent to legitimate interest for existing HCPs from whom they have already collected data and so the timing of any switch should be considered carefully.
• There is a risk that objection requests may not be handled adequately. Though an individual’s right to object is not an absolute right, a company may ultimately have to decide not to publish the HCP’s personal data if its legitimate interests are overridden by the interests, rights and freedoms of the HCP.

What's next?

Further guidance on legitimate interests in relation to ToV disclosures is expected from the ABPI later this year.

Authored by Bonella Ramsay, Paula Garcia, and Josh Stickland, a trainee in our London office.