Please login to the form below

How will new data protection law affect pharma?

Sarah Eglington, of Wilmington Healthcare, explores how GDPR will change pharma’s relationship with healthcare professionals

Introduction
 

A new European law, known as the General Data Protection Regulation (GDPR), will come into effect on May 25, changing the way that data is held and processed, and threatening heavy fines for non-compliance.   For pharma companies that are fully compliant with the robust data protection laws currently in place, the changes they need to make for GDPR are likely to be minimal. However, significant challenges lie ahead for those with poor data management practices.  

What will change under GDPR?
 

Changes to the law generally result from dissatisfaction, or a plea for change from the masses. Transparency and the individual’s right to control how and where their personal data is used are central to GDPR.  

The responsibility for data protection compliance currently lies with the individual company that holds or uses the data, regardless of whether it purchased that data under licence from a supplier like Wilmington Healthcare, or generated it from its own list of contacts.  

This will remain the same under GDPR. However, companies will also have to define the legal basis on which they are holding or using the data; the relevance of their product or service to an individual on the database and the purpose of their communications to that person.  

Although companies will not be allowed to hold data on people unless it is relevant to their business, there is some leeway in terms of how they can justify an individual’s inclusion on a database under GDPR, since it allows companies to have multiple legal bases for holding or processing data for different purposes. These range from consent from the individual where applicable, to potentially a legal or public interest reason to provide certain information like regulatory updates based on the healthcare professional’s role as a prescriber.  

A lot of pharma companies and data providers are processing healthcare professional data on the legal basis known as legitimate interest. Under GDPR, legitimate interest means an organisation has an unambiguous reason to hold someone’s information on its database, but it hasn’t necessarily obtained their consent. In such circumstances, it is good practice to send out an information notice to the individual, informing them that they are on a particular database, why and for what purpose, and giving them an opportunity to opt out if they wish.    

How can companies prepare for GDPR?


We recommend that companies conduct a data audit and profile their data to define how it is used for sales and marketing purposes. Companies must be prepared to be ruthless when it comes to deleting information that is not relevant to their purpose or business. They must also have a single point of access for their database.  

The next step is to define the legal basis for processing data e.g. consent, legitimate interest, vital interest, legal obligation or public task. Companies then need to inform data subjects of the information held, legal basis, purpose and how to opt-out either through an information notice, a data protection notice on a communication, a notice of change of terms on a website or other appropriate means.  

Other important tasks to ensure compliance include defining the company’s data protection approach and its data protection policy. GDPR statements and processes should be documented and companies must produce a privacy impact assessment. If they are processing under legitimate interest, they must complete a legitimate assessment too, which defines their basis for processing under that definition using a necessity and balancing test.

It is important for companies to ensure they have a nominated data protection officer – in a smaller company this will be the CEO or equivalent. They must also brief and train their staff, so they are aware and aligned. This is absolutely vital to ensure compliance, and we are currently writing a training course to guide companies through the process.  

On the issue of staff, the biggest data protection risk for pharma companies is sales representatives taking their own lists from databases. Restricting access to the database is, therefore, key to minimise a breach. To counter this, some companies are even writing rules on database use into employment contracts.

Companies should keep records of their approach to GDPR and how they have prepared for it. Pharma must also be prepared to respond in the event of an access request or complaint from a data subject, or with regards to a GDPR breach.  

On an ongoing basis, good database management is absolutely essential. So, if, for example, an HCP has asked to be removed from a database, this must be recorded to ensure that person is not accidentally contacted again.  
 
Conclusion  

While the work required to comply with GDPR may seem arduous to some, we must not lose sight of the purpose of this new legislation. Ultimately, HCPs and other individuals want more control over their personal data. Respecting their rights in this regard is key to building deeper and more meaningful relationships with them; relationships that put quality, ahead of quantity, and create genuine value for both parties.  

                                                                        Ends
 

Sarah Eglington is Client Services Director at Wilmington Healthcare. For information on Wilmington Healthcare, log on to
www.wilmingtonhealthcare.com

2nd May 2018

Share

Company Details

Wilmington Healthcare

01268 495600

Contact Website

Address:
Beechwood House
2-3 Commercial Way
Christy Close
Southfields
Basildon
SS15 6EF
United Kingdom

Latest content on this profile

New local NHS models help to deliver integrated care
Steve How, of Wilmington Healthcare, explains how health and social care groups are uniting within ‘neighbourhoods’
Wilmington Healthcare
Wilmington Healthcare adds innovative new features to its digital learning platform for pharma and medtech
Healthcare intelligence provider Wilmington Healthcare has introduced a host of new features to its unique digital learning platform, which enables pharma and medtech sales staff to keep abreast of NHS developments, policies and constraints.
Wilmington Healthcare
HSJ Awards Finalists Announced
2018 HSJ Awards Finalists Announced.
Wilmington Healthcare
HSJ Partnership Awards will showcase pharma’s inspirational joint working projects with the NHS
Health Service Journal (HSJ), the news and information service for all healthcare leaders working in, for, or with the NHS, has expanded and enhanced its Partnership Awards for 2019.
Wilmington Healthcare
How can pharma engage with key stakeholders on NHS service transformation?
Steve How, Paul Midgley and Oli Hudson, of the Wilmington Healthcare consulting team, explain how pharma should make its case for change
Wilmington Healthcare
Wilmington Healthcare wins first client for new NHS transformation tracker
Product helps pharma identify opportunities and tailor solutions to a changing NHS
Wilmington Healthcare