Europe Moves to the Next Level in Protecting Personal Data – The GDPR & Research

As cross-border business and technology advances, the European Union’s need to address data privacy protection continually rises. The General Data Protection Regulation will soon be enforceable and undoubtedly will have impact on how pharmaceutical and medical device companies conduct clinical trials and research studies. This article reviews key updates for companies to consider for their clinical trials and research functions as the May 25, 2018 enforcement date approaches.

After four years of discussion, the European Parliament adopted the European Union (“EU”) General Data Protection Regulation (“GDPR”) in April 2016. With an enforcement date starting May 25, 2018, the GDPR will replace the current Directive implemented in 1995 and will be applicable to Member States. As an EU-wide regulation, the GDPR introduces a single set of rules to allow for consistent data protection standards and enforcement.

While the GDPR preserves the core principles of the Directive, it also introduces clearer and broader definitions, increased data subject rights, and significant penalties for non-compliance (i.e., up to 4% of annual worldwide turnover or €20 million, whichever is higher). Considering that life science companies handle a large amount of personal information such as customer data, patient details, and marketing intelligence, the GDPR introduces significant new compliance obligations.