Data Protection Support for Life Sciences Companies

Many businesses have looked for legal support on data protection issues over the past few years, but life science companies’ needs are more specialised than most. It is important to ensure that you have the support you require and that your life science organisation’s need for effective and compliant data protection does not hinder the progress of your research.

The data protection regime in the UK is onerous enough, but if you are also operating in Europe and/or the US then there are a host of other data issues to consider.

Data protection requirements are developing rapidly in many non-European jurisdictions. Different jurisdictions have different requirements, and these need to be taken into account in clinical trials and related projects.

Who are you working with and what are the implications for how you collect, process, share and retain data? Do you work with contract research organisations (CROs)? Are you working with overseas authorities? Are you working with the National Health Service (NHS) in the UK?

Do you have appropriate and legally compliant arrangements for transferring data around sites internationally and do you have the right processor agreements in place?

All businesses hope that they will avoid data protection breaches, but we all know they do happen from time to time, and sometimes in companies that you might expect to be fully protected. Sometimes this is about systems; in others it is about human error. The intellectual property held by life sciences companies also mean that they are a good target for cyber attacks. So effective data protection regimes involve ensuring you have the most appropriate systems and agreements in place and also that all your employees understand what they need to do to protect your data and the seriousness of not doing so – in whichever country they are based.

Prettys’ specialist data protection life sciences team advises organisations on these issues among many others.

You will probably already know what you want to achieve with your product. Are you looking to take it to market yourself, planning a joint venture or looking to sell to a more established operator?

What stage are you at with your clinical trials and do you already have people signed up to participate? If so, what approach have you taken to data protection so far?

The answer to these questions will influence the data protection strategy that you should put in place now in order to future-proof your business.

This is likely to have a major impact on the steps needed to protect both the data and your business.

For instance, the data that researchers might collect in relation to exploring new prosthetic limb development options would be entirely different, with potentially very different sensitivities, to developing a product designed to treat a mental health condition.

One of the standard considerations around data retention is how long you will need the data for and how long you are entitled to keep it.

• If you are undertaking a long clinical trial then you will anyhow need to keep the data for the duration of the trial.
• Are you likely to embark on other research for which the data could also be used if you have the right permissions in place?
• Have you considered what is required for long-term liability protection?

Prettys’ specialist life sciences data team – led by Matthew Cole – advises organisations in the life sciences sector on data retention issues and helps to ensure that they are legally compliant with a data protection strategy fit for purpose, and that takes into account the particular characteristics of this sector.

Depending on the data you are collecting, you will probably have looked at the vulnerability of your participants and, hopefully, be ensuring that you are treating the data appropriately.

However, there can be misunderstandings about the need for
informed consent when people are taking part in research for clinical purposes. For example, what happens if participants decide to withdraw from a trial and how do you deal with vulnerable subjects?

Do you have an informed consent regime which is independent of your other data protection requirements? It is a common misunderstanding to think that if you have an informed consent regime that is compliant then data protection boxes are also being ticked but this is not necessarily the case and you should review the position and put in additional procedures as necessary.

Research into gene therapies is a new but growing area, which has considerable implications for data protection. Are you fully geared up to deal appropriately with these?

Approaches to the appointment or recruitment of a Data Protection Officer (DPO) vary widely, often depending on the size, geographical spread and complexity of a business.

Smaller, entrepreneurial life science businesses have often only just started to address their data protection issues in a formal way and are effectively looking for a cost-effective outsourced solution to ensure they have all the systems in place that they need and are fully compliant.

Larger companies may have recruited an experienced Data Protection Officer with knowledge of the sector who just needs a very small amount of external legal support to ensure full compliance with any new rules. Or they may need advice as you extend your research into new overseas markets.

The specialist life science data protection team at Prettys works to support businesses in both of these situations.

Most data protection training is currently done online. There are, inevitably, many providers. Working through the maze of who will give the most appropriate data protection training to your staff in the most cost-effective way can be time consuming. We have helped a number of organisations with this exercise and would be happy to help you review and enhance your data protection training if this is something your life science business needs.

Have you reached a point at where you know that there may be data protection issues in relation to some aspects of your research projects which haven’t yet been addressed? Or are you happy that the data protection measures you have in place may be fine now, but may not be suitable for the direction in which you expect your business to go over the next few years? You may have questions around some of the following areas.

• Are we treating all the personal data that we hold in an appropriate way for the type of data that it is? For example, do you have clinical data which may have
  particular value, or interest or sensitivity?
• Are our arrangements for transferring data around sites internationally appropriate and do we have the right processor agreements in place?
• If we are working with sites around Europe, are we adhering to the different rules imposed by different countries alongside GDPR?
• If we have investigators running study sites, do we have the correct approach and agreements in place relating to whether they are joint controllers, controllers or processors of the data?
• Are we dealing with the right supervisory authorities overseas?

We would be happy to offer a free initial exploratory meeting with our lead specialist solicitor to start to identify some of the issues you may have and how we might help to resolve them or to future-proof your approach. Our physical offices are in Ipswich but we have clients throughout the UK and now conduct most of our meetings virtually.

In recent years we have advised growing companies on a wide range of aspects of data protection best practice and compliance. They are happy to recommend us because of our practical approach and our accessibility.

They also like the fact that we can price our services more cost-effectively than many other legal advisers in this niche simply because we are based in East Anglia rather than in London or another major city and so have lower overheads.

To arrange your initial scoping meeting with our lead data protection life science team, to identify your current position and needs in relation to data protection, please contact dataprotection@prettys.co.uk or call on 01473 232 121.