Protection Of Personal Data Within The Scope Of Pharmacovigilance Activities

The Regulation on the Monitoring and Evaluation of the Safety of Human Medicinal Products (“Regulation”) aims to take the necessary measures for monitoring adverse reactions, collecting information on this matter, recording, evaluating and archiving in order to ensure the safety of drugs. According to the Regulation, an adverse effect refers to a harmful and unintended effect that occurs in the use of a human medicinal product. Pharmacovigilance, on the other hand, is “the activities and scientific studies carried out for the detection, evaluation, understanding and prevention of adverse reactions and other drug-related problems”. Accordingly, marketing authorization holders keep the records of the adverse effects reported to them in order to detect and evaluate adverse effects within the scope of pharmacovigilance activities, archive them and notify the Turkish Pharmacovigilance Center (“TPC”) within fifteen days at the latest following the receipt of the said information.

Records kept within the scope of pharmacovigilance activities include health data defined as “special categories of personal data”. The obligations of the data controllers who process these data on issues such as how these records will be retrieved and how they will be stored are also related to the Personal Data Protection Law (“PDPL”). At the same time, the Guide on the Protection of Personal Data within the Scope of Pharmacovigilance Activities issued by the Turkish Medicines and Medical Devices Agency (“TMMDA”) regulates the guidelines and rules regarding the processing of personal data in Pharmacovigilance activities.

In accordance with the PDPL, the explicit consent of the person concerned is required for the processing special categories of personal data. Express consent is the consent that is based on information and expressed with free will on a specific subject. Explicit consent is not required to be obtained in written form within the scope of PDPL, but it is possible to obtain it through electronic media and call centers.

However, if the special categories of personal data is processed within the scope of the protection of public health or the execution of preventive medicine activities, it is not obligatory to obtain the explicit consent of the data subject according to PDPL 6/3. Whether express consent is required for recording the interviews within the scope of pharmacovigilance activities is related to whether the processed data is special categories of personal data and whether there is an exception under article 6/3 of the PDPL.

It has been explained above that the marketing authorization holders are routinely obliged to collect data within the scope of pharmacovigilance activities. In order to analyze the data effectively in the reporting of adverse reactions, data such as age/age group, gender, weight, height, medical history and current status of the patient are recorded.

According to the guideline, pharmacovigilance activities are considered as activities carried out for the purposes of preventive medicine and protection of public health within the scope of PDPL. Accordingly, it is concluded that there is no need to seek the explicit consent of the data subject in the processing of special categories of personal data within the scope of pharmacovigilance activities. However, attention should be paid to the procedures and principles that must be followed while processing these data.

Although the explicit consent of the data subject is not required, the obligations of data controllers within the scope of PDPL continue. Accordingly, pursuant to article 10 of the PDPL, the data subjects should be informed about the purpose for which their data will be processed, who the data controller is, for what purpose the data can be transferred, the method and legal reason for data collection, and what rights the data subject has in accordance with article 11 of the PDPL. It should not be forgotten that this lighting text should be prepared in accordance with the provisions of the Communiqué on the Procedures and Principles to be Complied with in Fulfilling the Clarification Obligation.

Based on this requirement, the Guide also published sample data protection clarification texts on the website, on the phone, face-to-face, in digital media or in the follow-up of pharmacovigilance data. You can review the relevant texts here.

Apart from the obligation to inform, data controllers are obliged to take all necessary measures to ensure the appropriate level of security in order to prevent the unlawful processing of personal data, prevent unlawful access to personal data, and ensure the preservation of personal data, pursuant to article 12 of the PDPL.

In addition, according to article 4/2 of the PDPL, personal data should be related to the purpose for which they are processed, limited and measured, and should be kept for as long as required by the legislation or for the purpose for which they are processed. Therefore, marketing authorization holders should be able to justify why they should keep the data they process. This justification is given in article 28 of the Regulation on the Safety of Medicines. Accordingly, pharmacovigilance data and documents related to drugs should be kept as long as the drug’s license remains valid and for at least 10 years after the validity of the license expires.

CONCLUSION

The procedures and principles of processing personal data within the scope of pharmacovigilance activities are determined within the scope of the Guide issued by TMMDA, in addition to PDPL and related secondary regulations. Since the data collected within the scope of pharmacovigilance activities are considered as data processed within the scope of public health protection and preventive medicine activities regarding article 6/3 of the PDPL, the explicit consent of the data owner is not required. However, other obligations of the data controller pursuant to PDPL should be considered.

REFERENCES

https://titck.gov.tr/storage/Archive/2019/legislation/4a4c741b-cb54-4f1b-b504-44783cdfdfbc.pdf

https://www.kvkk.gov.tr/Icerik/2037/Acik-Riza-Alirken-Dikkat-Edilecek-Hususlar  

https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=19578&MevzuatTur=7&MevzuatTertip=5 

https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5 

https://www.resmigazete.gov.tr/eskiler/2005/03/20050322-7.htm