a.    Application of EU Member State Laws or the Privacy Shield Principles
  • i.    EU Member State law applies to the collection of the personal data and to any processing that takes place prior to the transfer to the United States.  The Privacy Shield Principles apply to the data once they have been transferred to the United States.  Data used for pharmaceutical research and other purposes should be anonymized when appropriate. 
b.    Future Scientific Research
  • i.    Personal data developed in specific medical or pharmaceutical research studies often play a valuable role in future scientific research.  Where personal data collected for one research study are transferred to a U.S. organization in the Privacy Shield, the organization may use the data for a new scientific research activity if appropriate notice and choice have been provided in the first instance.  Such notice should provide information about any future specific uses of the data, such as periodic follow-up, related studies, or marketing.  
  • ii.    It is understood that not all future uses of the data can be specified, since a new research use could arise from new insights on the original data, new medical discoveries and advances, and public health and regulatory developments.  Where appropriate, the notice should therefore include an explanation that personal data may be used in future medical and pharmaceutical research activities that are unanticipated.  If the use is not consistent with the general research purpose(s) for which the personal data were originally collected, or to which the individual has consented subsequently, new consent must be obtained.
c.    Withdrawal from a Clinical Trial
  • i.    Participants may decide or be asked to withdraw from a clinical trial at any time.  Any personal data collected previous to withdrawal may still be processed along with other data collected as part of the clinical trial, however, if this was made clear to the participant in the notice at the time he or she agreed to participate. 
d.    Transfers for Regulatory and Supervision Purposes
  • i.    Pharmaceutical and medical device companies are allowed to provide personal data from clinical trials conducted in the EU to regulators in the United States for regulatory and supervision purposes.  Similar transfers are allowed to parties other than regulators, such as company locations and other researchers, consistent with the Principles of Notice and Choice.
e.    “Blinded” Studies
  • i.    To ensure objectivity in many clinical trials, participants, and often investigators as well, cannot be given access to information about which treatment each participant may be receiving.  Doing so would jeopardize the validity of the research study and results.  Participants in such clinical trials (referred to as “blinded” studies) do not have to be provided access to the data on their treatment during the trial if this restriction has been explained when the participant entered the trial and the disclosure of such information would jeopardize the integrity of the research effort.  
  • ii.    Agreement to participate in the trial under these conditions is a reasonable forgoing of the right of access.  Following the conclusion of the trial and analysis of the results, participants should have access to their data if they request it.  They should seek it primarily from the physician or other health care provider from whom they received treatment within the clinical trial, or secondarily from the sponsoring organization.
f.    Product Safety and Efficacy Monitoring
  • i.    A pharmaceutical or medical device company does not have to apply the Privacy Shield Principles with respect to the Notice, Choice, Accountability for Onward Transfer, and Access Principles in its product safety and efficacy monitoring activities, including the reporting of adverse events and the tracking of patients/subjects using certain medicines or medical devices, to the extent that adherence to the Principles interferes with compliance with regulatory requirements.  This is true both with respect to reports by, for example, health care providers to pharmaceutical and medical device companies, and with respect to reports by pharmaceutical and medical device companies to government agencies like the Food and Drug Administration.
g.    Key-coded Data
  • i.    Invariably, research data are uniquely key-coded at their origin by the principal investigator so as not to reveal the identity of individual data subjects.  Pharmaceutical companies sponsoring such research do not receive the key.  The unique key code is held only by the researcher, so that he or she can identify the research subject under special circumstances (e.g., if follow-up medical attention is required).  A transfer from the EU to the United States of data coded in this way would not constitute a transfer of personal data that would be subject to the Privacy Shield Principles.