{"id":1459,"date":"2015-11-04T19:18:26","date_gmt":"2015-11-04T18:18:26","guid":{"rendered":"https:\/\/blogdelarechercheclinique.com\/?p=1459"},"modified":"2024-05-23T09:22:47","modified_gmt":"2024-05-23T07:22:47","slug":"invalidation-safe-harbor","status":"publish","type":"post","link":"https:\/\/blogdelarechercheclinique.com\/en\/invalidation-safe-harbor\/","title":{"rendered":"Invalidation of Safe Harbor, what to do?"},"content":{"rendered":"

Invalidation of Safe Harbor, what to do?<\/p>\n

\"PersonalYou have studies underway and you transfer some information in the US, either the promoter or subcontractors (eCRF, CRO, patient reimbursement, or other)? Did you know that the trade agreement between the European Economic Area and the United States had been invalidated and that personal data transfers made under the Safe Harbor framework were not allowed? Here concretely what this means for your tests.<\/p>\n

<\/p>\n

1. What happened?<\/strong><\/h2>\n

The Safe Harbor was one of the possible means for US companies to legally transfer the European Economic Area data to the United States. The Safe Harbor was a set of principles to be respected to which US companies adhered voluntarily. These principles were based on people information, the opportunity to oppose the transfer of a\u00a0personal data or the use of his data for a different purpose, the need for explicit consent for so-called sensitive data, right access and correction and data security. The list of companies that have joined the Safe Harbor was available on the website of the US Department of Commerce<\/a>. However, the European Court of Justice (ECJ) has invalidated this agreement on October 6, 2015. In fact, it was highlighted by the ECJ that US public authorities could access data without ensuring effective legal protection to concerned persons. Indeed, US companies are required to comply with the requirements of US laws and therefore not to apply the provisions of the Safe Harbor that are opposite\u00a0to them. The National Commission for Data Protection and Liberties (CNIL-France)<\/u> and its European counterparts (G29) came together and asked the European institutions and the governments concerned to find legal and technical solutions before January 31, 2016. Here are the two releases of the CNIL-France on it here<\/a> and there<\/a>.<\/p>\n

2. Prohibition of personal data\u00a0transfer<\/strong><\/h2>\n

According to Articles 68 and 69 of the edited Data Protection Act of 6 January 1978<\/a>, personal data transfers abroad are prohibited except in the case where the country in which the receiving company offers a sufficient level of data protection.<\/p>\n

As for the US, transfers that were made on the basis of Safe Harbor are indeed illegal. However, other solutions exist, we will detail below. Beware; the G29 is currently analyzing the impact of the Safe Harbor invalidation by the Justice European Court on these tools. So it is not sure that these tools can still be used if they also asks for\u00a0safety issues in their turn.<\/p>\n

In view of the CNIL-France \u00a0statements, for now, data already transferred\u00a0is not affected; it is still waiting the deliberations of the relevant authorities. However, new transfers will no longer be made.<\/p>\n

3. What data is concerned?<\/strong><\/h2>\n

The definition of personal data<\/a> is as follows according to the CNIL-France:<\/p>\n

\u00ab\u00a0Any information related to an individual who might be identified, directly or indirectly. For example: a name, a photo, a fingerprint, a postal address, an email address, a telephone number, a social security number, an internal number, an IP address, a computer login, a voice recording, etc.<\/em><\/p>\n

Note: For these data to no longer be considered personal, they should be made anonymous so that the concerned\u00a0person identification must\u00a0be\u00a0impossible: hidden names, blurred faces, encryption, etc.<\/em><\/p>\n

Warning: if it is possible to identify a person by crosscutting several information (age, gender, city, diploma, etc.), or by the use of various technical means , the data is still considered personal.\u00a0\u00bb<\/em><\/p>\n

If it is about a\u00a0biomedical research (BMR) study for a medicinal product, a medical device, a cosmetic or tattoo product or \u00a0other BMR out of health product, if the\u00a0transfer concerns the\u00a0data of an undergoing biomedical research persons<\/u>\u00a0and datas are in the in line with part 1.2.3 of the MR-001<\/a><\/u>, the transfer is still possible because it is not a personal data.<\/p>\n

If it is about a\u00a0non-interventional study on the performance study of a medical device in vitro diagnostic (MD IVD) and that, in accordance with the MR-002<\/a><\/u>, only anonymous or encoded data of the participants to non-interventional study of MD IVD performance are transmitted outside the EU, then the transfer of this data is possible.<\/p>\n

However, as part of these studies within the scope of the MR-001 or MR-002, the personal data of investigators and their team members are also transferred through their CV, contact information … This information, as for their part, are not anonymous and do constitute personal data. Their transfers to the United States are therefore prohibited.<\/p>\n

If it is about\u00a0another type of study or a study that does not meet the reference methodologies of the CNIL-France, the CNIL-France has assessed the nature of these data transfers and provides a transfer authorization. These transfers are not affected at this time.<\/p>\n

4. Other solutions<\/strong><\/h2>\n

There are two other solutions to implement data transfers to the United States:<\/p>\n