Genvejsmenu:
S - Indhold
1 - Forside
2 - Nyheder
3 - Oversigt
4 - Søg

The medical products and medical device industry, etc.

Notification and authorisation are no longer required

As from 15 May 2012, the following processing of sensitive personal data is no longer required to be notified to and authorised by the Danish Data Protection Agency:

• Clinical trials with medical products subject to the Danish Medicines Act;
• Clinical testing of medical equipment subject to the Danish Act on Medical Devices;
• Mandatory safety monitoring of medical products and medical equipment in accordance with the Medicines Act and the Act on Medical Devices.

Continued notification obligation for certain types of data processing
The exemption from the notification obligation does not apply to the processing of personal data in connection with non-interventional trials, nor does the exemption apply to biological material for future use, i.e. biological material that is not part of the individual clinical trial, but is stored for future research purposes. Non-interventional trials and biological material that is not part of the clinical trial must therefore still be notified to the Data Protection Agency.

Non-interventional trials must be notified to the Data Protection Agency on the Private research form.

Biological material for future research must be notified to the Data Protection Agency on the Private entity form if the biological material is expected to be used in trials of medical products or in the testing of medical equipment.

If the material is only expected to be used for research that can take place in accordance with Section 10 of the Danish Act on Processing of Personal Data (see more about Section 10 below) the notification to the Data Protection Agency must be made on the Private research form.

Pharmaceutical companies, etc. that conduct ongoing non-interventional trials, or other research that is subject to the notification requirement, may file a general notification thereof, and gain authorisation from the Data Protection Agency to process sensitive data. It is likewise possible to file a general notification of the processing of biological material for future research. 

Legal basis for clinical drug trials, testing of medical equipment and mandatory safety monitoring

1. Clinical drug trials, testing of medical equipment and mandatory safety monitoring  cannot take place in accordance with Section 10 of the Act on Processing of Personal Data

The legislation on medical products includes rules that the Danish Health and Medicines Authority (formerly the Danish Medicines Agency) must receive reports on side effects and adverse incidents, etc. This information is used in the Health and Medicines Authority’s administrative case processing.

Clinical drug trials, testing of medical equipment and mandatory safety monitoring which are reported for the Health and Medicines Authority’s administrative case processing cannot take place within Section 10 of the Act on Processing of Personal Data,.

Section 10 only makes it possible to process sensitive personal data without the consent of the trial subjects/participants when special requirements are fulfilled. Data may only be processed in accordance with Section 10 if the processing is solely to perform statistical or scientific studies, just as the information may not later be processed for other than statistical or scientific purposes.

The legal basis for the collection, registration, disclosing and other processing of personal data must therefore be found either in the legislation on medical products or in Chapter 4 of the Act on Processing of Personal Data.

2. The Act on Processing of Personal Data must still be complied with

Even though drug trials, etc. are no longer required to be notified to the Data Protection Agency, the Act on Processing of Personal Data - and any other relevant legislation - must still be complied with. Among other things, this means that the rules of the Act on Processing of Personal Data concerning data security and the data subject’s rights must be complied with.

This also means that the rules on transfer to third countries must still be observed by the data controller of the project.

See the overview of the requirements of clinical drug trials, clinical testing of medical equipment, and mandatory safety monitoring of medical products and medical equipment here.  

Pharmaceutical companies, etc. with general authorisation

The Data Protection Agency will shortly contact the pharmaceutical companies, etc. that hold a general authorisation from the Data Protection Agency for ongoing clinical drug trials, ongoing clinical testing of medical equipment, or mandatory safety monitoring, in order to revoke the general authorisation. The companies may still process data relating to these trials, etc. provided that the Act on Processing of Personal Data - and other relevant legislation - is complied with (see above).

Exemption from the obligation of notification to the Data Protection Agency is laid down in the Exemption Order.

Section 10 of the Act on Processing of Personal Data

10. - (1)  Data as mentioned in section 7 (1) or section 8 may be processed where the processing takes place for the sole purpose of carrying out statistical or scientific studies of significant public importance and where such processing is necessary in order to carry out these studies.

(2) The data covered by subsection (1) may not subsequently be processed for other than statistical or scientific purposes. The same shall apply to processing of other data carried out solely for statistical or scientific purposes, cf. section 6.

(3) The data covered by subsections (1) and (2) may only be disclosed to a third party with prior authorization from the supervisory authority. The supervisory authority may lay down specific conditions concerning the disclosure.