In June 2016, pharmaceutical companies in Serbia belonging to the Association of Manufacturers of Innovative Drugs – INOVIA reported on transfers of value during 2015 to Serbian health-care professionals (HCPs) and health-care organisations (HCOs). The disclosure, without a precedent in the practice of the pharmaceutical companies with presence in Serbia, raises some interesting issues concerning protection of personal data of the HCPs, especially the legal basis for making the data publicly available and the scope of permissible processing.
INOVIA was founded in 2007. It is an affiliate member of EFPIA, the European Federation of Pharmaceutical Industries and Associations. INOVIA’s Code on Disclosure of Transfers of Value provides for an obligation of the member companies to disclose transfers of value to the HCPs and HCOs.
The practice which INOVIA members implemented in June 2016 is rooted in EFPIA’s code on disclosure of transfers of value adopted on 24 June 2013. The Code requires from all associations – EFPIA members to disclose certain types of transfers of values which they made in the previous calendar year to HCPs and HCOs, directly or indirectly. EFPIA’s Code lists in Article 3 three categories of fees and contributions to HCPs to be reported: registration fees paid for participation in congresses, conferences, symposia, and similar events; travel and accommodation costs related to such events; and, fees for service and consultancy (this would include speakers’ fees, speaker training, medical writing, data analysis, development of education materials, and general consulting).
The main goal of the disclosure is to ensure that the entire process of cooperation with transfer recipients is transparent and legally incontestable. In addition, the disclosure should make it easier for the HCPs and HCOs to avoid getting into a conflict of interest and avoid placing their personal and professional integrity in doubt.
Like EFPIA’s Code, the Code adopted by INOVIA in 2014 prescribes that all transfer disclosures should be made on an annual basis. Each reporting period should cover a full calendar year, starting with 2015 (article 2.1 in INOVIA and EFPIA codes). The transfers should as a rule be disclosed on an individual basis for each clearly identifiable recipient. If that is not possible “for legal reasons” the transfers may be presented on an aggregate basis, for the entire company (articles 3.1 and 3.2 in INOVIA and EFPIA Code).
INOVIA’s official website includes some of the lists containing the transfer disclosures for 2015. The data for other companies – INOVIA members may be found on the companies’ websites.
As a good deal of transfers which have been disclosed or will be disclosed soon pertains to HCPs as concrete and identifiable individuals, the obligation of disclosure raises the question of protecting their personal data. The dilemma is whether their names, transfers received, and other relevant information may be lawfully published and, if so, under which conditions.
The Serbian Data Protection Act (2008) prescribes that any kind of the processing of personal data, including publishing, is allowed if it is based on certain statutory provision or on the consent of data subject (article 8, point 1). There are no laws in Serbia authorizing pharmaceutical companies to publish HCPs’ personal data without the person’s consent. As for codes of practice and acts of similar nature, adopted by international or domestic associations, organisations and businesses, they cannot be treated as statutory basis for making the data on HCPs publicly available.
Therefore, pharmaceutical companies may disclose transfers of value to HCPs only if they have obtained the consent for such disclosure from the professionals they cooperate with. The consent has to be in writing and must contain all elements prescribed by the Data Protection Act (Article 10, and Article 15, section 1).
The percentage of HCPs in Serbia who consented to disclosure of their personal data in the reports for 2015 varies significantly, from company to company. On one end of the spectrum, none of the HCPs who received value from Sanofi-Aventis consented to the use of personal data in the report. On the other end, around 95 percent of the HCPs gave their consent to Eli Lilly to publish the personal data. Somewhere in between, the consent rate was, as follows: between 7.5 and 11 percent (depending on the type of contribution, i.e. fee) for Merck; between 17.5 and 31 percent for Pfizer; between 60 and 75.5 percent for Novartis; between 66.5 and 77 percent for Servier; between 67 and 77 percent for GlaxoSmithKline; and so on.
If a HCP does not give or withdraws the consent for disclosing his data on received transfers, pharmaceutical companies may disclose the information on such transfers just in an aggregated manner, associated to transfers made to other HCPs who have not given their consent. This is what the companies did in the lists publicized in June.
Even if a pharmaceutical company as the data controller has obtained the data subject’s consent, the amount of published data must not exceed the purpose of publishing. That means that the lists of transfers may not contain the information such as personal ID numbers of HCPs, their private addresses or any other details which do not serve the transparency purpose while at the same time invading excessively the HCPs’ privacy. In fact, the disclosures in June, for the transfers made in 2015, limit the scope of the personal data to the name, work address, and the amounts received.
