The EFPIA Disclosure Code (the “Code“) requires all EFPIA member companies and companies that are members of EFPIA member associations, such as the Association of the Research-Based Pharmaceutical Manafacturers in Bulgaria (ARPharm) to disclose transfers of value to health care professionals (HCPs) and healthcare organisations (HCOs).
The first disclosures will be made by 30 June 2016, for payments made in 2015.
Under the Code, EFPIA member companies will have to disclose and make accessible to the public, with no restrictions, the names of healthcare professionals and organisations that have received payments or other transfers of value from them. They will also have to disclose the total amounts of value transferred, by type of activity, which could consist of, for instance, a grant to an HCO, a consultancy fee for speaking, payment for travel, or registration fees to attend a medical education congress.
Thus, disclosing the transfers of value provided to the HCPs and HCO, the EFPIA/ ARPharm member companies will comply with the regulatory and transparency requirements imposed by the applicable laws and industry codes of conduct.
In the meantime, when processing and publishing the personal data of the HCPs, the companies should do this in conformity with relevant data protection regulations. In this regard, for an individual public disclosure of the transfers of value, the HCPs should provide their explicit written consent, after being informed about the purposes of processing. However, under the EU and Bulgarian data protection regulations, the data subject, i.e. the HCP, is entitled to revoke his/her consent in any time.
The withdrawal of HCP’s consent for data processing after the HCP has received the funds and the pharmaceutical company has disclosed his/her data on their websites may trigger many legal issues. On one hand, the sponsors fulfil their transparency obligations under the EFPIA Disclosure Code, but on the other, such disclosure, done without the explicit consent of the HCP, would be considered a violation for processing of the HCPs personal data, in breach of the data protection laws. In order to avoid such risk, some of EFPIA member companies explicitly note that the revocation of HCP’s consent will not have any retroactive effect.
In the beginning of February 2016, the Bulgarian data protection authority (the Commission for Protection of Personal Data, CPPD), issued an Opinion in response to the question of how to deal with personal data of HCPs, who have revoked their consent for disclosure of transfers of value, after being provided with funds from the sponsors.
Under Bulgarian personal data protection law, personal data of HCPs should be maintained in a form that enables identification of the respective individuals for a period not exceeding the time necessary for the purposes for which such data are being processed. Therefore, according to the CPPD, the data controller should determine a specific deadline for processing the personal data of the HCPs, related to the transfers of value. When giving their consent, HCPs should be provided with information about the period during which his/her personal data will be available on the website of the EFPIA member companies.. The HCPs also should be aware that the revocation of their consent for disclosure of transfers of value, with regard to the data controller should also have ex-nunc effect, i.e. it will be valid for the period after the expiration of publication period.
Although the CPPD Opinion is not binding it is indicative about the position of the Bulgarian Data protection authority regarding the withdrawal of consent of HCPs in the context of the implementation of EFPIA Disclosure Code.
The CPPD opinion is also important, since it provides instructions to pharmaceutical companies, implementing disclosure codes, to determine a specific deadline for processing and making personal data of HCPs available on the websites and to make such deadline known to the HCPs at the time of the provision of their consent.
Given that in most cases the HCPs provide their explicit consent in a separate form to their agreements with sponsors, we would recommend that information about the period of data processing shall be specified in a Informed consent form.