Use the Lexology Navigator tool to compare the answers in this article with those from other jurisdictions.
What post-market monitoring mechanisms are in place to ensure the ongoing safety and efficacy of medicinal products after marketing authorisation has been granted?
The marketing authorisation holder must set up and operate a pharmacovigilance system (Section 63b of the Medicinal Products Act) which includes:
- nominating a local person responsible for setting up and managing the system (Section 63a of the Medicinal Products Act);
- submitting regularly updated safety reports;
- keeping records of all cases of suspected side effects and adverse events;
- recording every case of serious suspected adverse reaction and reporting such reactions to the Federal Institute for Drugs and Medical Devices (BfArM) or the Federal Institute for Vaccines and Biomedicines (PEI) (as the case may be) and to European Medicines Agency within 15 days of acquiring such knowledge;
- sending information letters and so-called ‘red hand letters’ (Rote Hand Briefe) to healthcare organisations about newly identified major risks and measures to reduce such risks; and
- conducting non-interventional post-authorisation safety studies if requested by the competent authority.
The BfArM or PEI may impose further conditions on the marketing authorisation holder when granting the authorisation.
What data protection issues should be considered when conducting pharmacovigilance activities?
Reporting adverse events
When an adverse event is reported, it is important to collect certain personal data (eg, name and address) to meet the pharmacovigilance requirements (ie, having an identifiable patient and reporter). Thus, individual case safety reports must contain certain minimum information. Information relating to the patient should be as complete as possible, although in accordance with local privacy laws.
Data subjects (ie, persons experiencing an adverse event and those making the adverse event report) must be notified of what personal data relating to them is being collected, who is collecting it, the purpose of collection and the recipient of the personal data (no individual names are required; it is generally sufficient to identify the receiver, such as the health authorities).
This information should be set out in a clearly written data protection notice that can easily be understood. However, different channels of adverse event reporting (eg, telephone, email and in person) may require different types of data protection notice.
Regardless of whether the data subject is the person who suffered the adverse event or the person reporting it (eg, healthcare professionals or a relative of the patient), in principle it is not necessary to obtain consent from the data subject in order to process personal data relating to the data subject for the purposes of pharmacovigilance. This is because the processing is based on legitimate legal purposes (ie, purposes of preventive medicine, medical diagnosis and healthcare). However, in all instances the data subjects should be informed as soon as possible of the collection and use of their personal data.
Follow-up of pharmacovigilance data All correspondence with a reporter requires a data protection notice (attached to follow-up request forms or adverse event forms sent to the reporter for completion). However, consent should always be obtained from the patient to follow up with his or her relevant healthcare professional.
Standards on data retention and redaction of personal data (ie, data minimisation) and general data protection standards apply in respect of data entry and data transfers, access, rectification and objection rights.
Click here to view the full article.