The Spanish Data Protection Authority (AEPD) has recently approved the first industry code of conduct (CoC) under the General Data Protection Regulation (GDPR). The CoC has been promoted by Farmaindustria (the National Business Association of the Pharmaceutical Industry) and governs the impact of data protection rules on the development of clinical trials and compliance with pharmacovigilance obligations.

Farmaindustria is the National Business Association of the Pharmaceutical Industry that brings together most of the innovative pharmaceutical companies established in Spain and represents virtually all sales of patented prescription medicines in Spain. This new Farmaindustria code ‒ which replaces and brings the previous one from 2009 into line with current legislation – represents a step forward in terms of data protection for those participating and intervening in the activities it regulates, and will also help to strengthen clinical trials and pharmacovigilance.

The CoC will apply to clinical trials sponsors, whether they are associated to Farmaindustria or not, and to clinical research organizations (CROs) in Spain, as long as they comply with the CoC and process personal data for the purpose of conducting clinical trials or complying with pharmacovigilance rules. It will not apply, though, to research initiated before the CoC comes into full effect.

The CoC sets out a standard operating procedure (SOP) for clinical trials and related research. It establishes that no data protection consent is needed once the participant has agreed to join the clinical trial. The information obligations remain.

With regard to pharmacovigilance, the CoC sets out a uniform protocol taking into account the specificity of the channel and the person making the report, as well as special rules when the company learns of an adverse reaction through social media.

The CoC appoints a Code of Conduct Governing Body (OGCC) whose role is to monitor compliance with the CoC by participating companies and to liaise with AEPD on behalf of Farmaindustria. The OGCC will remain independent of Farmaindustria.

In addition, the CoC establishes a voluntary and free-of-charge dispute resolution system to which data subjects may submit claims for breaches of data protection rights by any of the adhered companies. Claims will not be accepted if they are handled by AEPD or the Spanish courts.

The Code of Conduct will be reviewed as needed and (if applicable) updated every 4 years.

Scope of the CoC application is national, although it aspires to be a benchmark at European level, as it is the first code in this area approved in Europe.

Read the AEPD news (in Spanish language).

Read the CoC (so far only available in Spanish language).

Meditrial is the Representative trusted by more than 100 firms.
Market access has never been easier.

Get in touch today!