Scope of the two standards
The standards relate to Early Access and Compassionate Access. They are intended for all pharmaceutical companies offering a drug that has obtained an early access authorization from the French High Authority for Health or a compassionate access authorization from the French National Agency for the Safety of Medicines and Health Products.
Early Access concerns medicinal products that meet an unmet therapeutic need, are likely to be innovative, and for which pharmaceutical companies undertake to file a marketing authorization or a request for reimbursement under ordinary law. Compassionate Access concerns medicinal products that are not initially intended to obtain a market authorization but satisfactorily meet an unmet therapeutic need.
Because the new regime applicable since 1 July 2021 imposes a much more significant collection of personal data on pharmaceutical companies, these standards are key to ensure that the concerned data processing is fully compliant.
Purpose of the two standards
Like other CNIL standards, their purpose is to offer a simplified procedure. These two standards indeed establish a framework for compliance by describing specific steps for data processing. If the organization strictly complies will all provisions of the standards, it is exempt from requesting an authorization from the CNIL, and a compliance commitment is sufficient for all future processing operations that are to be subject to the standard.
In France, Early Access and Compassionate Access programs in principle require a prior authorization from the CNIL pursuant to Article 66 of the French Data Protection Act (Loi Informatique et Libertés). Thanks to these standards, the filings for pharmaceutical companies will be simplified and a compliance commitment for all future Early Access programs and Compassionate Access programs will be sufficient once the final versions of the two standards are published.
Main provisions of the two standards
These standards provide a framework for the processing of personal data implemented by pharmaceutical companies to monitor patients, make medicines available, and manage relationships with prescribers and dispensers.
They also enable pharmaceutical companies to reuse personal data they collect for research purposes, subject to compliance with the provisions of the GDPR and the French Data Protection Act. Regarding this key subject of reuse of personal data, the CNIL and the French High Authority for Health previously worked together in 2021 and published a more precise notice on the subject available here (French only).
These two standards require pharmaceutical companies to rely on an approved or certified health data hosting service provider in case of outsourcing. For data transfers outside the EU, they do not impose restrictions beyond those included in the current applicable regulations.
Next Steps
The public consultation is opened until 25 March 2022 before final adoption.
The CNIL invites all public and private actors concerned by these two standards to provide their comments and observations. Given the importance of personal data collection and valorization in this context, this opportunity to comment is not to be missed.
Authored by Patrice Navarro and Julie Schwartz.
