EMA is preparing dedicated guidance on the impact of EU data protection legislation on the secondary use of health data in support of the development, evaluation and supervision of medicines.

The aim is to help medicine developers, data providers and research bodies comply with EU data protection rules, and to help patients and consumers understand their rights and the existing safeguards to protect personal data.

Secondary use of data refers to the use of data for a different purpose than the one for which it was originally collected. It typically involves the use of electronic health records, health insurance claims data, registry data or drug consumption data for medicines research and public health purposes.

The guidance will cover various operational scenarios, including the development of medicines, the evaluation of marketing authorisation applications and post-authorisation safety monitoring.

By July 2020 EMA had gathered input from patients and consumers as data contributors as well as from medicines developers, research-performing and research-supporting infrastructures and other data providers (e.g. payers of healthcare).

In September 2020, stakeholders discussed with EMA the key questions concerning the application of the General Data Protection Regulation (GDPR) in the health sector and the secondary use of health data for medicines and public health purposes:

EMA aims to finalise the guidance in consultation with the European Commission and the European Data Protection Supervisor (EDPS) in the last quarter of 2021. It will take into account stakeholder input and guidance from the EDPS on the processing of health data for research.

Ensuring that personal data are managed and analysed within a secure and ethical governance framework in compliance with EU data protection legislation is one of the recommended priorities of the HMA/EMA Big Data Task Force.

EU data protection legislation includes:

• Regulation (EU) 2016/679, known as the General Data Protection Regulation (GDPR), which applies to private and public entities in the Member States;
• Regulation (EU) 2018/1725, known as the EU Data Protection Regulation (EUDPR), which applies to all EU institutions and bodies.