The European Medicines Agency (EMA) defines Compassionate Use as a treatment option that allows the use of an unauthorised medicine.

Under strict conditions, products in development can be made available to groups of patients who have a disease with no satisfactory authorised therapies and who cannot enter clinical trials.

Compassionate use is governed by Article 83 of Regulation (EC) No 726/2004 and its programmes are coordinated and implemented by Member States, which set their own rules and procedures.

The Early Access Program ('Accès précoce') in France is somewhat different from the definition of Early Access at EU level. In France it is governed by article L.5121-12 of the French Health Law: it enables patients to have access to a drug before it has received official approval under specific conditions, and the reimbursement of the treatment is covered by the French social security.

The new Guidelines from the French CNIL can be accessed here:

• Compassionate Use (Acces compassionnel):
  https://www.legifrance.gouv.fr...

• Early Access (accès précoce): 
  https://www.legifrance.gouv.fr...

The Ministry of Electronics and Information Technology of India has been deliberating on various aspects of digital personal data and its protection, and has formulated a draft Bill, titled ‘The Digital Personal Data Protection Bill, 2022’.

The purpose of the draft Bill is to provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto.

The draft Bill employs plain and simple language to facilitate ease of understanding and is available on Ministry’s website here, along with an Explanatory note that provides a brief overview of its provisions, which is available here.

This new draft bill allows cross-border data transfers with certain notified countries and territories. It establishes a Data Protection Board to oversee compliance and impose penalties. Such penalties should not to exceed 5 billion rupees (59 million euros).

People are invited to submit their feedback until Dec. 17th, 2022 on this link.

Read more about the new bill and how to submit comments here.

On 17 November 2022 the UK's Data Protection Authority, the Information Commissionner's Office (ICO ) updated its Guidance on , International Transfers, see here.

It includes a new section on Transfers Risks Assessments (TRAs), a new deliverable to draft,  If you are relying on an Article 46 transfer mechanism like UK IDTAs, EU SCCs, read here.

There are two broad types of risk you must consider in your TRA:

• Risks to people’s rights arising in the destination country from third parties accessing the information that are not bound by the Article 46 transfer mechanism, in particular government and public bodies.
• Risks to people’s rights arising from difficulties enforcing the Article 46 transfer mechanism.

The ICO considers that there are 2 ways to draft a TRA:

• Option 1: ICO’s approach in our TRA tool.
• Option 2: Approach taken by EDPB.
  

The TRA tool can be found here.

For any question, feel free to contact our UK Consultants:

• Dave Edwards d.p.edwards ( at ) pharmarketing.net
• Julianne Hull j.m.hull ( at ) pharmarketing.net
• Maria Veleva, MD m.i.veleva ( at ) pharmarketing.net

UK finalized adequacy decision with Korea, and it's the first adequacy decision of UK since the Brexit. 

This means that transfers of Personal Data from UK to Korea are compliant with GDPR. 

The decision and subsequent legislation was presented to U.K. Parliament and is expected to take force Dec. 19.

As a reminder, the European Union (EU) and the European Economic Area (EEA) have put in place already an adequacy decision with Korea, but the UK could not benefit from it since they left the EU. 

In total, the EEA has put in place adequacy decisions with 14 countries already.

Read the press release of the UK Government here.

1. We should always inform people before we start collecting or processing their personal data: 
   
   Yes, it is a key principle of the GDPR to inform people before you start collecting or processing their personal data
   
   

2. I can reuse the personal data from patients for a different objective without reinforming them: 

     No: you need to reinform the patients before you can proceed with the new personal data processing