The topic for this article arose from an interesting discussion at a roundtable event that Bristows hosted with clients from the pharmaceutical and medical device sectors on 26 February 2020.
Under Clause 24 of the ABPI Code of Practice, Pharmaceutical Companies must publicly disclose, on an annual basis, transfers of value made to healthcare practitioners (HCPs) in Europe. Where individual recipients of the payments cannot be identified for legal reasons, the amount attributable to such transfers must be disclosed on an aggregate basis.
From a policy perspective, the reasoning behind this obligation is to create transparency in the pharmaceutical sector and in doing so to demonstrate integrity on the part of doctors and other HCPs, particularly building trust in the eyes of patients and the public.
Pharma companies, as data controllers, need under the GDPR to have an appropriate legal ground to process the data relating to these payments. Currently it is market practice, and has been to date, for pharma companies to rely on the legal ground of consent under data protection law to disclose the personal data to the ABPI. The problem with this from a transparency perspective has been that HCPs don’t seem too willing to give their consent. The disclosure rate has fluctuated from 55% in 2015, up to 65% in 2016, plummeting to 49% in 2017.
Compliance rose again in 2018, to 57%, but this is still far from the ABPI and NHS England’s vision of 100% transparency. In 2017 these two institutions sent a joint letter to NHS Trust CEOs, NHS Acute Trust Medical Directors and CCG Accountable Officers, making it clear that if the voluntary process continued to produce such weak results, alternative measures would be introduced “to ensure full disclosure”.
Whilst such measures don’t yet appear to be forthcoming, the ABPI seems to be taking a slightly more conciliatory approach. In November 2019, the Legal Director of ABPI sent an email to registered pharmaceutical companies to say that the ABPI “recognised that industry thinking [on their reliance on consent] appears to have shifted slightly in recent months”. Instead, the idea of relying on Legitimate Interests under GDPR seemed to be gaining “some traction”. The Legal Director stopped short of directing or even advising pharma companies to make the switch, but stated that the ABPI’s own legal advice suggested that it was a sound approach. He therefore “felt this was worth pointing out to all companies registered”. It is also worth noting that the ABPI itself now relies on Legitimate Interests for its own disclosures on Disclosure UK, as set out in its Privacy Statement.
Whether this communication will precipitate an industry-wide swing remains to be seen, however we are aware from a number of sources that numerous companies are at least considering the move. So what are the risks in remaining with consent or on the other hand moving to legitimate interests?
Remaining with consent
The main issue with sticking to reliance on consent is that it is not producing the transparency desired by ABPI and NHS England. It may therefore lead to enforced measures further down the line.
There is also an administrative burden; just signing an agreement with HCPs won’t be sufficient for GDPR-compliant consent. Instead they must actively indicate their consent, for example by ticking a separate box, setting out what they are consenting to in clear, plain language and advising them of their right to withdraw consent at any time. Additionally, a pharma company needs to ensure that separate lists are kept of HCPs that consent and those that don’t, making sure there are no mix-ups, and deal with individuals that withdraw consent mid-way through a year, leading to confusion about which bucket they fall into or, worse, a situation where a misleading picture is provided as to how much they have been paid during that year.
However, most pharma companies will be used to this process and will already have the necessary systems and policies in place to deal with these challenges. It may feel like more of a burden to change things and move to a new legal basis for processing.
Switching to Legitimate Interests
The main advantage of legitimate interests is that once you have an affirmative outcome to an initial Legitimate Interests Assessment (LIA), you are able to publish payments to all HCPs without their consent. In order to get an affirmative outcome to the LIA, you first need to show that you have a genuine, legitimate purpose (such as meeting your obligations under the ABPI Code), and secondly that the processing is necessary to achieve that purpose (well, consent clearly hasn’t worked to achieve the desired policy objective, of 100% transparency). Finally you must carry out a balancing exercise between your interests and the rights and freedoms of the individual.
Pharma companies would need to notify HCPs in advance of making the switch and of their right to object to the processing. In one sense, the historical reliance on consent has made it more difficult to move to legitimate interests now, as doctors are used to having the choice and won’t like having it taken away from them, so might be more likely to object than otherwise would have been the case. However, the tide is starting to turn and if the majority of HCPs and the industry as a whole wishes to do away with non-disclosures, this might tend to discourage HCPs from making the effort to lodge an objection.
What if someone objects?
If a company receives an objection, an assessment of the objection would need to be done – namely an enhanced LIA, this time taking into account the individual HCP’s specific circumstances in the balancing test. Therefore there could be an increased administrative burden if there are lots of objections and you need to consider each one separately. It is hard to know how a switch to legitimate interests as a legal basis will be received by HCPs but judging by the current lack of engagement on the part of many HCPs, they may well not show particular interest.
Unfortunately there is no harmonised position across the EU. There are a myriad of approaches in different jurisdictions, ranging from near obligatory disclosure to legitimate interests being vocally encouraged but not mandatory. As such, companies should be wary of simply preparing and using a single template agreement across the EU and thought should be given, on a case-by-case basis, as to the position in the specific jurisdiction in question.
So should you make the switch?
Initially there is a higher administrative burden in making the switch, as the current systems and processes in place need to be changed and the legal analysis will need to be carried out and documented. On a similar note, companies will need to account for any inefficiencies in business process they may encounter by taking different approaches in different jurisdictions. However, the flexibility afforded by self-regulation will also be a factor, as opposed to the prospect of NHS England potentially turning to the mandatory approach referred to in the 2017 letter mentioned above.
In the short term there is no current pressure to rush to decide. We have heard that the ABPI is asking companies to disclose only aggregate data for their 2019 submissions, to alleviate NHS HCPs from receiving letters about the issue from pharma companies and the ABPI during this unprecedented and highly pressurised period of dealing with a global pandemic. All the more reason to switch to legitimate interests in future as, after the initial communication regarding the switch, that would remove the need for annual requests for consent and therefore to the need for annual attempts to engage busy HCPs.
 Note that withdrawal of consent does not apply retrospectively, so once the data has been published by the ABPI, it will not need to be removed from the Disclosure UK website. However, if consent is withdrawn part-way through a year, before that year’s figures have been disclosed to the ABPI, then the withdrawal should apply to all payments relating to that individual during the course of that year.