Compliance of cross-border transmission of medical data involved

Author: Zhou Hanshuo

(This article was first published on China Business Law Journal column "Life sciences & healthcare", authorised reprint)

The data security law and the personal information protection law came into force successively in 2021, together with the previous network security law, as well as the regulations on the security protection of key information infrastructure, the measures for data exit security assessment (Draft for comments) and the regulations on the management of network data security (Draft for comments). So far, China's data security regulatory framework has taken shape and put forward comprehensive compliance requirements for relevant subjects engaged in data processing.

As a practicing lawyer in the field of medical law, the author makes a preliminary discussion on the cross-border transmission of medical data in combination with the cross-border data transmission needs of Chinese pharmaceutical enterprises in the process of cross-border application for new drug clinical research approval (ind) and new drug registration application (NDA), and in combination with the latest data security supervision trend.

Cross border data transmission

The cross-border data transmission of medical data in ind and NDA mainly occurs when (1) applying for ind and drug clinical trials to overseas drug regulatory authorities and (2) submitting NDA to overseas drug regulatory authorities.

When applying for ind, pharmaceutical enterprises usually need to submit preclinical test data of drugs (such as animal pharmacology / toxicology research data), drug composition and production information, clinical research scheme and researcher information, etc. If the drug clinical trial is carried out in an international multi center way, the data collected and generated by each center need to be summarized and processed for the sake of the unity of statistics, analysis and supervision of the trial data. If the trial sponsor sets up a unified data processing center overseas, it will involve the transmission of the data of clinical trials in China to overseas. For another example, if EDC (electronic data capture) system deployed on overseas servers is used in the test, it will also involve the transmission of domestic clinical trial data to overseas.

In the NDA stage, it is usually necessary to provide overseas regulatory authorities with drug production information, non clinical pharmacological and toxicological data, human pharmacokinetics and bioavailability data generated in clinical trials, microbial data, clinical data, safety data update report, statistical data, case report form, relevant patents, samples, packaging and labels, etc.

Is a safety assessment required?

From the perspective of personal information

The development of new drug clinical trials in China will involve the collection and processing of medical and health data such as subjects' basic information, physiological indicators and test results. However, according to the requirements of China's specifications for the quality management of drug clinical trials and the technical guide for clinical trial data management, the protection measures for the personal information of subjects are included in the design of clinical trial scheme and database, including replacing their names with subject identification codes (the same when reflecting adverse events and other trial data). Therefore, the test reports and data submitted when submitting ind and NDA applications usually do not include personal information that can directly identify the subjects, and the number of subjects involved is relatively limited.

The application materials will also contain a small amount of ordinary personal information such as the names and emails of the sponsors, researchers and cro staff, but the overall scale is very limited and it is difficult to reach the transmission scale specified in the exit evaluation measures (more than 100000 personal information has been transmitted in total); As far as new drug R & D enterprises are concerned, the scale of personal information processed in China usually does not exceed the threshold of 1 million people. Therefore, the obligation to declare data exit security assessment will not be triggered unless the relevant party is identified as the operator of key information infrastructure.

In addition, the clinical trial data may also include the subject's human genetic resource information. The biosafety law and the regulations on the administration of human genetic resources stipulate the corresponding approval or filing backup requirements for the exit of China's human genetic resources information in different scenarios. According to the principle that the special law is superior to the general law, and according to the arrangement of "if there are other provisions in laws and administrative regulations", the author understands that the transmission of such scenes should be subject to the requirements of the Ministry of science and technology.The development of new drug clinical trials in China will involve the collection and processing of medical and health data such as subjects' basic information, physiological indicators and test results. However, according to the requirements of China's specifications for the quality management of drug clinical trials and the technical guide for clinical trial data management, the protection measures for the personal information of subjects are included in the design of clinical trial scheme and database, including replacing their names with subject identification codes (the same when reflecting adverse events and other trial data). Therefore, the test reports and data submitted when submitting ind and NDA applications usually do not include personal information that can directly identify the subjects, and the number of subjects involved is relatively limited.

From the perspective of important data

According to the draft of exit evaluation measures and network data security regulations, as long as the exit data includes important data, it is necessary to declare the exit security evaluation of data. However, the catalogue of important data and its identification still need to be determined by regional and industrial competent departments.

Although the "drug experimental data submitted by drugs with national strategic safety in drug approval" is mentioned as important data when describing the characteristics of important data in a national standard exposure draft posted online, it also stipulates that all regions and departments will clarify the categories / characteristics of important data in their industries / fields, Therefore, the clarification and guidance of the important data catalogue formulated by the competent authorities (State Food and Drug Administration and National Health Commission) are still needed.

Other compliance obligations

According to the above-mentioned new regulations, the relevant parties in the new drug R & D process also need to comply with other obligations on data exit activities. For example, 

1

In addition to disclosing the data exit situation in the subject's informed consent and obtaining their explicit consent, if there is personal information of the staff participating in the trial, it also needs to be disclosed in writing and obtain express consent;

2

Establish a set of self-assessment system within the institution to sort out the cross-border data transmission activities involved, carry out risk self-assessment in accordance with the requirements of the personal security law, the measures for exit assessment and other regulations, and keep the assessment report;

3

Improve the contract agreements with overseas partners in the process of ind, clinical trials and NDA application (such as foreign institutions in clinical trials, overseas intermediaries registered as agents, overseas technical service institutions, etc.), and agree on their safety protection responsibilities and obligations for receiving data from China; 

4

And keep the logs and records of cross-border data transmission involved in relevant scenarios for at least three years.

*Special thanks go to the partner Casper Sek for his suggestions on cybersecurity and data compliance.

Jingtian & Gongcheng’s Life Science and Healthcare Team has extensive legal and industrial experience in the field. Our lawyers have been focused on international and pharmaceutical legal practices over a dozen of years, with working experiences at international law firms and top-tier multinational healthcare companies, and many of them are qualified both in China and abroad.

We have advised clients on mergers and acquisitions, technology licensing, contracted manufacturing, co-promotion, business conduct and compliance, and daily operational issues related to pharmaceutical and medical devices companies. For more information, please contact Ms. Hanshuo ZHOU([e-mail], phone: [phone], mobile: [phone]).

医药医疗专栏往期文章

作者介绍

周晗烁律师毕业于华东政法大学、美国德克萨斯大学法学院(University of Texas at Austin) ，获中美两地法律硕士学位，具有中国大陆地区以及美国纽约州法律执业资格。
周律师从事法律工作已超过十五年，服务的客户包括国际500强医疗企业，国内大型药企、创新型医疗器械和医疗服务企业，以及著名私募和风险投资基金。周律师深耕于生命科学和医疗健康领域，不仅对传统医疗药械领域的生产、销售、跨境技术服务等交易经验丰富，近年来还深度参与了诸多新兴领域的项目，如生物技术、细胞治疗、基因检测、医疗大数据、互联网+医疗等。
周律师在“LEGALBAND 中国顶级律师排行榜”上连续两年被列为“医疗和生命科学领域的获推荐律师”。在国际知名财经媒体Euromoney公布的“2020年度亚洲商业法律杰出女律师（Women in Business Law Awards 2020）”评选中，荣膺亚洲区域“Best in Life Science （生命科学领域最佳）” 。

周晗烁等律师往期文章回顾