Interview with leading GDPR experts: Founder & Director Mark Gracey (Mark Gracey GDPR) and Senior Managing Lawyer Alison Berryman (Biztech Lawyers)
Are GDPR and UK GDPR relevant to Key Opinion Leader (KOL) Mapping?
MG:
The quick answer is yes, GDPR and UK GDPR are extremely relevant to KOL mapping. GDPR relates to the processing of personal data – data that identifies and/or relates to an individual, so in this case we’re talking about healthcare professionals (KOLs) who are identifiable, and so are Data Subjects as GDPR puts it.
Plus, he data that are collected about the KOLs, such as wide-ranging professional activities (to give a view of who is the most active in a particular therapy area and who might therefore be a suitable partner for a pharma company), social media activity, etc. may also be personal data. So yes, GDPR very much applies.
But generally, the data are all available in the public domain, doesn’t this mean that GDPR does not apply?
AB:
This is an interesting point and one that is quite often misunderstood. The fact that data are in the public domain doesn’t have any impact on whether it is legal or not legal to collect or analyse it. You can collect or analyse the data only if you fulfil your obligations under GDPR. The rules still very much apply irrespective of the data source!
Does it matter how you store your data? If I only have a spreadsheet of KOL names, does GDPR still apply?
MG:
This is another commonly misunderstood area. The fact that data are stored in an Excel sheet is no different to being in a database or even a Word document. You still have to fulfil your obligations under GDPR.
It’s worth noting that part of these obligations are around how data is managed, stored, accessed and protected, so if you are using spreadsheets for storing KOL data, you will need to consider the data security implications of doing so, and being extra careful when you share the spreadsheet – sharing spreadsheets are notorious for causing data breaches when they are accidentally emailed to the wrong person, so password protection is always a good idea if this is your chosen storage and sharing method.
Are there different rules for distinct types of data? What about subjective data, for example about someone’s likely opinion or support of a new therapy?
MG:
There are some data that have a different classification under GDPR. These are referred to as special category data. This special category data is personal data that needs more protection because it is sensitive (for example, data revealing race/ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning the data subject’s health, data concerning the data subject’s sex life or sexual orientation). This could be relevant to KOL or DOL mapping if, for example, you are storing data about expert patients.
In order to lawfully process special category data, you must identify both a lawful basis under Article 6 of the UK GDPR and a separate condition for processing under Article 9. These do not have to be linked.
With respect to collecting and analysing data regarding the likely opinions of the data subject, all general GDPR principles still apply (and you must decide if the opinion falls into special category data to see if the additional rules apply).
GDPR principles are of course a huge topic but, in general, they are divided into:
- Lawfulness, Fairness, and Transparency; Purpose Limitation; Data Minimisation; Accuracy; Storage Limitations; Integrity and Confidentiality; and Accountability.
Regarding lawfulness, can you expand more about what makes processing of data legal, especially in the context of KOL mapping?
AB:
You must have a valid lawful basis in order to process personal data. There are 6 available lawful bases for processing:
- Vital interests – not relevant to KOL mapping because that only covers the situation where the processing is necessary to protect someone’s life
- Legal obligation – not relevant to KOL mapping, as it isn’t necessary to comply with the law
- Contract – the processing is necessary for a contract you have with the individual, so this would not be relevant for KOL mapping
- Public interest – although you might think KOL mapping is in the public interest, this legal basis is slightly more restrictive and really only applies to tasks carried out by public authorities and organisations conducting similar functions
- Consent – as the data are being collected from publicly available sources without the knowledge of the KOL, consent doesn’t work in practice; KOLs can’t consent to something that they’re not aware of!
- Legitimate interest – this would be our usual legal basis for processing in the case of KOL mapping
However, there’s a common misconception that legitimate interest is a catch all, whereas in fact it’s up to the data controller to assess whether they have met the requirements – this assessment process is known as as a “Legitimate Interest Assessment” or LIA.
The wording of the legitimate interest legal basis is as follows:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject”
The UK Information Commissioner has helpfully broken this down for us into a 3 stage test:
- Purpose test: is your purpose legitimate?
- Necessity test: is the processing necessary? i.e. could you do the process without this information?
- Balancing test: do the individuals interests override the legitimate interest?
There are plenty of precedents available for Legitimate Interest Assessments – the UK Information Commissioner’s Office (ICO) has one on their website – and there are many experienced practitioners around, such as Mark and I, who can help too if needed.
Identifying the right lawful basis for processing is only one part of GDPR compliance, are there any other particular points you think are important in terms of KOL mapping?
MG:
Yes, it’s not just about identifying the right lawful basis, you have to meet all your other GDPR obligations too, for the processing to be legal.
This will include complying with the transparency principle and notifying the data subjects about what you’re doing. There isn’t a legally prescribed mechanism for this, but most businesses do it by way of publishing a privacy notice, and in the case of individuals who won’t yet know that you’re processing their data you are also required to actively inform them that you are doing so.
So, the take home message is that you need to make sure that you have considered all your data protection implications, including your legitimate interest assessment, and that you have notified the data subjects of the processing.
You mention that it is the data controller’s responsibility to assess legitimate interest. How do we decide who has the data controller role in a KOL mapping project?
AB:
The Data Controller is the organisation that determines the “means and purposes” of the processing. This is a somewhat unhelpful definition because often there are multiple parties involved in making these determinations, but where a pharma company has instigated the project and instructed an agency to conduct it for them, they will almost certainly to fall into this category. A Data Processor is purely acting on behalf of a controller, and so is likely to be the agency performing the KOL mapping project on behalf of the pharma company.
It is really important to be sure of who has which role in advance of a project, as there are significantly different obligations for Data Controllers and Data Processors.
Data Controllers must ensure that all data processing activities are compliant with the GDPR – so, to select just one relevant example, it will be the Controller who is responsible for providing the Data Subjects with information about who is collecting their data, what is being done with it and for what purpose.
Data Processors, on the other hand, must only process personal data according to the data controller’s documented instructions.
Where an agency, for example, takes the role of data processor, a Data Processing Agreement (DPA) must be in place that sets out details of the controller’s instructions, as well as certain key obligations of the processor (there are 8 specific points listed in the GDPR which need to be included in this document).
As an aside, it’s worth noting that additional measures need to be put in place if the personal data is to be transferred to a processor outside the EEA. Most commonly, this involves signing an additional agreement (in addition to the DPA I just mentioned) known as the “Standard Contractual Clauses” (SCCs) or the more recent UK specific version of the same thing, which is called the “International Data Transfer Agreement” (IDTA).
What about where a company subscribes to a database of KOLs?
MG:
The subscription database provider would, one assumes, be a controller themselves – you haven’t engaged them to create the database, they have done this for their own purposes. They would therefore have been required to comply with all of the Controller’s obligations under the GDPR. As a subscriber to their service, you have an obligation to ensure that any business that is transferring data to you has collected it properly, complied with all their obligations and has the right to transfer it to you. You’d want guarantees from the data provider about that.
As soon as you copy the personal data held in the database into your own environment (such as generating a spreadsheet of names), you are also a Data Controller. So, if you transfer data into your own environment, what you do with that data will make you a data controller and you have all the obligations that go with that, including as discussed above notifying the data subjects that you have their data, what you’ll be doing with it and allowing them to object to that processing.
Key points regarding GDPR and KOL or DOL mapping
- Compliance with GDPR is essential for any KOL or DOL mapping project
- GDPR applies to public domain data – you must still follow the rules
- GDPR applies however you store your data: in a database, an Excel document, a word document!
- You can analyse data regarding KOL opinions provided you stick to the GDPR rules
- Be careful to follow the specific rules governing special category data, for example if you are collecting data about patient experts
- You need to discuss how and what data you will be collecting up front and which parties are the Data Controller or Data Processor; this will enable the parties involved to fulfil their obligations under GDPR
- Establish and document your legal basis for processing
- Data subject notifications are very important – you must let your data subjects know that you are processing their data – there are definite rules around what information they need to be given. This is different from gaining consent
- Consent will be important in different circumstances, e.g., possibly where special data is under consideration, such as if you are maintaining records of expert patients which would include their personal health details
By Simon Rosenberg, Director of Research, Scout
simon.rosenberg@scoutdata.co.uk
