Negotiating the European legal landscape for big data

Sofie van der Meulen & Julian Hitchcock

Dedicated to Life Sciences

Axon Lawyers: Amsterdam

Italy Legal Focus: Milan

Lawford Davies Denoon: London, Cambridge

LCH Europe: Paris

Lützeler Klümper: Düsseldorf, Hamburg

| 2

Where do we find Big data?

| 3

© Daan Roosegaarde

4

The cloud - video

https://www.youtube.com/watch?v=ecZL4Q2EVuY

5

Example Big data analytics - video

https://www.youtube.com/watch?v=CeEDAchrc1U

Big data - EU

EU Council Summit 24/25 October 2013:"EU action should provide the right framework conditions for a single market for big data”

European Commission Digital Agenda for Europe:• https://ec.europa.eu/digital-agenda/en/making-big-data-work-e

urope

• http://ec.europa.eu/digital-agenda/en/news/big-data-what-it-and-why-it-important

Memo European Commission 7 November 2013:http://europa.eu/rapid/press-release_MEMO-13-965_en.htm

eHealth Action Plan 2012-2020 | 6

Big data in pharma

• Up to Now: randomised clinical trials

• Big data = complimentary. Larger population, patterns, personalisation. 

• From symptoms -> profiles

• Current problem: fixation on healthcare intervention and diseases. Patients don't take their drugs and that goes on until next intervention. Inefficient and bad for patient.

• Future: focus on behavioural change and management of patients to avoid intervention.

• Patent cliff.

 | 7

Patient management. Pharma meets medical devices?

There’s an app for that!

App promises for personalised medicine:

• Self-tracking & patient engagement• Big data source• Continuing adjustment of targeted therapy• Predictive analytics (next best action for patient)

And… there’s a rule for that!

• Directive 93/42/EC on medical devices

| 8

App may be regulated as medical device

Medical device: ‘Any instrument, apparatus, appliance, software, material or other article, whether used alone or in combination, including the software intended by its manufacturer to be used specifically for diagnostic and/or therapeutic purposes and necessary for its proper application, intended by the manufacturer to be used for human beings for the purpose of:

• diagnosis, prevention, monitoring, treatment or alleviation/compensation of disease or handicap

• investigation, replacement or modification of the anatomy or of a physiological process

• control of conception (art. 1.2a MDD)

General purpose software used in healthcare setting is not medical device (recital 6 Directive 2007/47)

Accessories to devices are regulated as devices in their own right

| 9

App as medical device

• Check decision trees in MEDDEV 2.1/6 to determine if app is in scope of ‘medical device’

| 10

Regulatory continuum towards medical device regulationWellness

Medical:• Diagnostic• Therapeutic

• amplify• analysis• interpret• alarms• calculates• controls• converts• detects• diagnose• measures• monitors

• trend• alter• highlight

• search• transfer• move• store• display• count

Big Data IP

• Databases

• Algorithms (models and programs)

• Products

• Functional diagnostics

| 11

12

IP: Databases

• Copyright

• “original” only if “selection or arrangement of contents is author’s own intellectual creation”.

• Infringement by translation or making an altered version.

13

IP: Databases

• EU Database rights (Directive 96/9)

• Excludes programs used in making/operating database.

• Qualification (EU)

• “Database”: “a collection of independent works*, data or other materials which (a) are arranged in a systematic or methodological way and (b) are individually accessible by electronic or other means”.

• Maker’s right where substantial investment (qualitatively/ quantitatively) in making the database.

• 15 years from making or, if during that period, publication.

• Infringement by extraction and re-utilisation of substantial parts or repeated and systematic re-utilisation of insubstantial parts.

14

IP: Mathematical Models

•Copyright – expression.• Mathematical models “as such” patent excluded (A52EPC).

• A method that “is carried out on numbers and provides a result in numerical form” (Vicom, EPO 1987).

• Technical contribution (e.g. enhancing digital images) saves.• Real-world data in real-world mathematical models

• Excluded “as such”, but not if process makes a technical contribution (e.g. geophysical data in seismic imaging).

• Analysis of real-world data may escape being “as such”:• (e.g. chromatography and spectroscopy followed by sequence of

data analyses to give particular results held to lie in field of chromatographic/spectoscopic sample analysis.

15

IP: Computer Programs

• Computer programs are also excluded “as such” (A52EPC).• Where invention relates to practical application of the

mathematical method (e.g. computer square root calculator), it is not “as such” but may be excluded as a computer program “as such” (Gale’s Application, UK 1991).

• What process does the program cause the computer to perform?• Does this make a technical contribution to the art (e.g. does it

solve a problem)?• Symbian’s Application (UKCA 2009): wrong to suggest that a clear

rule of exclusion exists. Given pace of technological development, each case should be determined on its particular facts.

• Copyright

16

IP: Products

• Discoveries and theories• Genentech (UKCA 1989): amino acid sequence for tPA a mere

discovery, but incorporating sequence into a manufacturing process is OK.

• Art 5 Directive 98/44 (Biotechnology Directive):• (1) “The human body… and simple discovery of one of its

elements, including the sequence or partial sequence of a gene, cannot constitute patentable inventions.”

• (2)“An element isolated from the human body or otherwise produced by means of a technical process, including the sequence or partial sequence of a gene, may constitute a patentable invention, even if the structure of that element is identical to that of a natural element.”

• (3) “The industrial application of a sequence or a partial sequence of a gene must be disclosed in the patent application.”

• Data mining

17

IP: Products –industrial application

• Big data invention: from wet to in silico biology.• Data mining:

• basic homology searches• pattern recognition (e.g. transmembrane regions)• Motif recognition (e.g. regulatory sequences)• Higher levels….

• Art 57 EPC: “susceptible to industrial application”.

18

IP: Products –industrial application

• Human Genome Sciences v Eli Lilly (UKSC 2011).• Neutrokine-β identified by data-mining• Claim: function assigned based on homology to other members of

TNF ligand superfamily, without supporting in vivo or in vitro study data.

• Held:• Need “practical application” and “some profitable use”;

expectation of commercial benefit;• A “vague and speculative indication of possible objectives that

might or might not be achievable” will be insufficient.• Skilled person should be able to reproduce or exploit without

“undue burden”.• A “plausible” reasonably credible” or “educated guess” suffices.

• Association of Molecular Pathology v Myriad (USSC 2013)

19

IP: Products – functional diagnostics

• Big data can redefine disease: from phenomenological towards aetiological…

• Are sub-diseases, their therapies and (companion) diagnostics new? Obvious to identify?

• Even without patent protection, 10 years’ market exclusivity on medicinal products is possible:• if 5 sufferers per 10 thousand; or• where intended for a life threatening, seriously debilitating or

serious and chronic condition.• Product / companion diagnostic – be wary of agreements that

prevent, restrict or distort competition or abuse a dominant position.

Big data - data protection

Green paper on mHealth: European Commission admits limits of EU regulation competence:

“many of the issues raised may not be in competence of EU law”

One of the issues “at stake”: data protection, including security• Currently: Data Protection Directive (95/46/EC)• in flux: General Data Protection Regulation proposal• EU approach: fundamental right (Article 8 European Convention

on Human Rights) -> emphasis on data subject interests• Horizontal approach to all data -> collateral damage in healthcare

sector!

| 20

Big data– personal data?

Collecting and processing data may give rise to personal data processing and related obligations.

• Criterion: information is related to data subject that are identified or identifiable, whether directly or indirectly

• related to: “data relates to an individual if it refers to the identity, characteristics or behaviour of an individual or if such information is used to determine or influence the way in which that person is treated or evaluated” (WP136)

| 21

22

Big data – personal data?

• Identifiable: “to determine whether a person is identifiable account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person.” (WP136)

• Not identifiable if [clinical trial example]: “serial numbers attributed randomly to each clinical case, in order to ensure coherence and to avoid confusion with information on different patients. The names of patients stay exclusively in possession of the respective doctors bound by medical secrecy.” (WP 136)

23

Processing of personal health data

• Health data is special category of data - processing prohibited UNLESS

• Consent: “…any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”. Special data? Explicit consent required (see article 29 WP Opinion 15/2011).

• Consent obtained in clinical context valid? Consent to treatment = consent to processing data?

24

Processing of personal health data

OR• processing of the data is required for the purposes of preventive

medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy (treatment exemption)

Processing of personal data - security

Appropriate technical & organizational measures to protect data.

| 25

Security

| 26

• Surveillance practices (PRISM)• Data transfer & security? • Safe Harbor Certification merely means that the transfer of personal data

to the US is allowed in principle because it demonstrates the adequacy of the US as jurisdiction

• Social engineering?

• Cloud & security:

WP 196 on Cloud Computing

! Data controller remains responsible for compliance!

Data protection - GDPR

EU General Data Protection Regulation in the works; proposal released on 25 January 2012

• Informed consent and burden of proof it was obtained

• Privacy by design – software & devices have to be designed and built as to enable GDPR and data subject’s rights by default

• EU delegated acts to specify technical standards related to GDPR requirements

• High fines (up to 2% annual WW turnover)

• Privacy officers mandatory for large companies

• Privacy impact assessment mandatory for each act of processsing

| 27

GDPR – important definitions

• Article 4 (10) 'genetic data’

“all data, of whatever type, concerning the characteristics of an individual which are inherited or acquired during early prenatal development”

• Article 4 (12) ‘data concerning health’

“any information which relates to the physical or mental health of an individual, or to the provision of health services to the individual”

Clarification is needed around ‘genetic data’ and ‘data concerning health’ to ensure that these definitions are only intended to apply to personal data that falls within these categories, rather than all related data.

| 28

29

?? ?

?

GDPR – processing of personal data

Processing of genetic data or data concerning health (article 9)

• only with consent; OR• processing of data concerning health is necessary for health

purposes and subject to conditions and safeguards (Article 81); OR

• processing is necessary for historical, statistical or scientific research purposes subject to conditions and safeguards (Article 83)

• controller has burden of proving that the data subject has given the consent to the processing operation

• consent is not a valid legal ground for the processing of personal data, where there is a clear imbalance between the data subject and the controller (likely: HCP / patient relation)

| 30

GDPR - anonymisation

• Anonymous data falls outside of the scope of the Regulation. However, the act of removing identifiers to ensure that data are no longer personal – anonymisation – could fall within the definition of processing (Article 4).

• Not clear about how ‘personal data’ relates to the different types of data used in research and data collection for meeting regulatory obligations (registry, PMCF studies) – anonymised data; key-coded or pseudonymised data; and identifiable data

• Clarity in the scope is essential so that those sharing and using patient data in research and to meet regulatory obligations are fully aware of their responsibilities, but do not implement beyond the requirements that are necessary in law

| 31

GDPR – profiling

Profiling (Article 20)

Limits to "profiling”, a technique used to analyse or predict a person's performance at work, economic situation, location, health, preferences, reliability or behaviour based on the automated processing of his/her personal data.

| 32

33

GDPR – right to erasure

• The right to withdraw consent and right to erasure (Article 17 GDPR)

Difficult to implement if data is stored in archived backups

• Real risk that statistical analyses will be “depowered” as a result of such changes as result of exercise of rights (particularly in the case of orphan diseases or conditions with difficult inclusion and exclusion criteria, such as paediatratic), thereby calling into question existing registrations (let alone future developments).

Result, clinical trials and clinical investigations will be conducted outside Europe to avoid any such risk.

Medical Devices Regulation (MDR)

• Medical Device: “any instrument, apparatus, appliance, software, implant, reagent, material or other article, intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the specific direct or indirect medical purposes of… diagnosis, prevention, monitoring, prediction, treatment or alleviation of disease.”

• Accessory: ““an article which, whilst not being a medical device, is intended by its manufacturer to be used together with one or several particular medical device(s) to specifically enable the device(s) to be used in accordance with its/their intended purpose(s); or to specifically assist the medical functionality of the medical device(s) in view of its/their intended purpose(s)”

• Medical Devices and Accessories are referred to as “devices”.

| 34

MDR: “Information Society Services”

• Devices “offered by means of information society services” to natural or legal persons established in the Union must comply with the Regulation

• Includes devices and accessories that are offered to natural or legal persons in the EU by means of services that is “normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services”.• “At a distance” means that the service is provided without the

parties being simultaneously present.• Devices used in medical examinations or treatment at a doctor's

surgery using electronic equipment where the patient is physically present are not deemed to be used in an “information society service” but will be caught by other provisions of the MDR.

| 35

IVD Regulation

• IVD includes “apparatus, equipment, software or system, whether used alone or in combination, intended by the manufacturer to be used in vitro for the examination of specimens… solely or principally for the purpose of providing information:• concerning a physiological or pathological state; • concerning a congenital abnormality physical or mental

impairments; • concerning the predisposition to a medical condition or a disease; • to determine the safety and compatibility with potential recipients; • to predict treatment response or reactions; • to define or monitor therapeutic measures.”

| 36

IVD Regulation

• Digitisation of the information for later analysis in silico... ?• Bioinformatics: later analysis is inherent. Invariably, such systems

are used “in combination” with primary devices for acquisition: mere sequencing.

• Sequencing per se merely endeavours to confirm sequences of nucleotide bases. It’s an assay, not a test.

• Interpretation is what happens downstream, at a time when the specimen itself may have been discarded.

• Intention: if the manufacturer of the acquisition apparatus intends it to be used “in combination” with the bioinformatic system, then does that other system become an “accessory to an in vitro medical device” and, therefore, susceptible to the Regulation?

| 37

IVD Regulation

• “Accessory” to an IVD: “an article which…, is intended by its manufacturer to be used together with one or several particular IVDs to specifically enable or assist the IVD to be used in accordance with its/their intended purpose(s).”

• “Device for self testing”: “any device intended by the manufacturer to be used by lay persons, including testing services offered to lay persons by means of information society services.”

• “Companion diagnostic”: “a device specifically intended and essential for the selection of patients with a previously diagnosed condition or predisposition as suitable and unsuitable for a specific therapy with a medical product or a range of medicinal products.”

• “Device for genetic testing”: “an IVD the purpose of which is to identify a genetic characteristic of a person which is inherited or acquired during prenatal development.”

| 38

Art 4a (genetic information, counselling & informed consent)

• A device may only be used for the purpose of a genetic test if the indication is given by persons admitted to the medical profession under the applicable national legislation after a personal consultation.

• A device may be used for purposes of a genetic test only in a way that the rights, safety and well-being of the subjects are protected and that the clinical data generated in the course of the genetic testing are going to be reliable and robust.

• Information. Before using a device for the purpose of a genetic test the person mentioned in paragraph 1 shall provide the person concerned with appropriate information on the nature, the significance and the implications of the genetic test.

| 39

Art 4a (genetic information, counselling & informed consent)

• Genetic counselling. Appropriate genetic counselling is mandatory before using a device for the purpose of predictive and prenatal testing and after a genetic condition has been diagnosed. It shall include medical, ethical, social, psychological and legal aspects and has to be addressed by physicians or another person qualified under national law in genetic counselling. The form and extent of this genetic counselling shall be defined according to the implications of the results of the test and their significance for the person or the members of his or her family.

• Consent. A device may only be used for the purpose of a genetic test after the person concerned has given free and informed consent to it. The consent has to be given explicitly and in writing. It can be revoked at any time in writing or orally.

| 40

MDR/IVD Regulation: will they happen?

• 2 April 2014: European Parliament:• “Adopts as its position at first reading the text adopted on 22

October 2013”• “Calls on the Commission to refer the matter to Parliament again if

it intends to amend its proposal substantially or replace it with another text;”

• New Commission, new Rapporteur for MDR.• Same Rapporteur for IVD Reg.• IVD Reg: constitutional?

| 41

Legal stuff - Disclaimer

The information in this presentation is not exhaustive and is provided for information and education purposes only. While every endeavour is made to ensure that the information is correct at the time of publication, the legal position may change as a result of matters including new legislative developments, new case law, local implementation variations or other developments. The information does not take into account the specifics of any person's position and may be wholly inappropriate for your particular circumstances. The information is not intended to be legal advice, cannot be relied on as legal advice and should not be a substitute for legal advice.

| 42

Thank you for your attention!

sofie.vandermeulen@axonlawyers.com

julian@lawforddaviesdenoon.com