Presentation Alliance of European Life Sciences Law Firms (Julian Hitchcock and Sofie van der Meulen) on legal aspects of big data in pharma. Topics: privacy, IP, medical devices and IVD.

1. Negotiating the European legal
landscape for big data

2. Axon Lawyers: Amsterdam
Italy Legal Focus: Milan
Lawford Davies Denoon: London, Cambridge
LCH Europe: Paris
Lützeler Klümper: Düsseldorf, Hamburg
Dedicated to Life Sciences
| 1

3. Where do we find Big data?
| 2
© Daan Roosegaarde

4. The cloud - video
3
https://www.youtube.com/watch?v=ecZL4Q2EVuY

5. Example Big data analytics - video
4
https://www.youtube.com/watch?v=CeEDAchrc1U

6. Big data - EU
EU Council Summit 24/25 October 2013:
"EU action should provide the right framework conditions for a single
market for big data”
European Commission Digital Agenda for Europe:
• https://ec.europa.eu/digital-agenda/en/making-big-data-work-europe
• http://ec.europa.eu/digital-agenda/en/news/big-data-what-it-and-
why-it-important
Memo European Commission 7 November 2013:
http://europa.eu/rapid/press-release_MEMO-13-965_en.htm
eHealth Action Plan 2012-2020
| 5

7. Big data in pharma
• Up to Now: randomised clinical trials
• Big data = complimentary. Larger population, patterns,
personalisation.
• From symptoms -> profiles
• Current problem: fixation on healthcare intervention and diseases.
Patients don't take their drugs and that goes on until next
intervention. Inefficient and bad for patient.
• Future: focus on behavioural change and management of patients
to avoid intervention.
• Patent cliff.
| 6

8. Patient management. Pharma meets
medical devices?
There’s an app for that!
App promises for personalised medicine:
• Self-tracking & patient engagement
• Big data source
• Continuing adjustment of targeted therapy
• Predictive analytics (next best action for patient)
And… there’s a rule for that!
• Directive 93/42/EC on medical devices
| 7

9. App may be regulated as medical device
Medical device: ‘Any instrument, apparatus, appliance, software,
material or other article, whether used alone or in combination,
including the software intended by its manufacturer to be used
specifically for diagnostic and/or therapeutic purposes and necessary
for its proper application, intended by the manufacturer to be used for
human beings for the purpose of:
• diagnosis, prevention, monitoring, treatment or
alleviation/compensation of disease or handicap
• investigation, replacement or modification of the anatomy or
of a physiological process
• control of conception (art. 1.2a MDD)
General purpose software used in healthcare setting is not medical
device (recital 6 Directive 2007/47)
Accessories to devices are regulated as devices in their own right
| 8

10. App as medical device
• Check decision trees in MEDDEV 2.1/6 to determine if app is in
scope of ‘medical device’
| 9
Wellness Regulatory continuum towards medical device regulation
Medical:
• Diagnostic
• Therapeutic
• amplify
• analysis
• interpret
• alarms
• calculates
• controls
• converts
• detects
• diagnose
• measures
• monitors
• trend
• alter
• highlight
• search
• transfer
• move
• store
• display
• count

11. Big Data IP
• Databases
• Algorithms (models and programs)
• Products
• Functional diagnostics
| 10

12. IP: Databases
• Copyright
• “original” only if “selection or arrangement of contents is author’s
own intellectual creation”.
• Infringement by translation or making an altered version.
11

13. IP: Databases
• EU Database rights (Directive 96/9)
• Excludes programs used in making/operating database.
• Qualification (EU)
• “Database”: “a collection of independent works*, data or other
materials which (a) are arranged in a systematic or methodological
way and (b) are individually accessible by electronic or other
means”.
• Maker’s right where substantial investment (qualitatively/
quantitatively) in making the database.
• 15 years from making or, if during that period, publication.
• Infringement by extraction and re-utilisation of substantial parts
or repeated and systematic re-utilisation of insubstantial parts.
12

14. IP: Mathematical Models
• Copyright – expression.
• Mathematical models “as such” patent excluded (A52EPC).
• A method that “is carried out on numbers and provides a result in
numerical form” (Vicom, EPO 1987).
• Technical contribution (e.g. enhancing digital images) saves.
• Real-world data in real-world mathematical models
• Excluded “as such”, but not if process makes a technical contribution
(e.g. geophysical data in seismic imaging).
• Analysis of real-world data may escape being “as such”:
• (e.g. chromatography and spectroscopy followed by sequence of
data analyses to give particular results held to lie in field of
chromatographic/spectoscopic sample analysis.
13

15. IP: Computer Programs
• Computer programs are also excluded “as such” (A52EPC).
• Where invention relates to practical application of the
mathematical method (e.g. computer square root calculator), it is
not “as such” but may be excluded as a computer program “as
such” (Gale’s Application, UK 1991).
• What process does the program cause the computer to perform?
• Does this make a technical contribution to the art (e.g. does it
solve a problem)?
• Symbian’s Application (UKCA 2009): wrong to suggest that a clear
rule of exclusion exists. Given pace of technological development,
each case should be determined on its particular facts.
• Copyright
14

16. IP: Products
• Discoveries and theories
• Genentech (UKCA 1989): amino acid sequence for tPA a mere
discovery, but incorporating sequence into a manufacturing
process is OK.
• Art 5 Directive 98/44 (Biotechnology Directive):
• (1) “The human body… and simple discovery of one of its
elements, including the sequence or partial sequence of a gene,
cannot constitute patentable inventions.”
• (2)“An element isolated from the human body or otherwise
produced by means of a technical process, including the sequence
or partial sequence of a gene, may constitute a patentable
invention, even if the structure of that element is identical to that of
a natural element.”
• (3) “The industrial application of a sequence or a partial sequence
of a gene must be disclosed in the patent application.”
15

17. IP: Products –industrial application
• Big data invention: from wet to in silico biology.
• Data mining:
• basic homology searches
• pattern recognition (e.g. transmembrane regions)
• Motif recognition (e.g. regulatory sequences)
• Higher levels….
• Art 57 EPC: “susceptible to industrial application”.
16

18. IP: Products –industrial application
• Human Genome Sciences v Eli Lilly (UKSC 2011).
• Neutrokine-β identified by data-mining
• Claim: function assigned based on homology to other members of
TNF ligand superfamily, without supporting in vivo or in vitro
study data.
• Held:
• Need “practical application” and “some profitable use”;
expectation of commercial benefit;
• A “vague and speculative indication of possible objectives that
might or might not be achievable” will be insufficient.
• Skilled person should be able to reproduce or exploit without
“undue burden”.
• A “plausible” reasonably credible” or “educated guess” suffices.
• Association of Molecular Pathology v Myriad (USSC 2013)
17

19. IP: Products – functional diagnostics
• Big data can redefine disease: from phenomenological
towards aetiological…
• Are sub-diseases, their therapies and (companion) diagnostics
new? Obvious to identify?
• Even without patent protection, 10 years’ market exclusivity on
medicinal products is possible:
• if 5 sufferers per 10 thousand; or
• where intended for a life threatening, seriously debilitating or
serious and chronic condition.
• Product / companion diagnostic – be wary of agreements that
prevent, restrict or distort competition or abuse a dominant
position.
18

20. Big data - data protection
Green paper on mHealth: European Commission admits limits of EU
regulation competence:
“many of the issues raised may not be in competence of EU law”
One of the issues “at stake”: data protection, including security
• Currently: Data Protection Directive (95/46/EC)
• in flux: General Data Protection Regulation proposal
• EU approach: fundamental right (Article 8 European Convention
on Human Rights) -> emphasis on data subject interests
• Horizontal approach to all data -> collateral damage in healthcare
sector!
| 19

21. Big data– personal data?
Collecting and processing data may give rise to personal data
processing and related obligations.
• Criterion: information is related to data subject that are identified
or identifiable, whether directly or indirectly
• related to: “data relates to an individual if it refers to the identity,
characteristics or behaviour of an individual or if such information
is used to determine or influence the way in which that person is
treated or evaluated” (WP136)
| 20

22. Big data – personal data?
• Identifiable: “to determine whether a person is identifiable
account should be taken of all the means likely reasonably to be
used either by the controller or by any other person to identify the
said person.” (WP136)
• Not identifiable if [clinical trial example]: “serial numbers
attributed randomly to each clinical case, in order to ensure
coherence and to avoid confusion with information on different
patients. The names of patients stay exclusively in possession of
the respective doctors bound by medical secrecy.” (WP 136)
21

23. Processing of personal health data
• Health data is special category of data - processing prohibited
UNLESS
• Consent: “…any freely given specific and informed indication of his
wishes by which the data subject signifies his agreement to personal
data relating to him being processed”. Special data? Explicit
consent required (see article 29 WP Opinion 15/2011).
• Consent obtained in clinical context valid? Consent to treatment =
consent to processing data?
22

24. Processing of personal health data
OR
• processing of the data is required for the purposes of preventive
medicine, medical diagnosis, the provision of care or treatment or
the management of health-care services, and those data are
processed by a health professional subject under national law or
rules established by national competent bodies to the obligation of
professional secrecy or by another person also subject to an
equivalent obligation of secrecy (treatment exemption)
23

25. Processing of personal data - security
Appropriate technical & organizational measures to protect data.
| 24

26. Security
• Surveillance practices (PRISM)
• Data transfer & security?
• Safe Harbor Certification merely means that the transfer of personal data
to the US is allowed in principle because it demonstrates the adequacy of
the US as jurisdiction
| 25
• Social engineering?
• Cloud & security:
WP 196 on Cloud Computing
! Data controller remains responsible for compliance!

27. Data protection - GDPR
EU General Data Protection Regulation in the works; proposal released
on 25 January 2012
• Informed consent and burden of proof it was obtained
• Privacy by design – software & devices have to be designed and
built as to enable GDPR and data subject’s rights by default
• EU delegated acts to specify technical standards related to GDPR
requirements
• High fines (up to 2% annual WW turnover)
• Privacy officers mandatory for large companies
• Privacy impact assessment mandatory for each act of processsing
| 26

28. GDPR – important definitions
• Article 4 (10) 'genetic data’
“all data, of whatever type, concerning the characteristics of an
individual which are inherited or acquired during early prenatal
development”
• Article 4 (12) ‘data concerning health’
“any information which relates to the physical or mental health of an
individual, or to the provision of health services to the individual”
Clarification is needed around ‘genetic data’ and ‘data concerning
health’ to ensure that these definitions are only intended to apply to
personal data that falls within these categories, rather than all related
data.
| 27

29. 28
?
?
? ?

30. GDPR – processing of personal data
Processing of genetic data or data concerning health (article 9)
• only with consent; OR
• processing of data concerning health is necessary for health
purposes and subject to conditions and safeguards (Article 81);
OR
• processing is necessary for historical, statistical or scientific
research purposes subject to conditions and safeguards (Article
83)
• controller has burden of proving that the data subject has given
the consent to the processing operation
• consent is not a valid legal ground for the processing of personal
data, where there is a clear imbalance between the data subject
and the controller (likely: HCP / patient relation)
| 29

31. GDPR - anonymisation
• Anonymous data falls outside of the scope of the Regulation.
However, the act of removing identifiers to ensure that data are no
longer personal – anonymisation – could fall within the definition
of processing (Article 4).
• Not clear about how ‘personal data’ relates to the different types
of data used in research and data collection for meeting regulatory
obligations (registry, PMCF studies) – anonymised data; key-coded
or pseudonymised data; and identifiable data
• Clarity in the scope is essential so that those sharing and using
patient data in research and to meet regulatory obligations are
fully aware of their responsibilities, but do not implement beyond
the requirements that are necessary in law
| 30

32. GDPR – profiling
Profiling (Article 20)
Limits to "profiling”, a technique used to analyse or predict a person's
performance at work, economic situation, location, health,
preferences, reliability or behaviour based on the automated
processing of his/her personal data.
| 31

33. GDPR – right to erasure
• The right to withdraw consent and right to erasure (Article 17
GDPR)
Difficult to implement if data is stored in archived backups
• Real risk that statistical analyses will be “depowered” as a result of
such changes as result of exercise of rights (particularly in the case
of orphan diseases or conditions with difficult inclusion and
exclusion criteria, such as paediatratic), thereby calling into
question existing registrations (let alone future developments).
Result, clinical trials and clinical investigations will be
conducted outside Europe to avoid any such risk.
32

34. Medical Devices Regulation (MDR)
• Medical Device: “any instrument, apparatus, appliance, software,
implant, reagent, material or other article, intended by the
manufacturer to be used, alone or in combination, for human
beings for one or more of the specific direct or indirect medical
purposes of… diagnosis, prevention, monitoring, prediction,
treatment or alleviation of disease.”
• Accessory: ““an article which, whilst not being a medical device, is
intended by its manufacturer to be used together with one or several
particular medical device(s) to specifically enable the device(s) to be
used in accordance with its/their intended purpose(s); or to
specifically assist the medical functionality of the medical device(s)
in view of its/their intended purpose(s)”
• Medical Devices and Accessories are referred to as “devices”.
| 33

35. MDR: “Information Society Services”
• Devices “offered by means of information society services” to
natural or legal persons established in the Union must comply
with the Regulation
• Includes devices and accessories that are offered to natural or
legal persons in the EU by means of services that is “normally
provided for remuneration, at a distance, by electronic means and at
the individual request of a recipient of services”.
• “At a distance” means that the service is provided without the
parties being simultaneously present.
• Devices used in medical examinations or treatment at a doctor's
surgery using electronic equipment where the patient is physically
present are not deemed to be used in an “information society
service” but will be caught by other provisions of the MDR.
| 34

36. IVD Regulation
• IVD includes “apparatus, equipment, software or system, whether
used alone or in combination, intended by the manufacturer to be
used in vitro for the examination of specimens… solely or
principally for the purpose of providing information:
• concerning a physiological or pathological state;
• concerning a congenital abnormality physical or mental
impairments;
• concerning the predisposition to a medical condition or a disease;
• to determine the safety and compatibility with potential recipients;
• to predict treatment response or reactions;
• to define or monitor therapeutic measures.”
| 35

37. IVD Regulation
• Digitisation of the information for later analysis in silico... ?
• Bioinformatics: later analysis is inherent. Invariably, such systems
are used “in combination” with primary devices for acquisition:
mere sequencing.
• Sequencing per se merely endeavours to confirm sequences of
nucleotide bases. It’s an assay, not a test.
• Interpretation is what happens downstream, at a time when the
specimen itself may have been discarded.
• Intention: if the manufacturer of the acquisition apparatus
intends it to be used “in combination” with the bioinformatic
system, then does that other system become an “accessory to an in
vitro medical device” and, therefore, susceptible to the
Regulation?
| 36

38. IVD Regulation
• “Accessory” to an IVD: “an article which…, is intended by its
manufacturer to be used together with one or several particular
IVDs to specifically enable or assist the IVD to be used in accordance
with its/their intended purpose(s).”
• “Device for self testing”: “any device intended by the
manufacturer to be used by lay persons, including testing services
offered to lay persons by means of information society services.”
• “Companion diagnostic”: “a device specifically intended and
essential for the selection of patients with a previously diagnosed
condition or predisposition as suitable and unsuitable for a specific
therapy with a medical product or a range of medicinal products.”
• “Device for genetic testing”: “an IVD the purpose of which is to
identify a genetic characteristic of a person which is inherited or
acquired during prenatal development.”
| 37

39. Art 4a (genetic information, counselling
& informed consent)
• A device may only be used for the purpose of a genetic test if the
indication is given by persons admitted to the medical profession
under the applicable national legislation after a personal
consultation.
• A device may be used for purposes of a genetic test only in a way
that the rights, safety and well-being of the subjects are protected
and that the clinical data generated in the course of the genetic
testing are going to be reliable and robust.
• Information. Before using a device for the purpose of a genetic test
the person mentioned in paragraph 1 shall provide the person
concerned with appropriate information on the nature, the
significance and the implications of the genetic test.
| 38

40. Art 4a (genetic information, counselling
& informed consent)
• Genetic counselling. Appropriate genetic counselling is mandatory
before using a device for the purpose of predictive and prenatal
testing and after a genetic condition has been diagnosed. It shall
include medical, ethical, social, psychological and legal aspects and
has to be addressed by physicians or another person qualified under
national law in genetic counselling. The form and extent of this
genetic counselling shall be defined according to the implications of
the results of the test and their significance for the person or the
members of his or her family.
• Consent. A device may only be used for the purpose of a genetic test
after the person concerned has given free and informed consent to
it. The consent has to be given explicitly and in writing. It can be
revoked at any time in writing or orally.
| 39

41. MDR/IVD Regulation: will they happen?
• 2 April 2014: European Parliament:
• “Adopts as its position at first reading the text adopted on 22
October 2013”
• “Calls on the Commission to refer the matter to Parliament again if
it intends to amend its proposal substantially or replace it with
another text;”
• New Commission, new Rapporteur for MDR.
• Same Rapporteur for IVD Reg.
• IVD Reg: constitutional?
| 40

42. Legal stuff - Disclaimer
The information in this presentation is not exhaustive and is provided for information
and education purposes only. While every endeavour is made to ensure that the
information is correct at the time of publication, the legal position may change as a
result of matters including new legislative developments, new case law, local
implementation variations or other developments. The information does not take into
account the specifics of any person's position and may be wholly inappropriate for your
particular circumstances. The information is not intended to be legal advice, cannot be
relied on as legal advice and should not be a substitute for legal advice.
| 41

43. Thank you for your attention!
sofie.vandermeulen@axonlawyers.com
julian@lawforddaviesdenoon.com