ARTICLE 29 DATA PROTECTION WORKING PARTY

the Privacy Shield cannot cover such transfers. The WP29 calls on the EU Commission to
explicitly provide that the draft adequacy decision will not cover the transfer of key-coded
data for pharmaceutical or medical reasons and as a consequence, such transfers must be
covered by other safeguards, such as Standard Contractual Clauses (hereinafter: SCCs) or
BCRs. The WP29 suggests this could be clarified in the final adequacy decision.
Transfers for Regulatory and supervision purposes (Annex II, III.14.d)
The WP29 is concerned that under these provisions personal data which is due to the medical
context mostly of sensitive nature may be transferred to regulators in the U.S. Since the
Privacy Shield is designed for data transfers between private entities it appears that a public
body like a U.S. regulator is not eligible to self-certify under the Privacy Shield which raises
the question of adequate data protection for such transfers. If such transfers need to be
administered for regulatory purposes, appropriate measures must be taken to ensure
continuous protection of EU data subject’s fundamental rights. The WP29 underlines the fact
that the draft adequacy decision does not provide any findings on this point. Therefore, the
WP29 does not have any guarantee that the sensitive data of EU-data subjects will enjoy
adequate protection in this context.
Additionally, the WP29 notes it does not understand why the purpose of ‘marketing’ is listed
as an example of processing for future scientific research. Also the reason to place onward
transfers to company locations and other researchers (Annex II, III.14.d) under the heading
“Transfers for Regulatory and Supervision Purposes” is unclear. These issues require
clarification in the final adequacy decision.
Product Safety, Efficacy monitoring (including reporting to government agencies) and
tracking of patients using certain medicines or medical devices
The Privacy Shield provides for an exemption to the Notice, Choice, Onward transfer and
Access principles to the extent that adherence to the Principle interferes with compliance with
regulatory requirements. The Draft Adequacy decision does not provide for any findings as
regards the situation where Privacy Principles interferes with compliance with regulatory
requirements. If the WP29 might understand that governments investigations may justify
limits to Notice and the right of Access to protect investigations, the WP29 does not see the
reasons that can justify such broad exemptions where processing are taking place by the
organisation or by a third party in the private sector. For instance, as the treatments of patients
are more and more individualised, such a broad exemption of the Privacy principles in case of
tracking of patients using certain medicines or medical devices is unacceptable as this type of
care will become common. This also applies where data are used by pharmaceutical
companies for Product Safety, Efficacy monitoring (test or sale of new medicines).
2.2.9 Publicly available information
The exception to the right of access in the case of publicly available information and public
record information (Annex II, III.15.d and e) raises concerns to the extent that an individual,
32