The CNIL (the French data protection authority) has published new practical recommendations on how to process personal data in the context of compassionate prescriptions (CPC) in France — a reminder that regulatory flexibility regarding treatments does not mean flexibility regarding data protection.

These derogatory market access schemes, which allow a medicinal product to be prescribed for a therapeutic indication other than the one covered by its marketing authorisation (MA), involve the processing of particularly sensitive health data when they are accompanied by a therapeutic use and patient monitoring protocol (PUT-SP). As such, they require a clear legal framework from a data protection perspective.

Key takeaways:

  • For CPCs initiated before 11 November 2022 (and possibly renewed): compliance with the former single authorisation AU-041 is required.
  • For CPCs initiated after that date: a prior authorisation request must be filed with the CNIL.

The CNIL strongly encourages companies to file a prior consultation as soon as the ANSM initiates the CPC procedure — in order to support them and facilitate the review of their authorisation request.

And if existing data systems are used, make sure they comply with the CNIL’s reference framework on compassionate use.

An essential compliance step for pharmaceutical companies involved in compassionate use.