Considerations for Privacy Laws Involving Health Data
3rd May 2022
About GMTA
The Global Medical Technology Alliance (GMTA) member associations represent companies thatproduce nearly 85 percent of the health care technology purchased and utilized annually aroundthe world. These technologies are transforming health care through earlier disease detection, lessinvasive procedures, and more effective treatments. Our companies range from the largest to thesmallest innovators and bring medical technology to patients worldwide in every setting. TheGMTA is committed to the highest ethical and legal standards for the best interest of patients andpublic health1.
Background
Many governments around the world have adopted privacy and/or data protection legislation, andover thirty have pending draft laws or initiatives2. As policymakers develop and advance privacy
and data protection legislation, we want to raise awareness about the importance of health data
and the key role of medical technology companies in patient care to ensure that this data cancontinue to be utilized to provide the highest levels of care for patients. We welcome any
opportunity to work with policymakers in their process of developing privacy and data protection
legislation.

Health data & the MedTech industry
The collection, sharing and use of health data is fundamental to advancing healthcare, researchand innovation, ensuring the highest levels of safety and quality that also translate to improved
health outcomes at lower total cost. As part of the development of new technologies and as partof their roll-out to healthcare systems, the medical technology (“medtech”) industry develops andis required to process health data. Over the past years, the medtech industry delivered majoradvances involving digital components relying on data in areas including cardiac pacemakers,
deep brain stimulation, sleep disorders, intravascular ultrasound, artificial hips and knees, disease
screening and diagnostics, anti-microbial resistance (AMR) testing, glucose monitors, and also
solutions that are helping to fight COVID-19 and strengthening pandemic response andpreparedness.

1 For more information about GMTA, please see:

http://www.globalmedicaltechnologyalliance.org/about.html
2 See Banisar, David, National Comprehensive Data Protection/Privacy Laws and Bills 2021 (August 30,2021). Available at:https://www.researchgate.net/publication/337060085_National_Comprehensive_Data_ProtectionPrivacy_
Laws_and_Bills_Map_-_August_2021_UpdateHealth data also enables new ways of personal management of one's health and lifestyle. It canbe integrated across a variety of platforms to enable better clinical care practice and decisionmaking. Combining health data from different sources in an appropriate manner can empower
people with information to improve their health and deliver more robust evidence for the efficacyof treatments. Data-driven research and innovation has and will continue to deliver benefits acrossthe care spectrum, from diagnosis to cure. In short, the appropriate use of health data brings
enormous benefits for people, healthcare professionals, and healthcare systems.

International dimension of data flows
Data flows are critical to the research and development of new technologies, the monitoring of
the safety and effectiveness of existing products for providing support services for medical
technologies currently in use, and for compliance with regulatory obligations and best practices.
In order to be able to effectively and efficiently develop, manufacture, and distribute medical
technologies, medtech companies need to be able to operate and collaborate internationally.
The medtech industry is one of the most highly regulated at every stage of device development,from the initial research to the post market surveillance that occurs after the device is on themarket. Throughout all stages, numerous safeguards are in place to protect the privacy andconfidentiality of the health data, and these safeguards also ensure that data transferred are used
only for permissible purposes.
Considerations for policymakers
GMTA supports a coherent approach to data privacy and data protection that takes into accountthe unique nature and importance of personal health data and deidentified health data used by
the medtech industry, and commends policymakers for their attention to this important issue. To
support continued research and innovation in healthcare through the responsible use of personaland de-identified health data, GMTA recommends the following considerations when developing
privacy and/or data protection legislation:

3•

Clear definitions and terminology: when developing data protection and privacy
legislation, we recommend including in the data protection/privacy law clear definitions toavoid terminology which could be confused with similar concepts used in otherjurisdictions. For example, the meaning of ‘personal data’ is different from one jurisdiction
to another. In some, it may also include data related to legal persons while others only
protect data of natural persons. In addition, the type of personal data falling under thatdefinition can also differ varying from names and contact information of residents in one
country, to any information related to an individual physically present in another.

•Consistency with principles, standards and practices of international organizations
and/or international treaties3. This will be an important element facilitating market accesswith other trade partners and advancing the economic growth of the country.

For example, internationally established principles are: Collection Limitation, Data Quality, Purpose
Specification, Use Limitation, Security, Transparency, Individual Participation and Accountability.

•Mechanisms for sharing health data across borders: the unique nature of health dataand its complex use needs to be considered to foster research and innovation and to makehealthcare accessible and available across borders.

•Data localization requirements: While there are cases where certain data localization
requirements might be justified, data localization poses a major barrier to data flow, andadd unnecessary cost and delay. Free and secure flow of data contributes significantly todigital innovation, technological advancements, and even the ability to provide healthcare.
Regulators should consider adopting a more risk-based regulatory approach to protect
data, allow secure and controlled exchange of information while supporting innovation andadvancing the competitiveness of the country.

•Exceptions to individual’s right to privacy: exceptions should only be possible in limited
cases and when prescribed by law. We recommend cautiousness when implementing
such exceptions mostly in areas of national security, sovereignty and public order. This
will ensure improved understanding and more streamlined negotiations when it comes tointernational personal data transfers as some jurisdictions do not allow the transfer of
personal data to countries with very broad exceptions.

•Mechanisms of redress and independent oversight: such mechanisms should beavailable for all the individuals living in the respective country.

In conclusion, GMTA and its members actively call for an unrestricted flow of health data transfers
between countries for research and innovation, the monitoring of the safety and effectiveness ofexisting products for providing support services for medical technologies currently in use, and forcompliance with regulatory obligations and best practices, for the interest of patient safety anduninterrupted healthcare delivery.
In addition, GMTA members support countries that seek to set privacy and data protection laws
and standards with international alignment of principles and definitions to ensure data can flowfrom one country to another.
The industry will be a supportive, essential partner in creating and maintaining the highest
standards of health data management dedicated to the benefit of patients.