CODE of CONDUCTAugust 2018

Includes: Brazil, Canada, Denmark, Finland, France, Germany,
Greece, Italy, Japan, Korea, Mexico, Netherlands, Norway, Poland,
Russia, Spain, Sweden, Turkey, UK, USA

1

CODE of CONDUCT August 2018
CONTENTS

1. Introduction
A. Purpose, Scope and Sources
Purpose
Geographic Scope
EphMRA Members’ Code Responsibilities
Relationships with Other Codes of Practise

5
5
5
5
5
5

2. Principles of the Code of Conduct

6

3. The Key Principles Explained

7

B. What Constitutes Market ResearchMarket Research
Secondary Data
Market Research, Ethics Approval and Non-Interventional Research
Non-Research Activities and Purposes
Combining Research and Non-Research Activities
Disguised Promotion
Competitive Intelligence
Client and Agency

C. Data Protection and Privacy
Definition of Personal Data
Processing Personal Data
Naming the End Client
Security
Storing Agreements about Access to Personal Data
Protection of Personal Data when Transferred
MR Subjects’ Rights to Their Personal Data
Privacy Rule in the USA – HIPAA

D. Market Research Tenets
Informed Consent
Confidentiality and Anonymity
Waiving the Right to Confidentiality
Separating Personal and Research Data
Patient Confidentiality

4. Key Research Stages - Before Fieldwork

7
7
7
8
11
11
11
12
12

13
13
14
14
14
14
14
15
15

16
16
16
17
17
17

18

E. Approval and Registration of Proposals Prior to Fieldwork

18

F. Use of Sub-Contractors

19

G. Preparing the Sample

19

Sample Size
Over-researching of MR subjects

19
19

1

Drawing a Sample From a List
Anonymity of MR subjects Drawn from Lists‘Do Not Contact’ List Status
Revealing the Source of a List
Correcting Listed Information
Adding Personal Data to a Database
Return or Destruction of Client Databases

H. Recruitment
Screening Questions and Questionnaires
Physician Recruitment of Patients
Snowballing – Supply of Potential MR subjects’ Names
Recruitment – Information That Must be CommunicatedData Collected at Recruitment
Scheduling of Fieldwork Appointments
Recruitment Agreements and Disclosure
Re-contacting MR subjects

I. Incentives
Incentives
Incentives – Country Exceptions
Incentives that are Not Allowed
Free Prize Draws
Confidentiality of Recipients’ Incentive Data
Storing Incentive Details

5. Key Research Stages - During Fieldwork

19
20
20
20
20
20
20

21
21
21
21
21
22
23
23
27

29
29

29
29
29
29
29

30

J. Information to be Communicated at the Start of Fieldwork

30

K. Instrument and Stimulus Design and Use

30

Questionnaire and Question Design
Sensitive Topics
Stimulus Material
Use of Product Names
Testing Products

30
30
31
31
31

L. Recording and Observation of Fieldwork

33

Personal Data Definition
Consents Required
Information to be Communicated to MR subjects when Observed by Clients
Passing on Recordings without Consent
When Written Consent is Required
When a MR Subject Withdraws
When Recipients of Recordings Change
Delayed Viewing of Fieldwork
Audio-only Recordings
Client Awareness of Restrictions on Use of Recorded Data
Protecting Data When it is Transferred
Observer’s Guidelines

M. Adverse Event Reporting
Introduction
Basis of Guidelines
EphMRA Members’ Responsibilities
Responsibility to MR subjects
Impact of Disclosure Requirements
Glossary and Terminology
Important Background
Adverse Event Reporting Guidelines

33
33
33
34
34
34
34
35
35
35
35
35

36
36
36
36
37
37
37
37
39

2

ScopeDefinition of an Adverse Event
Definition of an Adverse Reaction
Causality
Minimum Reporting Criteria
Passing on Reporter Contact Details
Consent for Further Follow Up from a Consumer
Duplication of Adverse Event Reports
Who Should Forward Adverse Events
Reporting Timetable
Reporting Formats
Adverse Event Reporting Form
When and How to Complete Adverse Event Reporting Forms
The Format of Adverse Event Tabulations
Quality Management and Training
Confirmation and/or Reconciliation Process
Syndicated Studies
Longitudinal Patient Databases
If You Have Questions
Adverse Event Reporting Form – Template

6. Key Research Stages - After Fieldwork

39
39
40
40
40
42
43
43
43
43
43
44
44
44
44
45
45
46
46
47

48

N. Quality Control

48

O. Storage and Security

48

Consent for Storage of Personal Data for Future Use
Storage Duration
Security

48
48
48

P. Reporting Market Research

49

Q. Publishing Market Research49

7. Researchers’ Responsibilities by Research Approach

51

R. Face to Face Methodology

51

S. Telephone Methodology

51

Naming the Agency/Researcher
Do Not Call Lists
Special Precautions When Contacting Mobile Phones
Use of Unsolicited Texts for Recruitment
MR Subject Costs
Use of Apps
Country Specific Guidance

T. Ethnographic/Observational Approaches
Definitions
Guidelines
Constraints

U. Online & Mobile Market Research
Definitions
Informed Consent
Privacy and Data Protection
MR Subject Costs
Researcher/Agency Contact Details
Protecting Personal and Company Data
CookiesInterview Duration
Disclosing List Sources

51
51
51
51
52
52
52

54
54
54
54

55
55
55
56
56
56
56
56
57
57

3

Use of Unsolicited Emails for Recruitment
Identification of the Client
Active Self-Selection of MR Subject in Germany
Use of Apps
Using Identifications and Tracking Technologies/Software
Online Access Panels

V. Social MediaDefinition
Accessing Social Media Content incl. Website Terms and Conditions
Anonymising Quotations
Passive Market Research
Active Market Research
Adverse Event Reporting

8. MR subjects’ Rights by MR Subject Type

57
57
57
58
58
59

60
60
60
60
60
61
61

62

W. Patients

62

X. Simulated Consultations

62

Z. Vulnerable MR subjects

63

Definition
What to consider When Interviewing Vulnerable MR subjects

AA. Children and Young People
Definitions
Consents Required
Online Market Research With Children
Role of the Responsible Adult
Researchers’ Responsibilities
Incentives
Product Testing
Criminal record Checks for Interviewers

63
63

64
64
64
65
65
65
66
66
66

BB. Opinion Leaders, Investigators and Advisory Board Members

67

CC. Physicians and Other Healthcare Professionals

67

DD. Payers and Influencers

67

9. Complaints and Grievance Procedure

68

Glossary69

Sources

72

Appendices Pro Formas
Recruitment Agreement
Receipt of Incentive
Consent Allowing Client Access to Recordings of MR Fieldwork
Agreement to Safeguard Confidentiality of Recordings of MR Fieldwork
Observer Agreement

75
75
76
77
78
79

4

1. Introduction
A.

Purpose, Scope and Sources

Purpose
1.1
The Code of Conduct provides comprehensive and up-to-date key ethical and legal guidance tosupport EphMRA members when they carry out multi-country, primary and secondary healthcare
market research. This includes ad hoc and syndicated work upon pharmaceutical drugs, biologics,
medical devices and diagnostics (available with or without prescription). Within the Code theumbrella term ‘products’ refers to drugs, biologics, devices and diagnostics unless specified otherwise
e.g. medicinal products refer only to drugs and biologics.
1.2

It is an industry-sponsored code that aims to define and safeguard the rights of MR subjects,
protecting data integrity alongside the rights of MR subjects.

Geographic Scope
1.3
The Code provides international guidelines, although its development has focused upon - Brazil,
Canada, Denmark, Finland, France, Germany, Greece, Italy, Japan, Korea, Mexico, Netherlands,
Norway, Poland, Russia, Turkey, Spain, Sweden, UK and the USA.
It offers international guidelines rather than country specific detail however key inter-country
differences are highlighted where they exist.

EphMRA Members’ Code Responsibilities
1.4
EphMRA strongly recommends that all members adhere to the Code of Conduct and ensure that all
personnel employed or sub-contracted on their market research studies understand and agree toabide by the Code.
EphMRA also recommends that contracts include a clause committing all parties engaged in themarket research study – the commissioning company, the market research agency and any subcontractors – to adhering to the EphMRA Code, including adverse event reporting guidelines.
1.5

All market research MUST comply with international and national law. This June 2018
update incorporates the impact of new data protection requirements introduced via theGeneral Data Protection Regulation (GDPR) on 25 May 2018.

1.6

Whilst incorporating the impact of relevant legislation, neither the Code of Conduct nor EphMRA will
be a source of legal advice. The information within EphMRA’s Code of Conduct is not intended andshould not be construed as or substituted for legal advice. It is provided as a reference for bestpractice. If legal advice is needed it is should be sought independently.

Relationship with Other Codes of Practise
1.7
EphMRA’s Code of Conduct complements other professional codes of conduct/practice e.g.
ICC/ESOMAR’s International Code of Marketing and Social Research. Where appropriate readers arereferred to complementary/ additional sources of information. Local codes should be observed.

5

2. Principles of the Code of Conduct
2.1

There are twelve guiding principles that underpin the Code of Conduct. These principles are thefoundation stones upon which the specific guidelines are built. They are as follows:I.

MR subjects MUST be able to provide voluntary, informed consent to data collection and use,
based upon a clear understanding of the purpose of the data collection and the use(s) towhich the data will be put.

II.

The rights of MR subjects MUST be observed, including rights to confidentiality, anonymity
and the right to withdraw at any stage.

III.

Market research MUST be kept separate from any form of promotion or selling, it MUST NOT
be a vehicle for disguised promotion.

IV.

MR subjects MUST be treated fairly and reasonably, with care and courtesy.

V.

MR subjects MUST be protected for the duration of the study – not harmed, exposed,
disadvantaged or made to feel uncomfortable in any way. Confidence in market research
MUST NOT be abused.

VI.

Data collection MUST be adequate, relevant and limited to the purpose (s) for which it isprocessed. Researchers MUST be transparent about the personal data they plan to collect,
the reason(s) it is being collected and who it will be shared with.

VII.

Data MUST be processed fairly and lawfully, and only used for the specific and lawful
purposes for which it was obtained. Personal data must be accurate and up to date. It must
be processed in accordance with the rights of individuals within national and international
data protection and privacy legislation.

VIII.

There MUST be no unauthorised or unlawful processing, loss, destruction or damage topersonal data. You must take appropriate technical and organisational measures to keep
data safe.

IX.

Data can only be transferred, to a third party or overseas, when adequately protected.

X.

Personal data MUST NOT be kept beyond the time required to fulfil the immediate purposesof the study.

XI.

Researchers MUST behave ethically; they MUST NOT undermine or damage the reputation ofhealthcare market research. They MUST NOT disparage or appear to disparage competingcompanies or products.

XII.

Researchers MUST conduct market research accurately, transparently, objectively and of
appropriate quality.

63. Explanation of Key Principles
Please see the Glossary for clear definitions of primary, secondary, ad hoc and syndicated market research.

B. What Constitutes Market ResearchMarket Research
The term ‘market research’ is used throughout the Code but it is recognised that the market researchfunction may go under different names in different organisations e.g. consumer/market insight,
business/commercial intelligence, marketing/data analytics, customer science. Market research is used inthis Code as an ‘umbrella’ term that describes the work meeting the definition below.
With the broadening of market research options both in terms of new methods e.g. behavioural economics,
co-creation, new mediums e.g. mobile devices and new data sources, it is important to be clear that EphMRA’s
Code is applicable to both traditional and the newer or non-traditional approaches such as digital listening.
3.1

Market research, whatever it is called and whatever approach is used, is defined by the following key
characteristics:– the systematic gathering and interpretation of information about individuals, organisations andmarket places– using the information gathering and analytical methods and techniques of the applied social,
behavioural and data sciences– its purpose is to gain insight or support decision making– the identity of MR subjects will not be revealed to the user of the information without explicit
consent (and can ever be revealed in Germany), market research has no interest in the individual
identity of MR subjects– no direct action e.g. a sales approach will be taken in relation to individuals or organisations as aresult of the market research (except following up adverse events when permitted), market
research is not a commercial communication or a selling opportunity
Based upon the definition of market research contained in the ICC/ESOMAR International Code 2007

3.2

Market research is defined by the objective(s) and the approach, not by the title of the work or those
involved in it. Consequently the EphMRA Code of Conduct includes areas such as digital listening (theuse of social media content for market research), the use of observational/ethnographic approaches
and work carried out online via mobile devices.
Advisory boards may or may not qualify as market research depending how they are run. An advisoryboard is generally a group that provides non-binding strategic advice to the management of anorganisation e.g. providing expert advice on new drugs and opportunities. If the advisory board isrecruited and operated as market research – meeting the definition above – then it is market
research. However Ad’ boards do not often offer anonymity, may not be systematic in theirapproach or supported by a basis in the applied social or behavioural sciences and may not be
entirely non-promotional.

7

Secondary Data
3.3
If the secondary data includes personal data, its intended use MUST be compatible with the purpose
for which the data was originally collected. The intended use must not be specifically excluded within
the privacy notice provided at the time of the original data collection.

Market Research, Ethics Approval and Non-Interventional Research3.4 Market research does not require
Clinical Research Ethics Committee or Independent Review Board approval.
Market research (as defined above) relating to market or consumer behaviour of the sort thatpharmaceutical companies routinely commission, whether involving healthcare professionals,
patients, carers or members of the public does not require Clinical Research Ethics Committee or
Independent Review Board approval (Institutional Review Board in the USA).
3.4

Key regulators have made it clear what distinguishes ‘research’ that requires ethics approval i.e.
clinical/medical research from ‘research’ that does not i.e. market research.
EFPIA Requirements
EFPIA require non-interventional research studies to meet specific criteria that are not required ofmarket research:- The study is conducted for a scientific purpose- There is a written protocol- The study protocol MUST be approved by, and the study conduct supervised by, theCompany’s Scientific Service- The study results should be analysed and made available within a reasonable period of timeto the Company’s Scientific Service and the Healthcare Professionals who participated in the
study- If the study shows results that are important for the assessment of benefit-risk profile of the
medicinal product, the summary report should be immediately forwarded to the relevant
Competent Authority- Companies publicly disclose the summary details and results of non-interventional studies ina manner consistent with the parallel obligations for clinical trials- Companies apply the same requirements (to the extent applicable) to all other types ofstudies including epidemiological studies, registries and other studies that are retrospective
in nature
For further details upon the characteristics of non-interventional studies see Article 15, NonInterventional Studies of Marketed Medicines within EFPIA’s Code on the Promotion of Prescriptiononly Medicines to, and Interactions with, Healthcare Professionals.

3.5

UK NHS Guidance
The UK National Health Service Health Research Authority (NHS HRA) provides a decision support
tool to help determine whether a study should be classified as 'research' or not:1. Are patients randomised to different groups?
2. Is there a protocol to be followed?
3. Are the results generalisable* to the population?
* Generalisable is defined as the extent to which the findings of a clinical study can be reliably
extrapolated from the subjects who participated in the study to a broader patient population
and a broader range of clinical settings.
http://www.hra.nhs.uk/research-community/before-you-apply/determine-whether-your-study-is-research/

8

In addition, the NHS HRA provide a leaflet ‘Defining research’ that is designed to help you decide if aproject is research, which normally requires review by a Research Ethics Committee (REC), or
whether it is some other activity such as audit, service evaluation or public health surveillance.
Indeed in the UK, Governance arrangements for research ethics committees A harmonised edition
published by the Department of Health, May 2011 states that:“2.3.14 Healthcare market research7 may be undertaken by professional market
researchers on behalf of pharmaceutical or medical device companies. Where suchresearch is conducted by professional market researchers in accordance with theLegal and Ethical Guidelines issued by the British Healthcare Business Intelligence
Association (BHBIA), it does not require REC review except where otherwise
required by law”

3.6

Key Differences
In addition, EphMRA provides a detailed overview of the differences between market research (MR),
non-interventional studies (NIS) and patient support programmes (PSP) – see page 10. Key
differentiating characteristics between MR and NIS are:Commercial focus/purpose (market behaviour and opportunities) – internal focus
Clinical or medical focus/purpose (safety, efficacy or pharmacokinetics) – external focus
Epidemiological methods must be used to design the study and analyse the data
Must generate scientifically significant evidenceManaged by company’s scientific/medical service (rather than commercial)

MR
Y
N
N
N
N

NIS
N
Y
Y
Y
Y

Confusion between market research and clinical/medical research can arise because they sometimes
address the same audience, may use a similar tool – a questionnaire, and can ask similar questions.
In particular, non-interventional studies (or post-marketing authorisation studies as they may also becalled) are confused with market research.
Non-interventional research studies involves the collection of “additional data post-authorisation, as
it is necessary from a public-health perspective to complement the available data with additional data
about the safety and, in certain cases, the efficacy of authorised medicinal products. Such postauthorisation measures (PAMs) may be aimed at collecting data to enable the assessment of thesafety or efficacy of medicinal products in the post-approval setting.”
http://www.ema.europa.eu/ema/index.jsp?curl=pages/regulation/q_and_a/q_and_a_detail_000037.jsp

Non-interventional research is carried out for a clinical purpose i.e. to assess safety, efficacy ortolerability, its ultimate purposes are to advance science, the treatment of disease, and improve
patient outcomes. In contrast, market research is carried out for a commercial purpose i.e. toinvestigate market behaviour and opportunities to inform business decision making, clinicalendpoints are not needed for market research.
Even market research that involves the collection of anonymised patient data detailing conditions,
symptoms and treatments this does not mean it is non-interventional research. Market researchusing anonymised patient record data is analysed in aggregated form to generate information uponmarket patterns.
The distinction between market research and non-interventional research applies whether themarket research involves prospective or retrospective patient data.

9

3.7
The following table distinguishes between the characteristics of market research, patient support
programmes and non-interventional studies.

Differences Between Market Research,
Patient Support Programmes and Non-interventional Studies
MR

PSP

NIS

Information gathering tool

Y

N

Y

Patient or carer service

N

Y

N

Participants remain anonymousYN

Y or N

Commercial focus/purpose

Y

Y

N

Clinical focus/purpose

N

N

Y

Direct patient benefit

N

Y

N

Promotional tool

N

Y

N

Directly impacts clinical care

N

Y

N

Pooled processing of information generated

Y

N

Y

Participants are generally financially incentivised

Y

N

N

Impacts patient directly and immediately

N

Y

N

Generally generates scientifically significant information

N

N

Y

Requires clinical research ethics committee approval

N

N

Y

Can be prospective or retrospective

Y

N

Y

Always involves marketed medicinal product

N

Y

Y

Managed by company’s scientific service (rather thancommercial)
Generally includes patient prescribed a company’s
medicinal product in the usual manner
Epidemiological methods must be used to design the
study and analyse the dataN

Y or N

Y

N

Y

Y

N

N

Y

Abbreviations used:
MR Market Research
PSP Patient Support Programme
NIS Non-interventional Study
Y
Yes
N
No

10

Non-Market Research Activities and Purposes
3.8 It is not market research when data are collected for any other purpose than that described above (see3.1). In general non-research exercises have the following characteristics:– Anonymity and confidentiality are not guaranteed– If the data are collected on an identifiable basis, direct action (such as selling or direct
marketing) will or may be taken– The exercise aims primarily to encourage people in general or at random to express views,
rather than to achieve robust data based on systematically targeting specific sectors of the
population or on the whole range of views from a representative sample of the relevant
population.
– The exercise promotes the aims or ideals of a client or organisation– The exercise promotes the products or services of a client or organisation
These definitions are based upon the UK’s Market Research Society’s Regulations for Using ResearchTechniques for Non-Research Purposes Nov 2010
Database building is a non-research purpose. Data Protection legislation prohibits information given
within a market research exercise being used to build a database unless consent for this was given atrecruitment.

Combining Research and Non-Research Activities
3.9 When researchers are fulfilling their role as researchers they MUST NOT conduct other non-research
activities without the prior informed consent of MR subjects. In Germany the MR industry guidelines statethat market research may not be combined with non-research activities. Market research should be clearly
separated and distinguished from any other activity.

Disguised Promotion
3.10 The collection of data to directly create sales or influence the MR subjects’ opinions MUST NOT be
presented to MR subjects as market research, selling MUST NOT be carried out under the guise of market
research. Judgement by regulators as to whether a market research survey is disguised promotion is likely to
be based on the impact of a series of factors, alone or in combination. Researchers must make sure that:- At recruitment and in the introduction to the MR explain clearly what is involved- Justifiable business need and market research objectives are clearly documented- The minimum sample size and an appropriate sample structure is used
- Appropriate incentives to the time, tasks and types of MR subject are given- Guide/questionnaire and stimulus design is balanced- There is no unnecessary use of company or brand names or over-emphasis upon claims or
product messages, particular care should be taken if the names of unlicensed products are to be
used- The use of stimulus is clearly sign-posted at recruitment and in the introduction to the MR- MR subjects are made aware that the stimulus is non-promotional and for the purposes of themarket research alone- If stimulus refers to a marketed or an unlicensed product this is made clear- The number of times the stimulus is shown is limited to the minimum- If repeated exposure is required, explain why this is necessary- Only essential personal data is collected and the necessity for this is explained11

- Market research is not run alongside a non-research exercise

Competitive Intelligence3.11 Market research MUST NOT be used to obtain confidential information about competing products
and companies from MR subjects who are bound by confidentiality agreements with those companies.

Client and Agency
3.12 In terms of the EphMRA Code of Conduct the client is the commissioning party and the agency
executes the study on their behalf. Generally but not necessarily the client is a manufacturer ofpharmaceuticals, devices or diagnostics and the agency is a market research specialist. It is
recognised that for some studies there may be more than one ‘client’ (e.g. different offices may be
involved) and more than one ‘agency’ involved (e.g. a co-ordinating global agencies and local
fieldwork suppliers). In which case for the purposes of the EphMRA Code the following definitions
apply:– Client = commissioning company head office or regional office or local affiliate/office, these
may be pharmaceutical medicine manufacturers, producers of devices, diagnostics or overthe-counter medicines etc.
– Agency = full service market research agency, fieldwork agency, independent recruiter,
freelance researcher or interviewer – these may be the main contractor or a sub-contractor.
Agencies may also include marketing or management consultancies, PR or advertising
companies that run market research studies
3.13

The following key points should be noted:– All parties involved should be contractually bound in a chain e.g. if pharma’ company X’s HQ
has commissioned international full service agency Y to carry out a multi-country market
research study on their behalf and agency Y has sub-contracted fieldwork to fieldwork agency
Z who has in turn sub-contracted recruitment of MR subjects to recruiters A, B and C in threedifferent countries – then, it is expected that the full service agency Y will be under contract
to company X, the fieldwork agency will be under contract to agency Y, and finally therecruiters A, B and C will be under contract to fieldwork agency Z– Sub-contractors should be bound by the same legal and ethical requirements as the main
contractor.
– For data protection purposes original holders of personal data can, if contractually bound,pass personal data to other parties without seeking the explicit consent of the individuals aslong as the data is being used for a purpose for which the original holder has a lawful basis toprocess the personal data, such as the consent of the individual.
– Agencies may not transfer MR subjects’ personal data to the client without the explicit
consent of the MR subjects. In Germany MR industry guidelines state that MR subjects mustremain anonymous to the client. Consequently personal data must never be made available
to the commissioning client company unless it can be guaranteed that client personnel willnot (now or in the foreseeable future) be able to identify the individuals. Requesting MR
subject consent to override this is prohibited too.

12

C. Data Protection and Privacy
Definition of Personal Data
3.14 National and international data protection and privacy requirements MUST be adhered to.
Personal data is any information relating to an identified or identifiable living person, who can be
identified directly or indirectly by that data on its own or together with other data. Personal data,
includes postal codes, cell phone numbers and email addresses as well as full names and postal
addresses. Personal data may be a single piece of information or a series of pieces of information
including other information or data sets available to the holder, which together would allow
identification of an individual or infer their identity.
Sensitive or special category personal data is personal information which identifies a living individual
and includes reference to: the racial or ethnic origin of the data subject; his/her political opinions;
his/her religious beliefs or beliefs of a similar nature; whether he/ she is a member of a trade union;
his/her physical or mental health or condition; his/her sexual life; the commission or allegedcommission by him/her of an offence; or any proceedings for any offence committed or alleged tohave been committed by his/her and the outcome. The definition of health data has been expanded
to include biometric and genetic data. You must obtain explicit consent to process special category
personal data. You must treat special category personal data with greater care than other personaldata.
In the United States the definition of personal data may depend upon the nature and/or subject
matter of the information, the way it is collected, other information that may be collected andcombined with it, and the use and disclosure of the information by the collector.
3.15

Personal data includes data in a range of formats - alphabetical, numerical, graphical, photographicalor acoustic. It includes information kept on paper, as well as information stored in a computer
memory by means of binary code, or on a videotape, for instance. Personal data includes videostreams (relayed live or delayed and non-anonymised recordings. Whether an audio recording is
considered personal data may depend on whether the surnames of the individuals are recorded orwhether the voice alone could lead to the identification of the individual.

3.16

Once all identifiers linking data to a MR subject have been removed then it is no longer personal data
(it has been irreversibly anonymised) and is not covered by the EU GDPR. Researchers may use aunique identifier (e.g. a serial number) to identify a MR subject (a process referred to as
pseudonymisation) but the file linking personal data to the unique identifier MUST be stored entirely
separately from the anonymised MR subject data. If access to the means to reverse thepseudonymised data is available, the data is still classified (under GDPR) as personal data. In
addition, researchers must make sure that de-identified data cannot be traced or an individual’s
identity inferred by deduction.

Processing Personal Data
The ‘processing’ of personal data includes any operation or set of operations performed on personaldata, including, but is not limited to: collecting, recording, organising, storing, adapting or altering,
retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available,aligning or combining, blocking, erasing or destroying, whether automatically or otherwise.
In the EU under GDPR there are six lawful bases for processing personal data but only two are likely
to be used regularly within commercial business intelligence – consent and legitimate interests.

13Generally speaking consent is used more frequently within MR and legitimate interests in data
analytics. Deciding which legal basis to use depends on the circumstances. No single basis is ’better’or more important than the others – which basis is most appropriate to use will depend on yourpurpose and relationship with the individual. You MUST determine your lawful basis before you
begin processing, and you should document it. For further explanatory detail please see EphMRA’s
GDPR guide to ‘Legal Grounds for Data Processing’, available on the EphMRA website.
3.17

Researchers must limit the collection and/or processing of personal data to the minimum required tomeet the needs of the market research.

Naming the End Client
3.18 There are three situations when the end client/commissioning client company must be named tomeet GDPR requirements. These are as follows, if they:
─ Are a data controller (see section 4H 4.19)
OR─ Are the source of personal data e.g. they supply a list of names to be used for sampling (seesections 4G, 4.10 and 4H 4.19)
OR─ Receive personal data e.g. they receive non-anonymised audio/video files – live or delayed(see section 5L 11.4)
These three situations all operate independently.

Security
3.19 Researchers are responsible for the safe handling, processing, storage and disposal of market
research and personal contact data.
3.20

Adequate precautions MUST be taken to protect personal data, any special category data andconfidential information against unauthorised access. This would include using the appropriatetechnological and organisational measures to protect data when it is collected, transferred or stored
e.g. reliable encryption systems, firewall and user identification and password access.

3.21

In addition to the EU GDPR and US HIPAA (Health Insurance Portability and Accountability Act)requirements that personal data be appropriately protected, in the USA certain states havelegislation requiring specific security safeguards (e.g., Massachusetts) for any organisation in thestate or holding data of a state resident, and various regulators (including the Federal Trade
Commission and, recently, the Federal Communications Commission), impose broad overall security
safeguards subject to enforcement within their jurisdiction.

Storing Agreements about Access to Personal Data
3.22 Researchers should keep copies of e-mails and other documents received from MR subjects agreeing
to, or restricting, the use of or access to their personal information. Unnecessary duplication ofrecords should be avoided.

14

Protection of Personal Data when Transferred
3.23 Personal data is protected by the provisions of the GDPR even when taken out of the country where
the MR subject lives. Personal data must not be transferred from one country to another without theconsent of the individual or ‘legally permissible grounds’ for the transfer.
3.24

If personal data is to be transferred from one country to another, the data protection requirements ofboth countries MUST be met. The transfer of personal data to non-EEA countries is forbidden unlessthere is adequate privacy protection and specific data protection arrangements in place.
There are various ways in which to comply with the EU Directive in non-EU countries depending upon
the circumstances, these include Model Clauses and Binding Corporate Rules (BCR) and in the USA, theEU – US Privacy Shield framework – For further information on these see:
http://ico.org.uk/~/media/documents/library/Data_Protection/Detailed_specialist_guides/model_contract_clauses_international_transfers_of_personal_data.ashx. EphMRA members can access further detail upon the EU– US Privacy Shield framework within the Ethics Country News section on the EphMRA website.
3.25

In Japan (in accordance to Articles 16 and 23 of The Act on the Protection of Personal Information),
personal data cannot be processed or passed to a third party unless the individual has given priorconsent. Consent must be given for specific purposes and processing or transfer must be for these
purposes alone.
In Mexico the data protection authority differentiates between transmission and transfer of personal
data. Transmission is defined as the passing on of personal data for a restricted range of uses and thetransmitting party continues to be responsible for the personal data. Transfers of personal data allow a
broad range of processing/uses. In both cases, the individuals consent is required.
In Russia (in accordance with Federal Law of the Russian Federation #266-FZ on personal data, article
12, Trans-border transfer of personal data), the MR subject MUST be made aware if their personal datais to be transferred to a foreign customer and give a written consent to this.

MR subjects’ Rights to Their Personal Data
3.26 MR subjects MUST be provided with a privacy notice which tells them clearly what their rights are. It
must include information such as what personal data is collected, how it is used, how it will be managed,
how long it will be stored and the conditions under which it will be shared including transferred outside theEU, as well as how to get more information or make a compliant. The privacy notice must be madeavailable by the individual/organisation collecting the personal data and must be honoured by all parties
that process the personal data (whether or not they are the originator of the privacy notice).
3.27

MR subjects MUST be made aware of their data protection rights and the right to complain to asupervisory authority, their rights include to:− ask what data is being held about them
− ask for the data to be amended or destroyed− object to processing− ask to move their personal data
− ask to restrict processing− exercise their rights in relation to automated decision making and profiling.
− where the data processing is based and details of any data transfers to countries
without adequate data protection

15

3.28

Data Protection in Mexico (regulated by the LFPDPPP - Law for the Protection of Personal Data in theHands of Individuals) requires to meet these minimum requirements:- Responsible person or committee for personal data safety and privacy issues- Defined and auditable internal procedures for the processing of personal data
- A data privacy disclaimer (“aviso de privacidad”) which makes clear the type and purposes ofdata collected and processed.
Individuals’’ rights are known as “A-R-C-O”: Acceso (access) – Rectificación (correction) – Cancelación(deletion) – Oposición (opposition to future data treatment). MR subjects and those processing
personal data must be aware of these, MR subjects through the data privacy disclaimer.

Data Localisation Law in Russia
3.29 The key requirement of the Data Localisation law states:
Data operators processing data of Russian citizens, whether collected online or offline,
are obliged to record, systematize, accumulate, store, update, change and retrieve suchdata in databases located within the territory of the Russian Federation.
All processing operations affecting the actual records held (collection, updating /amending anddeletion of the personal data record) must be carried out on a master/primary database held in
Russia. A copy of that database can be transferred and secondary processing (e.g. backup, data
analysis, secondary storage and access) can take place using the copy that has been transferred toanother country. The copy can also be anonymised, deleted or destroyed. Companies and agencies
will have to store and maintain personal data directly collected from individuals resident in Russia ina primary database held on servers hosted in Russia. Cross border transfers (carried out incompliance with Russian data protection law) are still permitted, but the master database containing
personal data must still be stored and maintained in Russia.
For more detail, please see http://www.ephmra.org/Country-News

Privacy Rule in the USA - HIPAA
3.30 In the USA, that part of HIPAA known as the HIPAA Privacy Rule, is a federal regulation which gives
the individual rights over their health information (i.e. name, address, health status and otherinformation that can be linked to an individual) and sets limits upon how this information can be usedor disclosed by “covered entities” (primarily health care providers and health insurers). This
regulation also now applies directly to “business associates,” which are service providers to thesecovered entities. Unless a use or disclosure is permitted by the HIPAA Privacy Rule, it can only bemade subject to an individual’s authorisation. There is no restriction upon the use or disclosure ofthis “protected health information” if it has been de-identified in accordance with the standards set
by the Privacy Rule (see 19.3). The US Marketing Research Association’s Best Practice Guidelines on
HIPAA state that “As a general matter, survey research entities are NOT covered entities under HIPAA,
but may be business associates. The HIPAA Privacy Rule applies when a business associate collects,
uses or maintains personal health information for a covered entity.”D.

Market Research Tenets

Informed Consent
3.31 Members MUST ensure that MR subjects give their informed consent before information iscollected from them.

16

“cooperation is voluntary and MUST be based on adequate, and not misleading, information
about the general purpose and nature of the project when their agreement to participate is
being obtained and all such statements shall be honoured.”
http://www.esomar.org/knowledge-and-standards/codes-and-guidelines.php

Consent must be a clear, unambiguous, affirmitive action. Consent should be ‘purpose-specific‘ i.e.
limited to one specific purpose.
Only personal data that is of necessary to the research process MUST be collected.
In Germany informed consent should be refreshed at regular intervals (e.g. 6 monthly
intervals) if long term or longitudinal research is being undertaken.
3.32 Information detailing an individual’s physical or mental health is classified as ‘special
category/sensitive personal data’ under the GDPR and requires explicit consent for its use.
Explicit consent although not clearly defined within the GDPR it is basically a slightly higher
standard of consent and is necessary for (amongst other things) processing special category(sensitive) personal data. Explicit consent must be confirmed in a clear and specifically worded
statement (oral or written).
3.33

3.34

Specific consent is not required for the use of anonymised and non-attributable
responses.

Informed consent guarantees MR subjects the right to withdraw from the interview at any
time. This right MUST be made very clear to children.

Confidentiality & Anonymity
3.35 It MUST be clear to MR subjects that all personal data collected during a market research project will betreated confidentially and are purely for the purposes of market research unless adverse event reporting isrequired and separate consent for transfer of personal data for this purpose has been given.
3.36 MR subjects' anonymity MUST be strictly preserved. It is important to note that withholding a MR
subject’s name is not necessarily sufficient to protect their anonymity especially when MR subjects
belong to small high profile universes.
For further information see the ICO’s ‘Anonymisation: managing data protection risk code of practice’
http://www.ico.org.uk/for_organisations/data_protection/topic_guides/anonymisation

3.37

Researchers MUST ensure that information identifying the MR subject (e.g. recruitment
questionnaires, attendance lists) is not passed to the client without the MR subject’s consent.
Passing a MR subject’s personal data to the client is forbidden by MR industry regulations inGermany.

3.38

Agencies must not identify the client or any confidential client data without the client’s consent
except if there is a legal obligation to do so.

Waiving Right to Confidentiality
3.39 The MR subject's right to confidentiality can be waived by the MR subject if specific consent has beensought and granted providing MR subjects have been made aware of:–To whom they will be identified–
What will happen to the information they give–
What, if anything, will happen to them as a result of this waiver.

17

In Germany MR industry guidelines prohibit transferring data that could identify MR subjects to theclient.

Separating Personal and Research Data
3.40 In Germany MR industry guidelines state that personal data MUST be separated from interview data
immediately by the research agency, after this the only link allowed between the two is a common
code number. The address data – name, postal address, telephone number, email address – MUST
be destroyed at the earliest possible time i.e. once quality control checks have been completed.
Personal data cannot under any circumstances be passed to a client, there are no exceptions or
waivers allowed.
ADM Key Problems in the Data Protection Laws and Professional Laws for Scientific Survey Research Aug 2009http://www.adm-ev.de/fileadmin/user_upload/PDFS/Kernprobleme_E.pdf

Patient Confidentiality
3.41 Physicians have a duty of confidentiality towards their patients. Information about a patient may beobtained for market research from patient records without patient authorisation only if these data
are fully anonymised and in the USA meet the de-identified criteria within HIPAA (see 19.3 or
www.hhs.gov/ocr/privacy/index.html Aug 2009) or as permitted by the HIPAA Privacy Rule provisions
related to research or a “limited data set” or if the patient has given explicit authorisation.

4.

Key Research Stages - Before Fieldwork

E.

Approval and Registration of Proposals Prior to Fieldwork

4.1

Researchers MUST inform clients if any of the work to be carried out for them is to be combined orsyndicated with work for other clients (any other clients do not need to be named and MUST not be
named without their permission).

4.2

In Spain, Farmaindustria member companies MUST provide prior notification to the Farmaindustria
Code of Practice’s Surveillance Unit (CPSU) when carrying out, financing or sponsoring market
research studies. This is NOT mandatory if:–
The pharmaceutical company funds less than 50% of the study OR–
The company does not have access before, during or after study, to the identity of theparticipating healthcare professionals and has not intervened in their selection beyond
defining participating group described in the study protocol OR–
The study does not provide direct or indirect remuneration to the participating
healthcare professionals OR–
The study involves paid participation of less than 20 healthcare professionals. It is notallowed to split a study into smaller units that share approach, objectives and methods.
Communication should be addressed to the Farmaindustria Code of Practice Surveillance Unit (CPSU)
and sent at least ten working days before the study is due to start. The pharmaceutical company is
responsible for reporting the study.
Prior approval from the CPSU is required if the market research could involve any of the following:
A disproportionate or unusual sample structure in quantitative market research
Linking the market research to a specific product18-Using results within any publication or promotional material.

However the CPSU recommends that all market research studies carried out in Spain should bereported on a voluntary basis (not just those that it is compulsory to report). For full details please
see: http://www.farmaindustria.es/Farma_Public_ING/Codigo/codeofsanitaryprofessionals/index.htm
In Spain market research studies MUST be approved before being carried out by the pharmaceuticalcompany scientific service or by the compliance officer in Spain, this is required by the Spanish Codeof Good Practices for the Promotion of Medicines and Interaction with Healthcare Professionals.
4.3

In Korea KRPIA member companies must reports details of surveys quarterly on the form provided by
the KRPIA and market research agencies MUST not disclose the identity of participating HCPs to theclient company and selection of HCPs MUST be conducted independently by the agency.

F.

Data Protection

When preparing a proposal and considering the use of personal data within a MR project that falls within thescope of the GDPR a Data Protection Impact Assessment (DPIA) may be needed (or relying on one previously
carried for similar work). DPIAs are only needed in certain circumstances, to find out more about the when
DPIAs are needed and how they should be carried out see the BHBIA’s guide to Risk and Privacy Impact
Assessment available at https://www.bhbia.org.uk/guidelines/gdprupdates.aspx
Proposals should include and address key data protection and privacy issues.

G.

Use of Sub-Contractors

4.4

Clients should be informed if any part of the study is to be sub-contracted outside of the agency. If
requested the identity of the sub-contractor should be provided. In Canada, this is mandatory for MRIA
members. If a sub-contractor is employed at short notice after the study has started the client should
be informed as soon as practical.

H.

Preparing the Sample

Sample Size
4.5
The size of the sample should be appropriate to meet the market research objectives. If the sample size
is unnecessarily large, the market research may be considered a promotional vehicle.

Over-Researching MR subjects
4.6
Researchers should manage and monitor the frequency with which potential MR subjects participate
in market research and try to avoid over-researching individuals.

19

Drawing a Sample from a List
4.7
Lists that are drawn from sources readily available within the public domain do not generally require
the consent of the individuals listed to have their personal details held (all of the data MUST be
drawn from the public domain). However you MUST always have a lawful basis for processing
personal data, whether the data is readily available in the public domain or not.
So if for instance a list of healthcare professionals (HCPs) was drawn up from health centre websitesthat listed the HCPs working there, this would not necessarily require the HCPs prior consent if alegitimate interests assessment made clear that it was in the data controller’s legitimate interests toprocess data in this way.
If a list containing personal data that is not in the public domain e.g. a list of detailed physicians was
passed to an agency to allow them to draw a sample from it, as long as the agency is contractually
linked to the client company and the physicians had given consent for their details to be used formarket research then this does not require the consent of the listed individuals. Legitimate interests
or public interests could be an alternative lawful basis.
The list holder should inform the supplier of the legal basis for passing on their list.
If however local law/regulations demand that the explicit consent of those on the list is required
before their personal details are passed on as in Italy, this MUST be complied with. In Italy, data thatis used that is not publicly available should be ‘certifiable’ – those that hold the data MUST have theconsent of the individual and evidence of how they obtained the data. It is also strongly
recommended by EphMRA that the responsibilities of list suppliers are made explicit and agreed to inwriting within some form of project agreement, such as the contract.

20

Anonymity of MR subjects Drawn from Lists
4.8
The client company MUST NOT be informed of the identity of market research participants, i.e. whoon the list was interviewed.

Do Not Contact Status
4.9
MR subjects that have chosen to opt-out of or not be contacted for market research must be excluded.

Revealing the Source of a List
4.10 When lists of named individuals are used for sample selection, the source of the list should be
revealed to potential MR subjects. Under GDPR, the source of the list MUST be named. If providing
the name of source of the personal data would impact the integrity of the MR it may be withheld
until the end of the interview but respondents must be made aware at recruitment that:– the client will be named at the end of the interview– they can withdraw their consent at any point
The justification for this should be documented.

Correcting Listed Information
4.11 You have a responsibility to make sure that any personal data you process is accurate and up to date.
Reasonable steps must be taken to correct or erase inaccurate data promptly.

Adding Personal Data to a Database
4.12 Personal data can be added to the database only if you have a lawful basis for this e.g. the MR subject
is told of this intention at the time of data collection. MR subjects MUST also be told why and forwhat purposes the data will be used, and that under no circumstances will it be released or used forany non-research purpose.
– An entry recording that a particular individual was interviewed or contacted on a given
survey, or that they do not wish to be contacted for further research, is permitted if the
purpose of the entry is solely to ensure that that individual will not be unnecessarily
approached for research at some later date except in Germany.
The MR subject has the right to request the deletion of any or all of their personal data from thedatabase at any time.

Return or Destruction of Client Databases or MR Subject Details
4.13 Client databases MUST be returned to the client or destroyed at the end of the project. MR subject
requests to have their personal data removed from a list or database must be respected.

Recruitment
Screening Questions and Questionnaires
4.14 Screening questions MUST only be used pre-screen potential MR subjects for participation in the
research, they MUST NOT be used to collect additional data.

21

Physician Recruitment of Patients
4.15 Physicians may act as intermediaries to recruit patients by inviting patients to take part or passing onquestionnaires on behalf of the agency, they MUST however:– Ensure that patients understand that their participation is voluntary– Not disclose the patient’s identity to the agency until the patient has consented to this.
Reimbursement should not be dependent on the number of patients successfully recruited. Agencies
should beware of placing pressure upon patients and try to minimise this e.g. by issuing a written
rather than a face to face invitation.
4.16

If the patients reply directly to the agency, which is preferable, the doctor should not be told which
patients are going to/have participated.

4.17

In Germany and Brazil, physicians are only allowed to pass on and return completed questionnaires if
there are no means by which to identify the patients detailed (e.g. name or address).
In the Netherlands, MOA affiliated researchers MUST make sure that an invitation to a patient toparticipate in market research that is given via a HCP must be in writing (mail or email).

Snowballing – MR subject supply of Potential MR subjects’ Names
4.18 When asking people to supply other people's names for the purposes of developing a list from whichto draw a sample (a technique commonly referred to as 'snowballing' and used to identify opinion
leaders) to meet the obligation to be transparent, the person being recruited MUST be told how theirname was obtained. This means for example that when trying to recruit an opinion leader the
recruiter MUST tell the doctor that they were suggested by another physician but there is no need toname the source of the nomination.

Recruitment – Information that MUST be Communicated
4.19 You must obtain a record of respondents’ agreement/consent to participate in MR. This must detail
all the key ‘terms and conditions’ including data protection requirements associated with the MR.
This agreement/consent must be collected from all respondents, both HCPs and non-HCPs.
EFPIA members and members of EFPIA-affiliated associations MUST document an agreement
between agency or client company and the healthcare professional MR subject in advance offieldwork (i.e. at recruitment) for all market research carried out face to face. Longitudinal studies
and panels MUST also be covered by a written agreement irrespective of methodology. Single stage
market research studies conducted online, by telephone or by post that involve only minimal
remuneration do not require a written agreement in advance of fieldwork. EFPIA member
associations provide guidance on the meaning of minimal. This ruling is based upon Article 14 of theEuropean Federation of Pharmaceutical Industries and Associations (EFPIA) Code on the Promotion of
Prescription-Only Medicines to, and Interactions with, Healthcare Professionals.
http://transparency.efpia.eu/uploads/Modules/Documents/efpia-hcp-code-2014.pdf

Records of the agreement MUST be kept in line with data protection and privacy legislation (as wellas primary market research records containing personal data) and MUST be destroyed when the
purpose of the market research study is redundant.
In Denmark, nurses must be treated as non-HCPs.

22

In Germany the FSA requires that if the incentive is not ‘marginal’ (which is defined as over 50 euros)
written contracts are required for all forms of market research with HCPs.
In the UK the BHBIA states that to conform to Clause 20 of the ABPI’s Code of Practise 2016, all study
types irrespective of methodology require a written agreement; although different mechanisms tocapture the agreement may be needed for different methodologies. For full details see the BHBIA
Guidelines.
http://www.bhbia.org.uk/guidelines/legalandethicalguidelines.aspx
http://www.pmcpa.org.uk/thecode/Pages/default.aspx

EFPIA and local pharmaceutical industry associations’ requirements mean the agreement/consent
must include:−
Subject and purpose of the MR−
Methodology and approach−
Location and duration of fieldwork−
Date and time of fieldwork−
Reimbursement offered – both the nature and the rate of remuneration−
Adverse event and product complaint reporting obligations if appropriate− Templates for a standard text are available in Germany(http://www.akdae.de/Arzneimittelsicherheit/UAW-Meldung/index.html andhttp://www.akdae.de/Arzneimittelsicherheit/UAW-Meldung/UAW-Berichtsbogen.pdf)−

and the UK (http://www.bhbia.org.uk/guidelines/abpiadverseeventguidelines.aspx).
Furthermore in the UK non-healthcare professionals MUST be informed that if
adverse events are discussed during the research, then the details will becollected and forwarded to the commissioning pharmaceutical company.
In Mexico, the privacy disclaimer (aviso de privacidad) has to be provided (inwriting or read) to the MR subject, or a source for it given (i.e. hyperlink). MR
subjects must consent to the terms of the privacy disclaimer.

In addition, in order to meet data protection requirements for informed consent, you must tell all
respondents:−
Identity and contact details of the data controller(s)−Agency or researcher name and contact details – name, telephone number, email address as
appropriate−
Source of their personal data of it didn’t come from the data subject, this may require you toname another organisation e.g. the commissioning client company−
Recipients of their personal data, this will require you to name any other organisation the
personal data is being transferred to e.g. the commissioning client company−
Why you want their data (purpose) and what you will do with it (types of processing activity)
including if and how viewing or recording will take place and who will have access to live orrecorded information−
If the data is not obtained directly from the data subject the categories of personal data−
Their right to withdraw consent at any time−
Of any automated decision making and its consequences
Either in the consent agreement or in an easily accessible privacy notice, respondents must also bemade aware of:−Legal basis for the data processing and if appropriate the legitimate interests of the data
controller or third party−
Details of the data protection officer (if there is one)−
How long their personal data will be stored

23

−
−
−
−
−
−
−
−

The existence of each of the data subject’s rights and the right to complain to a supervisory
authority, their rights include to:
Ask what data is being held about them
Ask for the data to be amended or destroyed
Object to processing
Ask to move their personal data
Ask to restrict processing
Exercise their rights in relation to automated decision making and profiling.
Where the data processing is based and details of any data transfers to countries without
adequate data protection

Naming the data controller, source and recipients of personal data
GDPR requires that data controller(s) relying on consent are named at the time that personal data is
obtained as part of the MR process.
If the end client company is a data controller i.e. determining the purposes and means of processing
personal data (either alone or jointly with another data controller) their identity must be shared withthe data subject.
The European Data Protection Board have suggested that where organisations are jointly determining
the purposes and means of processing, they will be considered joint data controllers (in accordancewith GDPR Article 26), regardless of whether one controller is only determining the purposes and theother only determining the means. In addition, when in a joint controller scenario, where personal
data are collected from the data subject, both controllers must be named (in accordance with therequirements of GDPR Article 13(1)(a)). The EDPB’s current view essentially means that within amarket research context, the end client is likely to be a data controller as the MR is taking place forthe end client’s overall purpose. The second key point to bear in mind is that this is considered thecase even if the end client never processes any personal data.
In addition, the source of the personal data and recipients of personal data must also be named at
the time that personal data is obtained as part of the MR process (whether or not they are data
controllers).
IF naming the end client before the interview would undermine the integrity of the work, this may bedone at the end of the interview BUT:
─
Respondents must be made aware at recruitment that:□the client will be named at the end of the interview□
they can withdraw their consent at any point─
If the end client is receiving personal data they must be named before any transfer takesplace─The justification for this should be documented.
The requirements for naming the client when observation and recording are taking place are detailed
at 11.4.
4.20

In France, public servants including physicians who work in university hospitals MUST haveauthorisation from their university hospital that they may participate in ‘incidental activities’ including
market research. The CNOM may require evidence of this to approve the project. Decree 2011-82
covers public servants and Article L.6152-4 2 of the Code de la Santé Publique (the French publichealth code) extends this requirement to physicians who work in university hospitals.

24

In Germany, the FSA Code recommends to members that employer permission(Dienstherrengenehmigung DHG) is sought and granted for healthcare professionals to participate inmarket research. There is no over-arching legal requirement for a DHG, however if you have to include
healthcare professionals and/or federal civil servants e.g. payers (Bundesbeamte) within the market
research sample and are committed to adhering to the FSA Codex, you have to check that a DHG is inplace. You may do this by including suitable questions within the recruitment screener and ensuringpotential MR subjects only participate if they have their employers’ permission. The DKG have also
stated that employer permission is required unless participation in market research is a one-off or rare
and the incentive does not exceed 100 euros. German market research associations have no suchrequirements.
For more detail, please see http://www.ephmra.org/Country-NewsIn Italy, the Transparency Act (art. 53 165/2001) requires that:- Physicians employed by public entities should have the permission of their employers before
they participate in market research if they are paid an incentive. If no incentive is paid (evenif expenses e.g. for travel, are reimbursed), employer permission is not required but theemployer should be informed. It is the responsibility of the physician to gain theiremployer’s permission (not the market research agency).
- Market research should take place outside public entities office/clinic hours and not on a
public employer’s premises unless the premises are used for private practice too.

Data Collected at Recruitment
4.21 Data collected at recruitment MUST NOT be used for any purpose other than the purpose for whichconsent was granted. Seeking consent for other uses retrospectively is not allowed. Consent must be
specific to a single purpose.

Scheduling of Fieldwork Appointments
4.22 In Germany, Italy, Norway and Sweden, the ADM/BVM, ASSIRM, and LIF respectively, recommendthat market research appointments with healthcare professionals (HCPs) should be made outside
working hours and that those HCPs that are employees are not interviewed on their employer’s
premises. However the preferences of the HCPs can be taken into account. In Italy this refers to
HCPs when employed by the national health service (SSN) only.
Guideline for Studies in Public Health Service for Purposes of Market and Social Research

ASSIRM, Directive on the interviews with medical staff for purposes of market research and social

Disclosure
4.23 Disclosure Code requirements apply to EFPIA and EFPIA affiliated association members and all thosethat have agreed to adhere to EFPIA or national associations’ code of practice. The Disclosure Codeapplies to prescription only medicines and only to over the counter medicines if they are dispensed
on prescription. Consequently pharmaceutical companies will need to disclose payments made tohealthcare professionals (HCPs) for a range of activities including participation in market research(MR) when (and only when) the pharmaceutical company is aware of the identity of the HCP. These
payments are referred to in the Disclosure Code as Transfers of Value (ToV).
For the full EFPIA Disclosure Code go to https://www.efpia.eu/relationships-codes/healthcareprofessionals-hcps/disclosure-of-payments-to-hcps/25

When disclosure is required
4.23.1 For market research disclosure is required when pharmaceutical companies are aware of theidentities of those participating in MR it has commissioned and ToVs i.e. MR-related payments(incentives and expenses) have been made to HCPs. In these cases the payments made to individual
named HCP MR subjects MUST be disclosed, whether they’ve paid them directly or indirectly via anagency. This information will be made publicly available.
4.23.2 National data protection legislation may require the HCP’s consent for their data to be used in thisway. If this consent is not given, MR payments MUST still be disclosed but on an aggregate basis. So
if HCP MR subjects do not consent to their personal data being used for disclosure they may still
participate in the MR.
When disclosure is not required
4.23.3 If the HCP’s identity is not known to the pharmaceutical company disclosure is not required.
EFPIA have stated that if a HCP’s identity becomes known to the company only as a result of an
adverse event where reporter contact details are provided, disclosure is not required.
Similarly if during viewing of non-anonymised fieldwork, a MR subject is recognised (and identified)by client company personnel, disclosure may not be required.
4.23.4 If a sample is to be drawn from a list of HCPs supplied by the pharmaceutical company, the identity of
those actually interviewed will not be known and so disclosure is not required. However if all those on
the list are to be interviewed, then the company will be aware of the identity of the HCPs involved in
the MR and disclosure will be required.
Reporting format and Information to be disclosed
4.23.5 EFPIA have provided a ‘Model of a Standardised Template’ – the suggested reporting format fordisclosure data. EFPIA country associations may provide their own template based upon the EFPIA one.
4.23.6 The following types of data MUST be recorded for a full calendar year on the appropriate template anddisclosed:For each individual HCP that gives consent for their personal data to be used in this way:
Full name and address of principal practiceFee for service and consultancy – MR incentive
MR-related expenses
Where only aggregate data can be given (where consent has not been given for personal data
to be used in this way):- Aggregate amount attributable to transfers of value to recipients i.e. the incentives
and expenses (separate totals) for MR- Number of recipients in the aggregate disclosure- % of recipients included in the aggregate disclosure as a proportion of the total
number of recipients disclosed (individual and aggregate)
Country of disclosure
4.23.7 Disclosures MUST comply with the national (EFPIA member) code of the country where the HCP
receiving payment has their principal practice. The address of the HCP’s principal practice should be
used as the reference when determining in which country the data should be disclosed.

26

Public disclosure
4.23.8 EFPIA have advised that public disclosure can be via either:I.
the relevant Member Company’s website orII.
a central platform provided by a government, regulatory or professional body or an EFPIA
member/country association
Individual country/member associations decide upon the route.
Disclosed data will be publicly accessible in the country where the HCP has their practice.
Reporting responsibility
4.23.9 Pharmaceutical companies MUST complete and post the disclosure data on their company website or
forward it to a central platform – as required in their country.
Reporting timetable
4.23.10 Disclosures MUST be made in the first six months after the end of the calendar year in which the MR
payment was made.
Consent and record keeping required
4.23.11 HCPs whose identity will be known to the commissioning pharmaceutical company MUST beadvised that disclosure will take place and asked for their consent to pass on their personal
data and payment information for this purpose. This must take place as soon as practical,
generally at recruitment. As with any request for consent for the use of personal data, thefollowing must be made clear:- The purpose for which the individual’s personal data will be used – why it is requested- The consequences of giving (how their personal data will be used) or not giving consent- MR subjects’ agreement or refusal must be recorded.
When securing consent to transfer personal data to the pharmaceutical company for disclosure the
GDPR requires that the recipient company is identified. As disclosure reporting is a separate
processing operation (to the MR), consent for this may be secured at the end of the interview.
MR agencies MUST keep records of the required disclosure information to pass to thepharmaceutical company.
Pharmaceutical companies MUST keep records of the required disclosure information, collate it, thencomplete and upload the appropriate data collection template.
Pharmaceutical companies may need to review their disclosure policy and procedures for MR
payments with their legal and/or compliance departments.
4.24

In Denmark legislation stipulates that any non-double-blinded (i.e. the identity of the commissioning
client company in not known to the HCP MR subject and the identity of the HCP is not known to thecommissioning client company) and the contact between a HCP and a pharmaceutical company or
manufacturer of medical devices must be declared to the Danish Health authorities as consultancy.
The registration of contact must be made by both the HCPs and the end-client (Pharmaceutical
Company or Medical Device Manufacturer).

4.25

In France Loi Bertrand imposes a general disclosure obligation on companies manufacturing orcommercialising health products or services. It applies to market research carried out withhealthcare professionals that takes place in France, whether commissioned from inside or outside27

France and requires that agreements between market research agencies and healthcare
professionals are publically reported.
http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000028339198&dateTexte=&categorieLien=id

It is the responsibility of the commissioning client company to report that they have an agreementwith a named market research agency, its date and the purpose of the agreement (i.e. market
research).
It is the responsibility of the market research agency (or if used, their sub-contractors) to report:
1. That an agreement with individual named HCPs exists (including a number of key details suchas title, speciality, qualifications, RPPS or equivalent number, professional address)
2. The purpose of the agreement e.g. market research
3. The law states that when a benefit valued over 10 euros (including VAT) is to be given it has
to be reported by named individual. Market research incentives are considered ‘benefits’(based on the Conseil d’Etat decision 1ère / 6ème SSR, 24/02/2015, 369074). So
incentives exceeding 10 euro (including taxes where applicable) have to be reported by
named physician. All market research studies involving healthcare professionals that takeplace in France have to be declared irrespective of whether a benefit or an incentive (orneither) is offered.
4. It should be noted that:- The agreed market research incentive should not be disclosed- The sponsoring company (and product) should not be named- HCP MR subjects MUST be informed of the processing of their personal data
- This applies whether or not the client company is aware of MR subject identity.
EphMRA suggests that the agency with whom the healthcare professional has the agreement will be
the reporting agency.
Reports should be made to the central public website https://www.entreprisestransparence.sante.gouv.fr/flow/login.xhtml;jsessionid=ECCC896876F382F19E1EB0AF367B227A.sunshine-entreprise

Reporting for January to June data should be done by 1 Aug and for July to Dec data by 1 Feb.
In France Loi Anti Cadeaux/Loi DMOS (Diverses Mesures d\'Ordre Social) requires that the relevant
national association/board e.g. the CNOM (physicians) or the CNOI (nurses) etc., is informed ofagreements between companies/agencies and healthcare professionals including market researchstudies, one month before they begin. A reporting template is available on the ASOCs website. It is
possible for organisations to apply for annual approval from CNOM in advance of carrying out market
research with physicians, rather than on a project by project basis. The terms and conditions of theannual process and the access arrangements are detailed in the July 2016 article ‘New and Simplified
CNOM Approval System’ which is available within the Country News, France section of EphMRA’s
website.
http://www.legifrance.gouv.fr/affichCodeArticle.do?idArticle=LEGIARTI000006688680&cidTexte=LEGITEXT000
006072665&dateTexte=20100914

Further information upon Loi Bertrand and Loi Anti-Cadeaux may be found within the Country News,
France section of EphMRA’s website.
4.26 In the USA generally speaking the federal Sunshine Act does not include mandatory disclosure ofsurvey incentives made by pharmaceutical companies or their agents to doctors. While survey
payments were included in initial versions of the law and have been the subject of ongoing debate inCongress, the law generally excludes thank you payments for taking part in surveys provided thecompany sponsoring the research is unaware of the MR subjects’ identity. However some state laws
are different. The CASRO, PMRG and the MRA Association have advised that to their knowledge theSunshine Act does not require agencies to identify to client companies the names of healthcare

28

professionals who report adverse events. For further information see:
http://www.insightsassociation.org/article/final-physician-payments-sunshine-act-rules-released

For further details upon US state Sunshine laws see:
http://www.policymed.com/2014/04/physician-payments-sunshine-act-review-of-individual-state-reportingrequirements.html

Re-contacting MR subjects
4.27 Under GDPR, you can only re-contact respondents if they have a lawful basis e.g. consent for this. So,
if you think you might wish to contact a respondent again (even if only for simple clarification), you
MUST obtain their consent before the end of the interview. When children are researched consent forre-contact should be sought from the responsible adult and the child separately.
You don’t need to obtain their consent before re-contacting them for MR quality control purposes ordata validation, these would be very likely to be in the data’s controller’s legitimate interests but thismust be subject to assessment. If you know you’ll definitely need to re-contact respondents for asecond stage or follow-up research, you must make this clear and get consent for this, at recruitment.
4.28

MR subjects agreeing to re-contact MUST be fully informed of the purpose of re-contact and who will
make it. Re-contact questions should reflect the possible reasons for the re-contact, such as for asecond stage of the study, to ask a question missed or further explore a particular issue. The
question “May we contact you for future research?” is not sufficient to allow re-contact, this type ofstandard question is really panel building question as it asks about any other projects occurring at anunspecified future time.

4.29

In Germany, if personal data is stored for re-contact for which informed consent has been given, thepersonal data MUST be stored separately from any additional data about the individuals. The merging
of data for the specific selection of MR subjects is done by means of a code number.

4.30

Transferring personal data outside the European Economic Area (EEA)
You must not transfer personal data outside the EEA unless there are adequate data protection
measures in place. The EU Commission provides a list of countries or territories providing adequate
protection for data subjects in connection with the processing of their personal data, see theEuropean Commission’s data protection website at:
http://ec.europa.eu/justice_home/fsj/privacy/thridcountries/index_en.htm

If you have to transfer personal data to counties outside the EEA or that are not listed as having
adequate protection you may consider other means of guaranteeing the personal data you transfer isadequately protected by:- Using other legal grounds, such as unambiguous consent from individuals for the transfer of
their personal data for processing- Using Model Contract Clauses (as approved by the European Commission)- Implementing binding corporate rules (BCR’s) for transfers within a corporate group or withina group of undertakings, or within a group of enterprises engaged in a joint economic activity.
When transferring data outside of the EEA you must comply with all data protection principles.
Fair and lawful processing requires you to inform individuals about transfers of their personal
data to other countries.

29

J.

Incentives

Incentives
4.31 An ‘incentive’ is any benefit given to a MR subject to encourage participation in a market researchstudy and should be:– Dependent only on the correct completion of a questionnaire/interview and not on any
additional conditions in the case of one-off surveys– Kept to a minimum– Appropriate to the time involved– No more than the fair market value for that individual’s professional consultancy or advice– Appropriate to the MR subject type– Appropriate to the task(s).
– For patients/members of the public it is a token of appreciation – not a fee for time.
– Handled only by the agency however if the market research is conducted by a company’s inhouse researchers, MR subjects’ personal data MUST NOT be accessible to company
personnel outside the research team.
MR subjects must be clearly informed:- Who will administer the incentive- What the incentive will be- When the participant will receive the incentive- If any conditions are attached e.g. completion of specific tasks or quality control checks
4.32

Panel members should be made aware of the approximate level of commitment and/or length oftime required before the incentive will be paid.

Incentives – Country Exceptions
4.33 In Denmark, ENLI member companies are required to pay incentives to healthcare professionals incash (cheques, bankers drafts and bank transfers are acceptable). In addition, nurses must be treatedas non-HCPs, so incentives should be similar to patients rather than physicians.
4.34

In Greece, SfEE member companies should not pay incentives:- To healthcare professionals for fieldwork that lasts longer than 2 hours, fieldwork
may last more than 2 hours but incentives cannot exceed 2 hours of incentives- Directly to healthcare professionals, the transaction should involve an intermediarye.g. an agency or recruiter. When the market research is undertaken directly by thepharmaceutical company, incentives for healthcare professionals are prohibited.

4.35

In Korea KRPIA members MUST report market research survey incentives quarterly. Food, drink and“compensatory gifts” up to a value of KRW 100,000 per HCP may be provided. In addition, if thesurveys takes 30 minutes or more to answer “compensatory payment” of up to KRW 100,000 per HCP
may be provided.

4.36

In the Netherlands CGR (Stichting Code Geneesmiddel Reclame) guidelines state that incentives
should be based upon the hourly tariffs set by the NZa (Nederlandse Zorg authoriteit, the Dutch
Healthcare Authority) and that the distinction between the incentive and expenses is clear.

4.37

In Poland and Russia, if the sum total of incentives paid to a MR subject exceeds a specific level (250
PLN in Poland and 4000 RUR in Russia) within a year, the tax authorities should be advised.

30

4.38

In Spain, payment of incentives MUST be in cash (cheques and bankers drafts are acceptable).
Exceptionally, and with the prior authorisation of the CPSU some payments in kind may be made.
For further country specific details of incentives regulations, recommendations and preferences
please see EphMRA’s Overview of Incentives.

4.39

In Sweden LIF guidelines state that the maximum incentive should be 2.5% of the current KPI.

Incentives that are Not Allowed
4.40 Incentives are not allowed in the following situations:– That could influence opinion or behaviour e.g. to encourage use of a drug; excessive
payments that could be seen as an attempt to buy good opinion or reward use– That require the MR subject to spend money– That are made up of the sponsoring client’s goods, services or vouchers for these– As a covert means (alongside supposed market research questions) to collect personal data.

Free Prize Draws
4.41 With regard to free prize draws, i.e. a draw where prizes are allocated by chance, with no payment toenter, MR subjects MUST NOT be required to do anything (other than participate in the market
research) to be eligible for entry to a free prize draw. ‘Free’ includes any method of communication(post, telephone or other) at a standard rate. The MRS Regulations for Administering Incentives andFree Prize Draws February 2012 provide further details of the rules in the UK. National laws
governing free prize draws vary widely in Europe, so care must be taken to ensure the prize draw iscarried out in compliance with local law, including registering the draw with the relevant authority
and arranging for the draw to be administered by public notary or other official as required by local
law.
4.42

In Mexico, the Secretary of Governance is responsible for authorising prize draws. There are specificrequirements including registration for prize draws open to the public. Legal counsel should beobtained in order to determine if a prize draw or raffle within a specific survey population should beconsidered a public or private / closed event.

4.43‘Rules Governing Sweepstakes’ in the USA are provided by CASRO and available to members on the
CASRO website www.casro.org. CASRO specifically state that “this is an evolving body of law” andthat “it is not possible to construct a set of rules and practices that we can guarantee will comply withevery applicable law. Anyone running sweepstakes, especially online, should have their counsel
carefully monitor state and federal legislation and court decisions in this area.”

Confidentiality of Recipients’ Incentive Data
4.44 The personal data of MR subjects eligible for incentives are confidential, so cannot be passed toclients without a lawful basis such as consent, this consent MUST NOT be linked to receipt of an
incentive.

Storing Incentive Details
4.45 In Germany and in Italy tax laws make it necessary to store the private address data of MR subjects
receiving incentives for the length of time required by tax law. The same is true in Poland forincentives above a specific level. . In the Netherlands tax laws make it necessary to store theconfirmation of receipt of incentives, for the length of time required by law. Personal data MUST be

31stored in a way that ensures the date of the interview is identifiable but prevents personal data being
linked to response data.

32

5.

Key Research Stages – During Fieldwork

K.

Information to be Communicated at the Start of Fieldwork

5.1

Before fieldwork starts all of the information detailed in section 4.20 MUST be communicated torespondents.

5.2

EphMRA does not recommend the use of sales representatives as market research interviewers.

L.

Instrument and Stimulus Design and Use

Questionnaire and Question Design
6.1
Researchers should take reasonable steps to ensure that:– Questions are fit for purpose and clients have been advised accordingly– Questionnaire design and content are appropriate for the audience being researched– MR subjects are able to answer the questions in a way that reflects the view they want toexpress, including don’t know/prefer not to say where appropriate– MR subjects are not led towards a particular answer– Answers are capable of being interpreted in an unambiguous way– Personal data collected is relevant and not excessive.
https://www.mrs.org.uk/pdf/2014-09-01%20Questionnaire%20Design%20Guidelines.pdf

6.2

Market research materials should not:– Raise unfounded hopes for a treatment– Mislead MR subjects with regard to the performance of a product– Encourage members of the public to ask a healthcare professional for a particular product orhealthcare professionals to use or recommend a particular product – disguised promotion isprohibited.

Sensitive Topics
7.1
When a topic is considered sensitive, MR subjects MUST be told explicitly the subject and content of
the discussion. Sensitive topics include those that are judged to be sensitive to most people or a
specific group of people because of the nature of the subject or those that may be sensitive to aparticular individual, because of that individual’s past history.
7.2

When sensitive topics are to be discussed, the MR subject MUST be made fully aware of:–
The topic for discussion prior to the interview–
The fact that they need not answer all of the questions posed–
Their right to withdraw at any point in the recruitment or interview process.

7.3

In cases where the subject under discussion is gender specific or of a sensitive or potentiallyembarrassing nature, MR subjects should be interviewed by interviewers of the same sex, or given
the choice to be so.

7.4

If collecting information on sex, gender or age may prove sensitive, the following guidance may be
helpful, the UK MRS’s:

33–

Guidance Note on Collecting Data on Sex and Gender, January 2016
http://www.mrs.org.uk/pdf/Guidance%20on%20Collecting%20Data%20on%20Sex%20and%20Gender.
pdf–

Guidance Note on Researching Age Bands for Over 65s, July 2016
https://www.mrs.org.uk/pdf/MRS%20Best%20Practice%20Guide%20Age%20bands%20for%20researc
hing%20over%2065s.pdf

Stimulus Material
8.1
Stimulus material includes any material shown during the course of fieldwork e.g. product profiles,
branding concepts, devices, packaging materials.
8.2

Stimulus material should be fit for purpose. Pharmaceutical industry codes of practice generally
require that information claims and comparisons be accurate, balanced, fair, objective, andunambiguous, be an up-to-date evaluation of all the evidence and they should not mislead either
directly or by implication, by distortion, exaggeration or undue emphasis – the same is expected ofstimulus material.

8.3

Within any market research care should be taken to ensure that MR subjects understand when they
are providing feedback on draft materials, hypothetical scenarios, assumptions, a product indevelopment or as yet unlicensed.

8.4

In the Netherlands MOA affiliated researchers MUST NOT use stimulus with healthcare professionals
that includes brand names or indications for unlicensed products. The use of samples of prescription
only medicines is also prohibited in market research.
In Finland, the PIF Code of Ethics states market research MUST not focus upon a medicinal productwhich has not obtained marketing authorisation.

8.5

Where required (country requirement or company policy) stimulus materials to be used withinmarket research should be approved by the client company’s medical department prior to use(irrespective of format or finish).

8.6

Companies may want to consider the need for respondents to sign some form of confidentiality or
non-disclosure agreement if commercially sensitive information is shared with them and the
respondent is made aware of the identity of the end client company.

8.7

All stimulus materials should be collected at the end of the interview.

Additional ABPI guidelines for stimulus material content and format for the UK are detailed within the
BHBIA’s Legal & Ethical Guidelines http://www.bhbia.org.uk/guidelines/legalandethicalguidelines.aspx.

Use of Product Names
9.1
The unnecessary or repeated use of brand names should be avoided unless assessing reaction to thename, or use of the product by name is an essential research objective, particular care should betaken if the names of unlicensed products are to be used
The use of brand names when researching hospital ‘H’ drugs with patients in Italy although not
explicitly forbidden would be considered unethical. The Spanish Code of Good Practices for the
Promotion of Medicines and Interaction with Healthcare Professionals requires that there is no link
between the product tested and a company, so product testing should be blinded.

34

Testing Products
10.1

Companies should generally refer to their medical and regulatory departments for guidance on market
research surveys that involve testing products.

10.2 It is strongly recommended that placebos are used during market research surveys whenever practical.
10.3 Guidance for testing products via market research varies depending on the category a medication falls
into:
Licensed prescription-only medicines taken in line with the license can only be taken by a
MR subject who is an existing user of the product and if a registered medical practitioner
is present.
If a medicinal product is licensed but the MR subject is asked to use the product outside of
its approved indication(s)/dosing/formulation i.e. as an ‘investigational product’ during amarket research survey, it is recommended that the research is carried out according toGood Clinical Practice (GCP) guidelines
If the medicinal product is unlicensed, Good Clinical Practice (GCP) guidelines MUST befollowed when undertaking a market research survey.
http://ec.europa.eu/health/files/eudralex/vol-1/dir_2005_28/dir_2005_28_en.pdf

If subjects are taking non-prescription drugs (i.e. over the counter - OTC) during market research
surveys, it is recommended that an appropriate healthcare professional is present.
10.4

For market research involving medical devices or diagnostics only (i.e. there is no active ingredientinvolved), if the device is not CE marked, is an implantable device, is to be used outside the approved
license or could potentially cause a patient harm (e.g. use of a needle is involved), the commissioning
client company’s medical department MUST approve the market research approach, confirm
whether the Guidelines on Medical Devices (MEDDEV 2.7/4) need to be followed and whether anappropriate healthcare practitioner should be present.

10.5

When the client entrusts products to an agency researcher’s care, the client commits them self toproviding products compliant with laws in force and to give all the necessary information on theseproducts, providing in particular correct information on the directions for use, the ingredients list andthe transport and storage conditions. Moreover, the client MUST take the necessary measures toprovide the researcher with any constraints relating to the security of the products.
http://www.esomar.org/uploads/public/knowledge-and-standards/codes-and-guidelines/ESOMAR_Codes-andGuidelines_Mutual-Rights-And-Responsibilities-Of-Researchers-And-Clients.pdf

10.6

Clients are fully responsible for all damage or injury caused by materials or products they haveprovided to researchers for research purposes unless the researcher failed to follow the care
instructions provided by the client when the materials were in the agency’s possession (or the agency
breached any other legal obligations.

10.7

As with stimulus material, all products should be collected at the end of the interview.

10.8

Adverse Event reporting requirements associated with medical devices should be agreed with theMarketing Authorisation Holder before commencing any market research survey.

35

M.

Recording and Observation of Fieldwork

Personal Data Definition
11.1 Personal data includes sound and image data e.g. non-anonymised audio recordings and video
footage of an individual from which it could be possible to identify the individual.
Image data will always be personal data, a voice alone, may or may not be. If an individual belongs tosmall universe e.g. they are a KOL and have a distinctive accent, then voice alone is likely to be an
identifier; however a GP’s voice with a non-descript accent listened to out of area is not likely to be
identifiable data in isolation.

Consents Required
11.2 MR subjects MUST be made aware at the time of recruitment if their input is to be recorded orobserved (even if it only for analysis purposes by the agency) and why it is proposed. MR subjects
MUST always give their consent for this and consent must be recorded.
11.3

At the start of fieldwork MR subjects MUST be informed if their personal data is to be passed on to
the commissioning client company.

Information to be Communicated to MR subjects when Observed by Client
11.4 When the end commissioning client is viewing non-anonymised fieldwork live or at a later date via
streaming or video-relay this is a transfer of personal data, consequently in order to meet therequirements of informed consent, MR subjects MUST be told:– The name of the recipient company
If naming the recipient company is likely to impact on the integrity of the MR the company namecan be withheld until the end of the interview if MR subjects agree. However if MR subjects do
not want their non-anonymised input to be viewed this MUST be respected.
– Why they are viewing – different purposes require separate consents– Who (in terms of role/position not names) will see/listen to it– Of the countries outside their own to which non-anonymised information will be transferred or
viewed e.g. inform MR subjects filmed in France that the film will be viewed in the USA.
– Of their right to withdraw consent– How and who to contact within the MR agency with any questions or concerns.
In most countries the data protection/privacy regulator will require the name of the company
receiving personal data to be revealed to the MR subject. This is a GDPR requirement.
When live observation takes place via a one way mirror or sitting in there is no transfer of personal
data to the commissioning client company so the client’s identity does not need to be revealed andshould not be revealed without the company’s permission. In Germany MR guidelines require thatthe client’s identity must be revealed if requested.
When live viewing takes place via video relay/streaming (with and without archiving), data protection
requirements mean you must name the organisation(s) viewing before transfer of the personal datatakes place. So if for example, the end client is viewing fieldwork live via a video-stream the client’s
identity must be revealed before fieldwork as part of the information communicated to secure
respondents’ informed consent.

36When delayed viewing takes place via video relay/streaming (with and without archiving), if the end
client wants to view or listen in to fieldwork after it has taken place, consent for this must be secured
before the interview. However, the client’s identity may be disclosed at the end of the interview(before any personal data is shared with the client) if naming the end client beforehand would
undermine the integrity of the MR but:─ Respondents must be made aware at recruitment that:the client will be named at the end of the interview
they can withdraw their consent at any point─ The justification for this should be documented.
In Germany Live viewing of non-anonymised fieldwork via one-way mirror or sitting in at the agency’s
premises (or a sub-contracted specialist facility) is allowed as long as measures are taken to ensure
MR subjects are not known and cannot become known to observers. Non-anonymised video footage
may not be transferred to the client company to prevent identification of the MR subjects’.

Passing on Recordings without Consent
11.5 Recorded data (audio or video that could identify individual MR subjects) given to clients without MR
subject consent MUST be anonymised.

When Written Consent is Required
11.6 MR subjects’ documented consent for audio or video recording should be obtained at the beginningof the interview before recording commences. Where multiple purposes exist or are possible,
separate consent for each purpose should be obtained. Combining non-research purposes withmarket research is prohibited by MR industry guidelines in Germany, adverse event reporting within
the context of a market research project is considered a market research activity.

When a MR Subject Withdraws
11.7 If a MR subject withdraws from the research at any stage e.g. during a group discussion, theirpersonal data MUST not be processed anymore and their anonymised input should be withdrawn
from the final analysis and reporting, if they request this.

Delayed Viewing of Fieldwork e.g. by video streaming
11.8 To ensure that unauthorised viewers cannot access recorded material EphMRA recommends that thecommissioning agency/client ensures that:– Comprehensive security measures are in place– Access is password protected and restricted to authorised users (identified through a uniquelogin id) and that login ids/passwords are distributed only by the project leader– Authorised users agree in writing not to allow access to unauthorised personnel (see pro
forma 4 – Client Agreement to Safeguard Confidentiality of Recordings).
Recordings should not be archived for no longer than is required to fulfil the purposes of the study. In
Germany, MR industry guidelines state that end clients must destroy copies of non-anonymised recordings
after 3 months.

37

Listening In or Audio-only recordings
11.9 If it is possible that the MR subject could be identified by the audio-recording alone they should not
be passed to client companies unless there is a lawful basis in place e.g. the MR subject has given
their informed consent. In Germany transferring information that could lead to the identification of
the MR subject to the client is prohibited by MR industry guidelines. Listening in to audio only
recordings of a simultaneous translation (without the MR subjects’ voice) would be anonymousassuming no personal data was revealed, it is always the data controller’s responsibility to make surethat anonymity is not compromised.

Client Awareness of Restrictions on use of Recorded Data
11.10 Clients should be made aware of the restrictions on the use of recorded data at the start of a project
if they might want to watch, listen to or view copies of recordings during or after the project.

Protecting Data When it is Transferred
11.11 The agency MUST ensure that the country or organisations in those countries, to which any personal
data are transferred by them or their sub-contractors have adequate data protection measures inplace, particularly outside the EEA.

Observers’ Guidelines
11.12 When client observers are introduced, they do not need to be introduced by name. It is sufficient totell MR subjects the nature of their roles within their company and in general terms their reasons forobserving. Clients or their sub-contractors MUST NOT be passed off as members of the MR agency.
11.13 Observers should be informed of their responsibilities towards MR subjects and agree to:– Withdraw from observing if a MR subject is known to them/recognised to protect the MR
subject’s anonymity. If an observer knows that they will subsequently have to deal with a
MR subject, the attendee MUST also withdraw. However, if MR subjects are made fully
aware of the presence of an observer known to them and give explicit consent for that
individual to observe then that person may remain at the session, however care should betaken to ensure that MR subjects are completely comfortable with this. In Canada,
observers should be told that if they find they know any of the participants, they must stopobserving and notify the researcher. In Japan, if a (HCP) MR subject is known to an observer,
the observer MUST sign an agreement that they will never disclose information gained whileobserving, never make any notes, and never use directly or indirectly the information forsales/promotion activities. In Germany MR industry guidelines require that the possibility
that MR subjects are known to observers should be ruled out before viewing.
– Respect the confidentiality of all information exchanged in interviews/groups.
▫ Not record any MR subject’s personal data or record any information with thespecific aim of establishing the identity of a MR subject.
▫ Not make any notes or recordings that could be attributed to a specific MR subject.
▫ Not use the information to influence future approaches to a MR subject.
▫ Not use information gained whilst observing to amend or build databases.
– Abide by the guidelines for observers. It is good practice to obtain a signed pro forma fromall observers agreeing to adhere to these guidelines.
These conditions should apply whether observers are watching a recording or video stream in remotelocations or are viewing at the research location.

38

In Canada, MRIA members must make sure that any observer of fieldwork or recipient of a fieldwork
recording is aware of the requirements of the MRIA Code and the need to abide by these.

39

N.

Adverse Event Reporting

Based upon the Guideline on good pharmacovigilance practices (GVP), Module VI – Management andreporting of adverse reactions to medicinal products, European Medicines Agency 22 June 2012
EMA/873138/2011
Introduction
12.1 EphMRA’s Adverse Event Reporting Guidelines detail the scope of market researchers’ adverse event
reporting responsibilities and the requirements of the process.
12.2

Details of suspected adverse reactions that meet the qualifying and minimum reporting criteria
should be forwarded by the contracted market research agency and their sub-contractors to thenominated contact within the market authorisation holder that commissioned the market research.
This information is assessed by the pharmacovigilance department and if appropriate it will bereported to the regulators as an individual case safety report and/or within a periodic safety update
report.

Basis of Guidelines
12.3 EphMRA’s Adverse Event Reporting Guidelines are based upon legal requirements:–
Detailed in Directive 2001/83/EC and Regulation (EC) No 726/2004, as regards the collection,
data management and reporting of suspected adverse reactions associated with medicinal
products for human use authorised in the European Union–
Interpreted within the European Medicines Agency’s Guidelines on good pharmacovigilance
practices, particularly volume VI Management and reporting of adverse reactions to medicinal
products
Within the European Union, MAHs are legally obliged to report suspected adverse reactions and those
adverse events that they consider to be signals. Market research (MR) studies commissioned bypharmaceutical companies (MAHs) but carried out on their behalf on a sub-contract basis byindependent MR agencies are subject to the EMAs adverse reaction and event reporting guidelines
detailed in module VI and module VII. However if an organisation is conducting an MR programme
independently, without being commissioned, financed or influenced by a MAH, the requirements
provided in EU pharmacovigilance legislation do not apply. It is the MAH’s responsibility to set up
contracts with the market research supplier detailing how they would like adverse event reporting to
be implemented during the course of the study and the training required.
The term ‘adverse event’ is used as an umbrella term within this section and refers to adverse events,
potential adverse reactions, product complaints and specific reporting situations such as druginteractions.

EphMRA Members’ Responsibilities
12.4 EphMRA members should understand and adhere to the EphMRA Adverse Event Reporting (AER)
Guidelines and ensure others involved in market research (MR) abide by the guidelines too – such as
suppliers and sub-contractors as well as colleagues in marketing, sales and national/local market
researchers.
12.5

The AER Guidelines apply irrespective of which functional area or organisation/department within
the marketing authorisation holder (MAH)/pharmaceutical company initiated the work i.e. whether

40the work is commissioned by the department responsible for market research, marketing or anotherfunction.

Responsibility to MR subjects
12.6 All MR subjects whether healthcare professionals or not should be informed at recruitment of therequirement for MAHs to report adverse events that arise during MR.

Impact of Disclosure Requirements
12.7 EFPIA disclosure requirements and the US Sunshine Act do not generally require agencies to identify
to client companies the names of the healthcare professionals who report adverse events.

Glossary & Terminology
AE
Adverse Event
AER
Adverse Event Reporting
AR
Adverse Reaction
EU
European Union
HCP
Healthcare Professional
ICSR Individual Case Safety Report
MAH Marketing Authorisation Holder
MR
Market Research
PSUR Periodic Safety Update Report
PV
Pharmacovigilance
EMA Guidelines:“All applicable legal requirements detailed in this Module are usually identifiable by the modal verb “shall”.
Guidance for the implementation of legal requirements is provided using the modal verb “should”.”

Important Background Information
12.8 The European Medicines Agency categorises adverse event reports as solicited or unsoliciteddepending upon their source. With regard to market research sources solicited reports include AEs
from MR studies except when social media/digital listening is used, AEs arising from digital listening
are classified by the EMA as unsolicited reports.
12.9

Adverse events may be collected within Individual Case Safety Reports or as Signals within Periodic
Safety Update Reports collated by the marketing authorisation holders’ pharmacovigilance
department and forwarded to the regulators.

12.10 Solicited reports are “derived from organised data collection systems, which include clinical trials,
non-interventional studies, registries, post-approval named patient use programmes, other patient
support and disease management programmes, surveys of patients or healthcare providers,compassionate use or name patient use, or information gathering on efficacy or patient compliance.”
The European Medicines Agency (EMA) state that “safety reports originating from market research(MR) programmes should be considered as solicited reports. A MR programme refers to thesystematic collection, recording and analysis by a marketing authorisation holder of data and findings
about its medicinal products, relevant for marketing and business development.”41

12.11 Unsolicited reports include spontaneous reports, literature reports, other sources e.g. lay press andthose from the internet or digital media. The EMA states that:–“MAHs should regularly screen internet or digital media under their management or responsibility,
for potential reports of suspected ARs. In this aspect, digital media is considered to be company
sponsored if it is owned, paid for and/or controlled by the MAH– If a MAH becomes aware of a report of suspected AR described in any non-company sponsored digital
medium, the report should be assessed to determine whether it qualifies for reporting”
Consequently AEs arising from the use of social media to gather market research information i.e.
digital listening will be unsolicited reports whilst those cited during any other form of online market
research, face to face, telephone or postal market research will be solicited reports. This does notmake any difference to market research activities.
12.12 Individual Case Safety Report (ICSR) refer “to the format and content for the reporting of one orseveral suspected adverse reactions in relation to a medicinal product that occur in a single patient at
a specific point of time. A valid ICSR should include at least one identifiable reporter, one single
identifiable patient, at least one suspect adverse reaction and at least one suspect medicinal
product.”
12.13 Signals are “information arising from one or multiple sources, including observations andexperiments, which suggests a new potentially causal association, or a new aspect of a known
association between an intervention and an event or set of related events, either adverse or
beneficial, that is judged to be of sufficient likelihood to justify verificatory action.”12.14 ICSRs are forwarded directly to regulators and ICSRs and signals are incorporated into periodic safety
update reports these are the “format and content for providing an evaluation of the risk-benefit
balance of a medicinal product for submission by the marketing authorisation holder at defined time
points during the post-authorisation phase.”
Source: Module VI – Management and reporting of adverse reactions to medicinal products, European Medicines Agency 22 June 2012
EMA/873138/2011

42

EphMRA Adverse Event Reporting Guidelines
EMA Guidelines
Scope

EphMRA Guidelines

Suspected adverse reactions (serious and nonAER Guidelines apply to authorised
serious) and emerging safety issues associatedmedicines for human use.
with medicinal products for human use authorisedin the EU.
A medicinal product is for:– Treating or preventing disease in humanbeings– Restoring, correcting or modifying
physiological functions by exerting apharmacological, immunological or metabolic
action, or to making a medical diagnosis

AER applies to both prescription andnon-prescription bound (over thecounter) medicines.
AER requirements associated withmedical devices should be agreed with
the MAH.

Applicable to medicinal products authorised in the
EU but also to any such medicinal products
commercialised outside the EU by the same
marketing authorisation holder (MAH)
All ARs suspected to be related to any of theactive substances being part of a medicinal
product authorised in the EU.

AEs that relate to any medicinal productfor which the drug company is theauthorisation holder need to be
forwarded. Market researchers are notrequired to collect events cited for othercompanies’ medicinal products.

The pharmacovigilance (PV) rules laid down in
Directive 2001/83/EC and Regulation (EC) No
726/2004 do not apply to investigational medicinal
products and non-investigational medicinal
products used in clinical trials conducted inaccordance with Directive 2001/20/EC21.

Serious and non-serious adverse
reactions should be included. It is not
the market researcher’s responsibility to
decide what is and is not serious.

Independent of the strengths, pharmaceuticalforms, routes of administration, presentations,authorised indications, or trade names of the
medicinal product.
Where a case of ARs is reported to be related
only to a therapeutic class, it is considered
incomplete and does not qualify for reporting.

AEs should be forwarded whether citedin the company’s brand or generic
name.

AEs cited in groups of drugs should not
be forwarded.

Companies should provide agencies witha list of medicinal products for which
they hold the marketing authorisation.
Definition of
an Adverse
Event

Any untoward medical occurrence in a patient or
clinical trial subject administered a medicinal
product and which does not necessarily have acausal relationship with this treatment.
An adverse event can therefore be any
unfavourable and unintended sign, symptom, ordisease temporally associated with the use of a
medicinal product, whether or not consideredrelated to the medicinal product.

The definition of an adverse event istaken from the EMA’s Guideline on
good pharmacovigilance practices (GVP)
Annex I – Definitions 2012.
Adverse event is an ‘umbrella term’ that
includes adverse reactions and productcomplaints.

43

Definition of
an Adverse
ReactionA response to a medicinal product which isnoxious and unintended. Response in thiscontext means that a causal relationship between
a medicinal product and an adverse event is atleast a reasonable possibility. Adverse reactions
may arise from use of the product within or
outside the terms of the marketing authorisation
or from occupational exposure. Conditions of use
outside the marketing authorisation include offlabel use, overdose, misuse, abuse andmedication errors.
Plus:– Suspected or confirmed falsified product or
quality defects

An adverse reaction is directly linked tothe medicine i.e. is caused by the
medicine, the adverse event may notbe.

– Suspected transmission via a medicinal
product of an infectious agent– Misinformation in the product information– Use of a medicinal product during pregnancy
or breastfeeding– Lack of therapeutic effect . . . unless thereporter has specifically stated that theoutcome was due to disease progression– For vaccines , cases of lack of therapeutic
effect should be reported– Drug interactions – drug/drug, drug/food, drug

Lack of efficacy whether unexpected or
expected needs to be reported unless it
is due to disease progression i.e. thedrug would have been expected to work
but the patient’s disease worsened.

device and drug/alcohol

Reports of overdose, abuse, off-label use,
misuse, medication error or occupational
exposure with no associated adverse reaction
should not be reported as ICSRs. They should beconsidered in periodic safety update reports asapplicable.

Causality

The definition of an AR implies at least areasonable possibility of a causal relationshipbetween a suspected medicinal product and an
adverse event
If the primary source has made an explicit
statement that a causal relationship between the
medicinal product and the adverse event has
been excluded and the receiver (competentauthority or marketing authorisation holder)agrees with this, the report does not qualify as avalid ICSR since the minimum information isincomplete.

Minimum
ReportingCriteria

It is not the market researcher’s
responsibility to assign causality
AEs should be reported even if thereporter states that there is nolink/causal relationship between theevent and the drug. This may be thecase but the decision not to forward theevent can only be taken by the MAH.

A valid ICSR should include at least one
For the purpose of reporting AEs, theidentifiable reporter, one single identifiable patient, minimum data elements for a case are:at least one suspect adverse reaction and at one
1. Identifiable reporter
suspect medicinal product.

2. Identifiable patient or patients
3. Suspected adverse event
4. Suspected medicinal product.

44

Researchers should identify events
based on the information cited, they are
not required to probe for missing
reporting criteria.
1. Identifiable reporter
One or more identifiable reporter characterised byqualification (e.g. physician, pharmacist, other
HCP, lawyer, consumer or other non-HCP) name,initials or address.
There are several types of primary sources[reporter]:– A healthcare professional is defined as a
medically-qualified person such as a physician,dentist, pharmacist, nurse, coroner or asotherwise specified by local regulations.
– A consumer is defined as a person who is nota healthcare professional such as a patient,
lawyer, friend, relative of a patient or carer.

THE FOLLOWING GUIDELINE HAS BEEN
AGREED WITH THE EMA BUT THE ISSUE OF
AER FOR UNIDENTIFIABLE AND
UNTRACEABLE PATIENTS IS STILL UNDERCONSIDERATION AND EphMRA IS
AWAITING FURTHER GUIDANCE FROM THE
EMA If an adverse event is mentioned in

the context of a group of patients it isessential to establish that the patientsactually exist i.e. they are/were real
2. Identifiable patientpatients actually seen. Reporters
One single identifiable patient characterised byinitials, patient identification number, date of birth, should be able to state how many
age, age group or gender. The information should patients have been impacted if it is
be as complete as possible.
suggested there is more than one. If
this information is not available, theReasonable attempts should therefore be made to adverse event does not need to beobtain and submit the age or age group of theforwarded. In the UK, ABPI/BHBIA AER
patient when a case is reported by a healthcare
guidelines state that AEs without anprofessional, or consumer in order to be able toidentifiable individual patient or
identify potential safety signals specific to aparticular population.
numbered group of patients still need
to be reported.
When collecting reports of suspected ARs via theinternet or digital media, the term “identifiable”
refers to the possibility of verification of theexistence of a reporter and a patient via verifiable
contact details (e.g. an email address under avalid format)
3. Suspected medicine
One or more suspected substance/medicinal
product
Biological medicinal products, the definite
identification of the concerned product with regard
to its manufacturing is of particular importance.
Therefore, all appropriate measures should betaken to clearly identify the name of the productand the batch number

When forwarding AEs arising from theuse of social media to gather market
research information i.e. digital listening(spontaneous AEs), for both thereporter and patient (it may be thesame person) it should be possible toverify the individual’s existence via
contact details even if these are not to
be used.

MAH responsibilities apply to reports related to
medicinal products for which ownership cannot be
excluded on the basis of one the following criteria:
medicinal product name, active substance name,pharmaceutical form, batch number or route ofadministration.
4. Suspected adverse reaction

45

One or more suspected AR.
The report does not also qualify as a valid ICSR if
it is reported that the patient experienced anunspecified AR and there is no information
provided on the type of AR experienced.

Passing on
ReporterContact
Details

Reports, for which the minimum information isincomplete, should nevertheless be recorded
within the pharmacovigilance system for use inon-going safety evaluation activities

AEs should be reported even if thedetails are incomplete:
1. Reporter – in MR research there will
always be a reporter and it will
generally be known if the reporter is
at least a HCP or a non-HCP
2. Patient – there should be a patientor a specific number of patients.
Patient details should be collected if
possible
3. Drug – there must always be a drug
for which the company
commissioning the MR is the MAH
4. Adverse Event – there must always
be an AE of some type even if thedetail is sparse

Reports should include the verbatim text as usedby the primary source or an accurate translation ofit
Whenever possible, contact details for thereporter should be recorded so that follow-up
activities can be performed. However, if thereporter does not wish to provide contact details,
the ICSR should still be considered as valid
providing the organisation who was informed of
the case was able to confirm it directly with thereporter.

Describe the AE as clearly and carefully
as possible, try to avoid paraphrasing
Researchers must ask the reporter ifthey are willing to provide their contact
details and allow these to be passed to
the MAH so that if required PV follow
up is possible.
Contact details (i.e. personal data)cannot be passed on without consent,
explicit consent in the case of patients.
When securing consent to transfer
personal data to the pharmaceuticalcompany for AE reporting the GDPR
requires that the recipient company isidentified. As AE reporting is a separate
processing operation (to the MR),
consent for this may be secured at theend of the interview.
In addition, when asking for consent topass on contact details, it must be clearthat the MAH can only use the personal
data for AE investigation purposes andreporters must be made aware thatthey may be re-contacted with regard
to the AE by the MAH. AEs can be
forwarded without contact details if
consent to pass these on is denied.
In Germany MR industry guidelines
prohibit revealing MR subject identity46

to the client. It may be practical torequest that the MR agency facilitates
any follow up between the MAH’s PV
department and the reporter (soprotecting the reporter’s anonymity) byallowing questions and answers to bepassed via the agency with no personal
data passed to the MAH.
Attempts should be made to obtain consent toConsent for
Further Follow contact a nominated HCP to obtain further followup information
Up from a
Consumer

Non-HCPs/consumers should be asked
if they are willing to consent to supply
contact details for the relevant HCP. If
they do not consent, the AE should still
be forwarded

Duplication of
AE Reports

If the primary source may also have reported thesuspected AR to another concerned party, thereport should still be considered as valid

Even if the primary source/reporter has
already reported the AE directly to theauthorities or the MAH, it must bereported from the MR

Who Should
Forward AEs

Any personnel of the marketing authorisation
holder, including medical representatives andcontractors.

All employees of the commissioning
pharmaceutical company/MAH - market
researchers, sales representatives,
clinical research associates etc.
All organisations and individuals
contracted to work (and report AEs
events) on behalf of the MAH including
MR agencies, MAHs should have acontract in place with all their suppliers
Any sub-contractors used by the MR
agency e.g. freelance recruiters,interviewers, coders – MR agencies
should have a contract in place with all
their suppliers

ReportingTimetable

ReportingFormats

Contextual information:
The clock for the reporting of a valid ICSR starts
as soon as the information containing theminimum reporting criteria has been brought tothe attention of the national or regional PV centre
of a competent authority or of any personnel ofthe marketing authorisation holder, including
medical representatives and contractors. Thisdate should be considered as day zero. In
practice this is the first business day the receiver
becomes aware of the information.

AE reporting forms should becompleted and forwarded to the MAH
within one business day of the firstawareness of the AE. Awareness refers
to first knowledge within the normal
course of the MR process/project. E.g.
For AEs cited within a self-completion
online survey, first knowledge will be on
review of the data at the DP/analysis
stage, in which case it will not be
forwarded until after fieldwork.
There are two potential AER formats:– AE Reporting Form - generally used
when responses are generated oranalysed on a MR subject by MR

47

subject basis e.g. from one to one
interviews or group discussions– Tabulations of aggregate data appropriate when AE data are only
reviewed in aggregate so AEs canonly be detected at the point ofcoding or analysis at intervals during
fieldwork or at the end of datacollection e.g. an online survey
The reporting format should be agreed
with the MAH at the project start
AE ReportingForm

The MAH should supply the AER form
EphMRA provide a standard AER form
that can be used

When andHow ToComplete AER
Forms

Complete the AER form at the end of theinterview – there is no need to interrupt
the interview to fill it inCollect as many details on the form as
possible, ideally complete it with thehelp of the reporter
The company should provide an email or
fax address to which completed AER
forms should be sent

The Format ofAE
Tabulations

AER tabulations should show:– Number of MR subjects citing event– Question base i.e. how many MR
subjects answered the question
The format should be agreed with the
MAH in advance of data processing

Quality
Management
and Training

Clear written standard operating proceduresshould guarantee that the roles andresponsibilities and the required tasks are clear to
all parties involved and that there is provision forproper control and, when needed, change of thesystem. This is equally applicable to activities thatare contracted out to third parties, whose
procedures should be reviewed to verify that they
are adequate and compliant with applicablerequirements.

Both client companies and market
research agencies should have clear andcomprehensive operating procedures inplace for the collection of adverse
events – these should be exchanged
upon project commissioning at thelatest and AER responsibilities built into
contracts.

Personnel who may receive or process safety
reports (e.g. clinical development, sales, medical
information, legal, quality control) should betrained in adverse event collection and reporting

Training should be undertaken to
ensure that all those directly involved in
AE reporting have a clear understandingof how to recognise an AE and what
action is required48

in accordance with internal policies andprocedures.

Confirmation
and/orReconciliation
Process

Where the MAH has set up contractual
arrangements with a person or an organisation,
explicit procedures and detailed agreements
should exist between the MAH and theperson/organisation to ensure that the MAH cancomply with the reporting obligations. These
procedures should in particular specify theprocesses for exchange of safety information,
including timelines and regulatory reporting
responsibilities and should avoid duplicate
reporting to the competent authorities.
When transfer of PV data occurs within an
organisation or between organisations having
concluded contractual agreements, themechanism should be such that there isconfidence that all notifications are received; inthat, a confirmation and/or reconciliation process
should be undertaken.

Confirmation and/or reconciliation
involves production of a summary of all
AEs identified during the project to be‘reconciled’ with/checked against theindividual AEs received during the MR
study ensuring all AEs are accounted for
An AE reconciliation form should becompleted at the end of each MR study(not at the end of fieldwork) even if noAEs were forwarded and irrespective ofwhether data collection forms or tables
were used
Reconciliation form should include:– Number of AEs identified (not justreported)– Summary by each AE of MR subject
ID, medicinal product (s) and event
details

SyndicatedStudies

MAHs have no obligations [to collect AEs] if the
programme is not commissioned, financed or
influenced by them. In this example* GVP VI
does not apply, since it concerns only MAHs andCompetent authorities in the EEA. However local
requirements may be applicable to theorganisation who is conducting the programme.
You need to check directly with the competentauthorities of the Member State where theprogramme is conducted. Source: EMA Comment

For syndicated studies e.g. patient diarystudies, there is no legal responsibility
for the supplier to forward AEs as the
supplier is not the legal agent at thetime of data collection

Responsibility to collect AEs lies with the
MAH that purchases the syndicateddata, the MAH’s market researcher
to EphMRA
should forward the AE data to the PV* “this example” refers to market research studies department, the supplier may bethat are designed and run independently by arequested to prepare the data in themarket research agency and the findings thenappropriate format for the MAH
sold to several pharmaceutical manufacturers, so
there is no MAH involved during design, datacollection or processing.

If confidential questions are added to a
syndicated survey by a MAH, the datafrom these questions must be treated in
the same way as an ad hoc study i.e. the49

agency should forward AEs generated bythese questions

50

Longitudinal
Patient
Databases

Longitudinal patient databases e.g.
GPRD (General Practice Research
Database) are out of scope
The Council for International
Organisation of Medicinal Sciences(CIOMS ) V suggests that there is no
obligation to search through suchdatabases for individual AEs as this will
give rise to spurious signals andconclusions however if they are found(deliberately or co-incidentally), theyshould be forwarded. Data fromlongitudinal patient databases aredifferent to tabular AE summaries
collected from MR as they have notarisen from a defined project and are formultiple uses, not just acquired by an
MAH for internal use (unlike
commissioned MR)

If You Have
Questions

The MAH’s PV department is a mostimportant source of guidance onrequirements for forwarding AEs

51

EphMRA Adverse Event Reporting Form – TEMPLATE
MR Agency Information
Agency name
Telephone number
Researchers nameDate aware of Adverse Event
Project title/reference number
MR subject ID/AE number

Patient Information
Number of patients
Availability of patient information
Age and Gender
Pregnant

YES
AGE
YES

NO
FEMALE

MALE
NO

Drug and Event Information
Drug name
Description of Adverse Event

Indication/condition for which drugprescribed
Daily DoseDON’T KNOW

Lot/batch number.

DON’T KNOW

Frequency

DON’T KNOW

Route of administration/form

DON’T KNOW

Reported to local regulator

Does reporter think drug caused event

YES
YES

NO
NO

DON’T KNOWDON’T KNOWMR Subject/Reporter details
Reporter/MR subject name
Reporter type (E.g. doctor, patient)
MR subject’s address/contact information if
willing to provide
NOT WILLING TO PROVIDE
I agree to my information being forwarded to [NAME OF COMPANY/MAH] for the purpose of following up on thisadverse event report if follow up is necessary
Willing to be contacted for follow up
YESNO
SIGNATURE
Doctor’s name & address if patient is a MR
subject/reporter

52

6.

Key Research Stages – After Fieldwork

O.

Analysis and Quality Control

13.1

Researchers and agencies should anonymise or pseudonymise personal data as soon as possible
during the MR process.

13.2

Researchers must when requested by clients allow independent checks on the quality of datacollection.

P.

Storage and Security

Consent for Storage of Personal Data for Future Use
13.3 Personal data e.g. contact details should only be stored for future use if consent has been given.

Storage Duration
13.4 Personal data MUST be destroyed as soon as the purpose for which it was processed is redundant.
In Russia, Personal data should not be stored for longer than it is needed for processing unless the
personal data retention period is established by a federal law or a contract.
13.5

The researcher/agency should store research records for an appropriate length of time - there are no
absolute guidelines on how long this should be. This period will vary according to the nature of thedata, the type of project and the need for future research or follow up analysis. Personal data (such as
recruitment questionnaires) can be destroyed before non-personal data (such as tabulations).

Security
13.6 All those processing personal data should have a data breach notification policy in place. For more
information on data breaches please see the EphMRA guide ‘GDPR Data Security’ available tomembers on the EphMRA website.
13.7

The data disposal method should be appropriate to the sensitivity and confidentiality of the data.

13.8

If video streaming has been used to allow remote viewing of fieldwork it is possible that the video
transmission system used delivered a copy of the recording to the receiving computer. If this was thecase the researcher MUST take steps to ensure that any copy of the video stream saved on theobserver’s computer is deleted.
ESOMAR Guide on Passive Data Collection, Observation and Recording

53

Q.

Reporting Market Research

13.9

Researchers should take reasonable steps to ensure that:– Interpretation and conclusions are adequately supported by the research findings, with
explanation as to which data support the interpretation.
– The detail necessary to assess the validity of findings is available (including sample size,
question source, statistical tests used) and that data tables include sufficient information to
enable reasonable assessment of the validity of the results.
– Reports and presentations accurately:▫ Reflect the findings of the research.
▫ Reflect the researcher’s interpretations and conclusions.
▫ Distinguish between factual reporting of data and a researcher’s interpretation.
And that the content does not breach any copyrights.

13.10 Combining data is permissible as long as personal data is not released to the client company whendata is combined and combining the data does not enable the client to identify the MR subject.
13.11 Personal data MUST not be included in reports unless there is a lawful basis for this e.g. consent has
been given. If personal data is included in the report the client as the recipient of personal data willneed to be identified to the data subjects whose personal data is used.

R.

Publishing Market Research

13.12 The client should not publish any of the results of the survey without the approval of the agency
unless otherwise agreed in advance.
13.13 In Spain, market research studies not published in renowned scientific/medical publications (i.e.
NEJM, Lancet, etc.), cannot be used as references for prescription medicines promotional materials.
In Turkey, the AIFD Code of Good Promotional Practice and Good Communication 2015 5.2, statesthat the use of IMS grid sales data in promotion does not conform to the Code.
13.14 Researchers should check any client-prepared materials prior to publication to ensure that the
research results are not misleading.
13.15 Full details of the source should be referenced and must include detail that will allow the audience toassess the quality of the data and the validity of the conclusions. The material included must not breach
copyright.
13.16 In the USA, CASRO and MRA members are obliged to disclose the:– Sponsor of the study– Description of the study’s purpose– Name of the research organisation conducting the study– Method of data collection– Date(s) of data collection– Sampling frame, method and size
– Exact wording of the questions– Calculated margin of error for quantitative studies

54

CASRO Code of Standards and Ethics for Survey Research, http://www.insightsassociation.org/issuespolicies/casro-code-standards-and-ethics

In the Netherlands, MOA affiliated researchers commit themselves to sending out a researchframework, when sending out press releases intended to publish research findings. The request is
made to both the external media, and to the internal press services, to add the framework at thebottom of the article.
13.17 If research is misreported by a client, the researcher should as soon as possible:– Refuse consent for their name to be used in connection with the misreported findings.
– Publish a statement that the results have been misreported and correct the misreporting.

55

7.

Researchers’ Responsibilities by Research Approach

S.

Face to Face Methodology

14.1

It is good practice for the interviewer to provide an identity card to the MR subject.

T.

Telephone Methodology

Unless otherwise stated the guidelines below apply to both telephone research using mobile phones andfixed-line calls.
Naming the Agency/Researcher
15.1 The interviewer MUSTgive the name of the agency that he/she represents and MUST give their own
or an agreed contact name.

Do not call lists
15.2 Do not call lists specific to market research must be respected.

Special Precautions When Contacting Mobile Phones
15.3 Researchers should take special care when contacting MR subjects via mobile phones (whether by
voice, text or email), with regard to MR subject safety and privacy:– It is recommended that interviews by mobile/WAP phone are preceded with a question suchas "is it convenient to proceed with this interview now?"– The MR subject should be told the likely length of the interview.
– It may be more convenient to arrange an appointment to call back at a different time or via aland line.
– Researchers should try to establish as early as possible if the number to be contacted /contacted is that of a mobile or a fixed-line telephone.
When calling mobile phones researchers should recognise that even where legislation restricts
unsolicited calls for commercial purposes but not market research, it is important to consult andapply any existing research-specific do-not-contact lists for mobile and fixed line phones.

Use of Unsolicited Texts for Recruitment
15.4 ESOMAR advises against the use of unsolicited text messages to recruit market research study MR
subjects and provides a ‘Summary of regulations covering unsolicited contacts (business toconsumer)’ May 2013, this is available on the ESOMAR website.

Use of Apps
15.5 You must have a lawful basis e.g. MR subject consent for the use of an app and MR subjects MUST be
made aware of its purpose, the type of data it collects and its impact on functioning or performancesuch as degradation of battery life. See also 17.7 and for further details see ESOMAR’s Guideline for
Conducting Mobile Market Research.

56

It is suggested that legal advice is sought if an app uses a location device or tracks activities without
user engagement (e.g. passive listening) to ensure that data protection and privacy rights are notcontravened.

Country Specific Guidance
15.6 Regulations in force in Canada could potentially establish legal liability for researchers contacting
potential MR subjects via a mobile device. In general, researchers must not make unsolicited email
approaches to potential participants unless individuals have a reasonable expectation that they may
be contacted for market research due to a pre-existing relationship with an organisation.
15.7

In Germany and the UK the use of predictive/auto-diallers is restricted. In the USA they are
permitted only if the MR subject has given prior explicit consent. When they are used, “abandoned
or silent calls”, (i.e. there is no live interviewer) immediately available, are not allowed.
https://www.mrs.org.uk/pdf/2012-02-23%20Regulations%20for%20Predictive%20Diallers.pdf

15.8

In Germany telephone interviews that are in any way directly linked with telephone marketing areprohibited. For further details upon telephone interviewing in Germany see Guidelines on Telephone
Surveys published by the German market research organisations
In the Netherlands the ‘Onderzoekfilter’ is set up specifically for registering ‘do-not-call’ requests
regarding market research. Research agencies affiliated to the MOA, the FEB and the VSO, theassociations of the market and policy research, MUST check the available phone numbers at the‘Onderzoekfilter’ before starting any unannounced telephone surveys.

15.9

In the USA the CASRO Code of Standards and Ethics requires research organisations to verify that
individuals contacted for research by email or text message have a reasonable expectation that they
will receive email or text message contact for research (and provide further detail upon what
constitutes ‘reasonable expectation’).

15.10 In the USA the Federal Government has recognised the distinct separation between survey researchand telemarketing. The restrictions included in the 1995 Telemarketing and Consumer Fraud andAbuse Prevention Act, the 1991 Telephone Consumer Protection Act, and the 2003 National Do Not
Call Registry apply to telemarketing and NOT to market research calls. Under the laws, calls made forsales-related purposes MUST comply with the ‘do-not-call’ request of the person called. Telephone
calls for survey research purposes are not bound by these provisions, although companies should be
careful in drawing this line and should be aware of ongoing debate and concern about survey
activities by some regulators and legislators. However, CASRO members maintain internal do-not-calllists of those individuals who have specifically requested not to be contacted by that company forparticipation in survey research.
FCC Regulations (October 2013), permit market reserach calls made to mobiile phones using an autodialler only with the “prior express consent“ of the intented recipient to receive such calls.
15.11 In the USA there is a federal prohibition on calling:– A doctor’s office or a healthcare facility where the called party is charged for the call or insuch a way that 2 or more telephone lines of a multi-line business are engaged
simultaneously.
– Cell/mobile phones with an auto-dialler (any equipment capable of dialling a telephone
number prior to a live operator being available to exclusively handle the call).

57

In addition, operators of automated dialling equipment need to remove any number classified as apublic safety answering point (PSAP), in line with the Telephone Consumer Protection Act (TCPA).

58

U. Ethnographic/Observational Approaches
Definitions
16.1 Observational or ethnographic research are defined as any research form which relies significantly
upon the observation of human behaviour as one of its data sources, whether MR subjects are
openly observed (participant observation) or covertly or indirectly observed (non-participant).
16.2

Images of people on film and audio recordings of them would be considered as personal data under
Data Protection legislation.

Guidelines
16.3 When conducting ethnographic market research researchers are advised to:– Inform MR subjects of the overall reasons for the observation of their behaviour.
– Clarify in writing and gain documented agreement as to the precise nature of the researchand the responsibilities of each party.
– Inform MR subjects of the extended nature of ethnographic research at the point of
recruitment before they agree to participate. Timings should be clear.
– Inform MR subjects at recruitment of any activities they will be asked to undertake.
– Use language that is understandable.
– Explain significant factors that could influence the person’s willingness to participate (suchas risks, discomfort, adverse effects, or limitations on confidentiality).
– Guard against unwarranted intrusion; so safeguards and the ability to end the observation
quickly should be built in – the right to withdraw MUST be respected.

Constraints
16.4 There are a number of constraints upon how covert observational data may be collected and used:– Where recordings for market research purposes are made in public areas e.g. in store, signs
MUST be displayed indicating:▫ Who is recording▫ Purpose of recording▫ Means of contact - phone number– Signage should be displayed with some prominence in a large and readable typeface.
– Cameras MUST be sited so that they monitor only the intended areas.
https://www.mrs.org.uk/pdf/2014-09-01%20Qualitative%20Research%20Guidelines.pdf
http://www.esomar.org/uploads/public/knowledge-and-standards/codes-and-guidelines/ESOMAR_Codes-andGuidelines_Passive_Data_Collection-Observation-and-Recording.pdf

59

V.

Online & Mobile Market Research

Definitions
17.1 Online or internet research refers to research in which a MR subject or researcher is involved in anyof the following:– Completing research documentation online regardless of access route– Downloading research documentation from a server and returning it by email– Receiving research documentation incorporated into an email and returning by email– Participating in an online qualitative interview or discussion– Taking part in a measurement system which tracks web usage– Participating in an online message board– Collecting information from social media– Any other collection of data in the online environment for the purpose of market research
Mobile market research (sometimes referred to as eResearch) involves the collection of information
by mobile device (mobile phones, tablets and other similar mobile computing devices) for market
research purposes.
These guidelines apply to market research carried out on mobile phones or devices and to browser
based or downloaded applications, passive and active data collection.
17.2

An online ‘access panel’ is defined as a sample of potential MR subjects willing to receive invitations
to participate (if selected) in future online interviews. Further guidance for research suppliers setting
up and managing online panels are available from ESOMAR at
https://www.esomar.org/uploads/public/knowledge-and-standards/codes-and-guidelines/ESOMAR_26Questions-To-Help-Research-Buyers-Of-Online-Samples.pdf . These cover panel recruitment, project

management, monitoring, maintenance and data protection issues.
17.3

A MR subject’s email address or other personal identifiers (e.g. screen or user name or device
identifier) is personal data where it refers to an individual and therefore needs to be protected in thesame way as other identifiers. A person’s digital image is personally identifiable data. Geo-location
data may be considered personal data too.

17.4

In the UK market research emails are not defined as commercial communications within the 2011
Amended Privacy and Electronic Communications Regulations. Consequently clients can forward
customer email addresses to agencies (for recruitment purposes), unless the client has included
market research in their standard data protection opt out policy.

Informed Consent
17.5 If relying on informed consent you must provide an easy way for MR subjects to supply and withdraw
it.
17.6

MR subject consent is required for the installation and use of software such as an app and MR
subjects MUST be made aware of its purpose, the type of data it collects and its impact on
functioning or performance such as degradation of battery life. For further details see ESOMAR’s
Guideline for Conducting Mobile Market Research

60

Privacy and Data Protection
17.7 Researchers MUST post a privacy policy statement, sometimes referred to as a privacy notice. The
statement should be easy to find, easy to use and understand, including by children whenappropriate.
17.8

Links to data protection; privacy policy or cookie consent statements MUST be given at the start ofthe market research. This will ensure that should MR subjects fail to complete the exercise for any
reason their rights are protected.

17.9

If a repeat or follow-up survey is intended, a lawful basis for storage of their contact data e.g. consent
is needed. The MR subjects MUST be able to refuse further participation in the survey via a suitableoption and to refuse further contact by email in connection with the survey.

17.10 When emails are sent in batches, MR subjects’ email addresses MUST be kept confidential, so for
instance blind copying should be used.

MR Subject Costs
17.11 MR subjects should be alerted to any costs they may incur e.g. online charges and recompensed
appropriately for these.

Researcher or Agency Contact Details
MR subjects should be told of the researcher’s identity and given contact details. They should also be given
the opportunity to find out more about the research agency carrying out the study, by giving them the nameof the organisation together with an address, a corresponding hyperlink is recommended. When working
overtly in social media sites, researchers should also provide contact details.
Protecting Personal and Company Data
17.12 Researchers MUST use adequate technological and organisational measures to protect personal datawhen collected, transmitted or stored on websites or servers.
17.13Clients should be made aware of the potential risks of using confidential information in online or mobile
surveys (e.g. within product descriptions). Agencies should be required to implement strict security
procedures. Confidential information even if protected by non-disclosure agreements is easily
printed/stored/forwarded and practically impossible to remove from circulation.

Cookies17.14 Cookies store specific information about online browsing. EU legislation states that a cookie can be
stored on a user's computer, or accessed from that computer, only if the user "has given his or her
consent, having been provided with clear and comprehensive information". So the use of cookies
MUST be disclosed, as well as a clear description of the data collected and the uses to which it will be
put – this MUST be easily accessible - and consent may be required (depending upon national
legislation.) and whether personal data is collected or not. ESOMAR provides a Practical Guide on
Cookies61Interview Duration
17.15 MR subjects should be told the length of time the questionnaire is likely to take to complete undernormal circumstances (e.g. assuming connection is maintained and standard connection speed).

Disclosing List Sources from Website Registration Databases
17.16 Where lists (including client-supplied lists) are used for sample selection, the source of the list MUST be
disclosed. Where these are derived from website registration databases, researchers MUST check that
registration was voluntary and that the data are current.

Use of Unsolicited Emails for Recruitment
17.17 Researchers should avoid intruding unnecessarily on the privacy of MR subjects. ESOMAR advisesthat unsolicited e-mail approaches to potential MR subjects should not be made even in countries
where this is permitted by law unless individuals have a reasonable expectation that they may becontacted for research. ESOMAR provides a ‘Summary of regulations covering unsolicited contacts(business to consumer)’ May 2013,
http://www.esomar.org/uploads/professional_standards/guidelines/ESOMAR-Codes&Guidelines-Legislativeissues-unsolicited-contacts.pdf

When receiving email lists agencies should verify that individuals listed have a reasonable
expectation they will be contacted for market research purposes.
In Mexico, unsolicited email must not be sent unless a previous relationship exists, and the recipientis aware and agrees to that use in the sender’s privacy disclaimer.
In the Netherlands article 11.7 of the Telecommunications Act (Telecommunicatie wet) requires priorconsent from individuals to be contacted via their email addresses for commercial (charitable oridealistic) purposes. When an e-mail address is used for sending invitations for research, or forsending a survey, this is considered not to be commercial (charitable or idealistic) purposes, but
purely for research, information gathering, and therefor prior consent is not required. If, however,under the pretense of market research the intention is to sell something, this exception does not
apply.
In the USA the Federal CAN SPAM Act and CASRO’s mandatory Code of Standards requires priorconsent from individuals to be contacted via their email addresses. CASRO’s Code requires researchorganisations to verify that individuals contacted for research by email or text message have areasonable expectation that they will receive email or text message contact for research (andprovide further detail upon what constitutes ‘reasonable expectation’).

Identification of the Client
17.18 Data protection law requires you to identify data controller(s), recipients of personal data and thesource of the personal data (if it wasn’t obtained directly from the individual). Therefore the end
client company needs to be identified if they any one of these three criteria.

Active Self-Selection of MR subjects in Germany
17.19 In Germany, the ADM Standards for Quality Assurance for Online Surveys state that participants
within online surveys MUST be actively selected (i.e. they MUST opt-in) as opposed to passive selfselection. ADM Standards for Quality Assurance for Online Surveys 200762

17.20 Measures should be in place to validate the identity of MR subjects (to avoid surrogate MR subjects)
and to check the quality of responses (e.g. to identify cursory or random response patterns).

Use of Apps
The AMSRS (Australia), the MRS (UK) and CASRO (USA) also provide the following guidelines, drawn from theDraft Mobile Research Guidelines August 2013:https://www.mrs.org.uk/pdf/2013-08-30%20Draft%20AMSRS%20CASRO%20MRS%20Mobile%20Research%20Guidelines.pdf

17.21 Researchers MUST NOT:
- install software that modifies the mobile settings beyond what is necessary to conduct research;- Install software that knowingly causes conflicts with the operating system or cause otherinstalled software to behave erratically or in unexpected ways;- Install software that is hidden within other software that may be downloaded or that is difficult
to uninstall;- Install software that delivers advertising content, with the exception of software for the purposeof legitimate advertising research;- Install upgrades to software without notifying users and giving the participant the opportunity to
opt out;- Install software that inordinately drains battery life;- Install software that causes any costs to the participant that aren’t reimbursed by the researchorganisation;- Install or utilise geolocation tracking software that would compromise the participant or theirpersonal data;- Create a risk of exposing personal data during data transmission or storage;- Change the nature of any identification and tracking technologies without notifying the user;- Fail to notify the user of privacy practice changes relating to upgrades to the software; or- Collect identifiable data that may be used by the app provider for non-research purposes; orExtract information from the mobile device or phone unless this information is part of the purpose of thestudy (and informed consent is obtained).

Using Identification and Tracking Technologies/Software
17.22 MR subjects MUST always be told at the first opportunity when software is being used to collectinformation about them, they MUST also be told:– Why it/they are to be used
– If the data subject’s information is to be shared– That they can turn them off or remove them.
Consent for downloading software to be used for market research purpose should be sought and ameans provided to address questions.
ESOMAR provides example disclosure statements within its Guidelines for Online Research 2011 anddetails a series of 15 ‘Unacceptable Practices’ that researchers must forbid or prevent.
https://www.esomar.org/what-we-do/code-guidelines/esomargrbn-online-research-guideline

In Germany websites that use analytics tools MUST give users the chance to opt out.
For the USA CASRO provides detailed guidelines with regard to the use of active agent technology
within its Code of Standards and Ethics

63

Online Access Panels
17.23 Panel members MUST be made aware that they are members of a panel and should be reminded ofthis at regular intervals. Access panels are a sample database of potential MR subjects who declarethat they are willing to receive invitations to participate in future online interviews. At recruitment
potential panel members MUST be told that their personal data may be stored for further market
research and there must be a lawful basis for this in place.
17.24 ESOMAR provides a series of guidelines on internet access panels, covering panel recruitment,
management, monitoring, maintenance and privacy/data protection, and a battery of 26 Questions
to help research buyers. More details can be found within these guidelines and the question battery
can be found at ESOMAR Guideline for Online Research Aug 2011.
17.25 ESOMAR are also developing joint guidelines with the GRBN for Online Sample Quality which provide
guidance on the operational requirements for providing online samples for market, research.
https://www.esomar.org/uploads/public/knowledge-and-standards/codes-and-guidelines/ESOMAR-GRBNdraft-Online-Sample-Quality-Guideline-April-2014.pdf

64

W.

Social MediaDefinition
18.1 Social media is defined by ESOMAR as internet based platforms and technologies that permit users”
interaction and/or facilitate the creation and exchange of user generated content.”
Widely used examples include:–
Online forums/discussions, communities, blogs, social networks (e.g. Facebook)–Video/photo sharing (e.g. YouTube)–
Multi-person/group communication and/or collaboration platforms (e.g. Twitter).”

Accessing Social Media Content including Website Terms and Conditions
18.2 You must have legal grounds for accessing content on social media, these are likely to be either
consent or legitimate interests. When conducting social media market research, researchers arebound by the terms and conditions attached to access of the online services. Many service providers
include intellectual property rights clauses that prohibit copying of material without consent.
Researchers should ensure that they abide by the terms and conditions attached to use of site
content. However if consent for listening/scraping is not given, researchers can read and précis thecontent.

Anonymising Quotations
18.3 Care should be taken to ensure that anonymous quotations are indeed anonymous and cannot be
traced back to reveal their original source.

Passive market research i.e. digital listening, scraping
18.4 Without the contributor’s consent (obtained as part of the terms of use or directly) or another lawfulbasis only anonymised data can be reported. Anonymised data should not reveal any personallyidentifiable information.
18.5

No attempt should be made to identify contributors. ESOMAR states that this MUST be a contractual
obligation if the data is passed on to the client or another researcher. If a contributor’s comments
are to be made public (i.e. cannot be covered by contractual obligations) and the contributor is
identifiable, their consent should be sought or the comment disguised or ‘masked’ appropriately.

18.6

Quotations containing personal data can only be provided to the client if you have a lawful basis forthis e.g. the contributor has given their consent for this and it has been made clear that they will not
be subject to promotion as a result of this. In Germany, MR subject identity must remain anonymousand MR subjects cannot be asked to waive their right to confidentiality

18.7

In ‘private’ SM spaces (ones in which users would expect their comments to be private), researchers
should seek and gain the consent of contributors to listen in/scrape comments, other lawful bases
are unlikely to be appropriate in these circumstances. Comments given to clients MUST be masked
unless the contributor gives consent for their comments to be passed on verbatim. This assumes theterms and conditions have not given explicit site owner and site user consent for listening
in/scraping.

65

In Germany it should be remembered that local market research guidelines prohibit asking MR
subject/contributor consent to pass their personal data to the client company.

Active market research i.e. engaging with participants
18.8 Consent from the site/service owners and contributors/users MUST be given.
18.9

Researchers MUST declare their presence, they MUST NOT represent themselves as anything otherthan market researchers.

18.10 Contributors should be told the identity of the research organisation, purpose of the market
research, what sort of data will be collected, how their comments will be used and who will haveaccess to it. If processing personal data you must meet data protection requirements.
18.11 Contributors should be provided with contact information for the researcher or research agency. If
you are processing personal data you must identify data controller(s), recipients of personal data andthe source of the personal data (if it wasn’t obtained directly from the individual).
18.12 Researchers should publish a privacy policy/notice on their website.
18.13 Online space created specifically for MR such as MROCs should fulfil the following criteria:–
Participants MUST be aware of its function and the use to which their contributions might
be put and that the data will be shared with the client–
Any rules for interacting MUST be available–
Site privacy policy MUST be available–
The personal identity of participants MUST be protected.

Adverse Event Reporting
18.14 Adverse event reporting requirements are the same when market researchers use social media as asource of market research data as any other market research medium such as face to face interviews.
Marketing authorisation holders and their contracted agents have an obligation to collect and followup on the adverse events and product complaints associated with their medicinal products. Thisapplies to public and private sites, passive and active approaches and to company sponsored andnon-company sponsored websites.
If a company chooses to listen-in to or ‘scrape’ from non-company sponsored sites, whether public or
private (with consent) it is recommended that the listened to pages should be monitored for adverse
events for the period of the listening-in activity only. There is no obligation for researchers tomonitor non-company sponsored sites routinely for adverse events if they are not being used for amarket research purpose.

66

8.

MR Subjects’ Rights by MR Subject TypeX.

Patients

Patients
19.1 When researching existing or future potential medical treatments with patients, care should be taken
not to:–Raise unfounded hopes of treatment of specific medical problems.
–
Mislead MR subjects with regard to the safety of a product.
–
Encourage members of the public/patients to ask their doctor to prescribe a product.
–
Offer advice on the specific therapy area under discussion.
It is also important to remember that personal data that includes data about an individual’s health isspecial category of personal data and explicit consent is required to process it; and particular careshould be taken when collecting, transferring or storing it as it constitutes a higher risk.
19.2

Interpretation of national legislation on data protection and patient anonymity in Finland andSweden appears to suggest that direct use of patient records for market research is difficult, even if
the data is anonymised because of concerns about indirect identification, unless written consent
from the patient has been secured. It is acceptable for physicians to complete patient record forms
from memory although great care must be taken to ensure that the patient cannot be identified
directly or indirectly. EphMRA strongly advises that the sponsoring pharmaceutical company's legal
department seek local advice on the matter.

19.3

In Greece, the SfEE’s Code of Ethics states (within the English translation) that:- “The data from HCPs referring to patients shall be collected and delivered fully anonymized
and in aggregate form.”

Y.

Simulated Consultations

19.4

Simulated consultations between a patient and a healthcare professional (known or unknown to eachother) are a legitimate research approach however they should be conducted with great carebecause they may lead to misunderstanding with the patient. It is important that participating
patients are fully aware of the nature of the research and that the consultation is a simulation andnot a substitute for a normal consultation.

19.5

There is no restriction upon the use of protected health information if it has been de-identified.
There are two ways to de-identify data. The first method is to remove all identifiers such as:(A) Names(B) All geographic data, including street address, city, county, part or all of the postal code(C) Elements of dates (except year) directly related to an individual, including birth date, admission date,discharge date, date of death; and identifying ages e.g. those over 89;(D) Telephone numbers;(E) Fax numbers;(F) Electronic mail addresses;

67

(G) Social security numbers;(H) Medical record numbers;(I) Health plan numbers;(J) Account numbers;(K) Certificate/license numbers;(L) Vehicle identifiers and serial numbers, including license plate numbers;(M) Device identifiers and serial numbers;(N) Web Universal Resource Locators (URLs);(O) Internet Protocol (IP) address numbers;(P) Biometric identifiers, including finger and voice prints;(Q) Full face photographic images and any comparable images; and(R) Any other unique identifying number, characteristic, or code

The second option is to have a qualified statistician determine that the risk is very small that the
information could be used to identify the individual.
https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/

Z.

Vulnerable MR subjects

Definition
20.1 Vulnerable MR subjects are those who for whatever reason could be more susceptible than normal
to physical or mental stress induced by the research process. Patients may well prove to bevulnerable MR subjects because of their age, physical or mental health. A vulnerable MR subject
could be someone who is HIV positive or has cancer, a psychiatric illness or is physically handicapped.

What to Consider When Interviewing Vulnerable Patients
20.2 If the MR subjects are considered vulnerable, then the following questions should be considered:–Is the market research justifiable?
–
Is the nature of interview/tasks involved appropriate?
–
Should a carer be present or on hand if required?
–
Is additional time or the provision of breaks needed?
20.3

When a potentially sensitive issue has been discussed with a vulnerable MR subject members may
provide information or relevant helpline information.

In the UK the Mental Capacity Act passed in April 2005 enforced in 2007 provides codes of conduct on how
vulnerable adults who lack the capacity to consent for themselves should be consented into research. The
Act allows for another adult such as a next of kin or legal representative to consent on their behalf, thepatient’s doctor cannot give this consent alone. However there is an onus on the researcher to withdraw theMR subject from the study if they show any sign of being unhappy or distressed by being included in the
study.

68

AA.

Children and Young People

Definitions
21.1 When conducting research with children or young adults, ESOMAR advises that in the absence of anational definition, ‘child’ is a minor 12 years old or less and a ‘young person’ is 13 to 17 years ofage. In Canada, a child is to be defined as under the age of 14, a young person as aged 14-17. In
Mexico all those under 18 are considered children. The UK MRS Code of Conduct defines a child as aperson under the age of 16 and ‘young people’ refers to those aged 16 and 17 years. In the USA, theChildren’s Online Privacy Protection Act (COPPA) requires verifiable parental or the legal guardian’sconsent for interviewing children below the age of 13 years.
If you are relying on consent as your lawful basis for processing personal data, when offering online
services directly to a child, only children aged 13 or over are able provide their own consent.

Consents Required
21.2 Consent from the responsible adult i.e. an adult responsible for the child's safety and welfare at thetime of the research, is required to ask the child whether they will participate. Consent of a parent or
responsible adult MUST be obtained before interviewing a child under 15 in the following
circumstances:– In home/at home (face-to-face and telephone interviewing)– Group discussions/depth interviews– Postal questionnaires– Online questionnaires or email– Where interviewer and child are alone together– In public places such as in-street/in-store/central locations unless the child is 14 years or
over, in which case interviews may take place without the consent of a parent or
responsible adult
In Germany, children under 11 MUST have consent (oral) to participate from their legal
representative. With children aged 11-13, the agency may establish if the child has the necessary
cognitive faculty and not seek consent but if they are under 14 years, the interview should not be
conducted without the knowledge of an adult present in the home. In addition, consent is always
needed if personal data relating to adults will be asked of the children at recruitment or during theinterview.
In Mexico, written consent from the responsible adult must be obtained for all market research with
MR subjects under 18 years of age.
In the UK in certain circumstances the adult consent may be waived but only with permission from
the MRS’s Standards Board.
21.3

Explicit consent from the child MUST also be given; the child MUST have their own opportunity toagree or decline to participate. When online research is carried out, a notice to children informing
them of the requirement for consent MUST be shown at the point where personal information isrequested.

21.4

Personal information relating to other people MUST NOT be collected from children unless it is to be
used to gain consent from a parent/responsible adult. Where consent is being sought, it may be69

preferable for some classification questions to be asked of the parent/responsible adult, rather thanthe child/young person.
21.5

Details of the person giving consent (name and role) MUST be recorded.

21.6

The responsible adult MUST be made aware of any observation or recording.

Online Market Research with Children
21.7 EphMRA recommend that online research is not conducted with children under the age of 14.
21.8

For online research with children MR subjects should be asked to give their age before any otherpersonal information is requested. If the age given is under 15, the child MUST be excluded fromgiving further personal information until the appropriate consent from the responsible adult has
been obtained and verified.

21.9

In the USA, researchers MUST abide by the Children’s Online Privacy Protection Act (COPPA). This
federal ruling applies to the online collection of personal information from children under 13. It
details what a website operator MUST include in a privacy policy, when and how to seek verifiableconsent from a parent and what responsibilities an operator has to protect children’s privacy andsafety online. http://business.ftc.gov/documents/Complying-with-COPPA-Frequently-Asked-Questions

21.10 A notice to the parent/responsible adult should be placed on the website or sent via email asking fortheir consent for the child to participate in online market research. ESOMAR provide guidelines
upon the recommended content of such a notice. See ESOMAR Online Research Guidelines 2011.

Role of the Responsible Adult
21.11 Consider the necessity for the presence of a parent/guardian during fieldwork. It is recommended
that when interviewing a child in their own home, a parent/responsible adult is present, notnecessarily in the room but in the house. If a child or the responsible adult asks for an adult to bepresent, this request should be respected.
21.12 The researcher should ensure that the responsible adult has full details of the research venue, nameof moderator, finishing time, etc.

Researchers’ Responsibilities
21.13 No study can ask a child to do something illegal for their age.
21.14 Language on questionnaires should be suitable for the age group.
21.15 Refreshments provided should be suitable for the age group and care should be taken to avoid
including anything that is known to cause allergic reactions.
21.16 The researcher should take responsibility for safely handing over the child/young person after aninterview or ensuring that arrangements for them to get home safely are in place.
21.17 In Canada, MRIA affiliated researchers must take into account the degree of maturity of the child or
young person involved when considering what subjects may or may not be safely dealt with in aninterview.

70Incentives
21.18 Where incentives are used they should be suitable and acceptable for the age of the child/young
person and fitting for the task required.

Product Testing
21.19 If a child is going to be asked to test a product, the responsible person should be allowed to see thisand (if they wish) to try it themselves.
21.20 If children/young people are to be asked to take part in any form of product testing, researchers
should take special care to ensure that the products are safe to handle or consume and that thechild/young person does not suffer from any relevant allergy. EphMRA recommends that active
medicines are not used in market research with children.

Criminal Record Checks for Interviewers
21.21 Criminal record checks for interviewers may be necessary in some circumstances but it is notnecessary for all researchers.
https://www.mrs.org.uk/pdf/2014-09-01Children%20and%20Young%20People%20Research%20Guidelines.pdf

71

BB.

Opinion Leaders, Clinical Trial Investigators and Advisory Board Members

22.1

When recruiting MR subjects that have a pre-existing relationship with the company e.g. clinicalinvestigators, opinion leaders or advisory board members, it is acceptable for the initial invitation toparticipate in the market research to come from the client company. However their decision toparticipate or not MUST remain confidential i.e. the client company MUST NOT know who did or did
not participate.

22.2

A senior member of the marketing or clinical department may provide the following information inwriting – an outline of the:– Company’s aims in undertaking market research (e.g. to obtain feedback on the clinicalperformance of a new drug in trials).
– Reasons why the MR subject has been chosen (personal experience of drug, expertise intherapeutic field).
– Credentials of the researcher/agency undertaking the study and names/contact details of
personnel who will conduct the interview.
– Procedure for selecting any trial patients for inclusion in the study (via records orinterviews) if required.
However it should be noted that in some circumstances or cultures this may be misinterpreted as orconsidered disguised promotion. So this approach should be used with great care.

CC.

Physicians and Other Healthcare Professionals

23.1

In some countries the professional associations or employers (for/of salaried healthcare professionals)
may need to give approval for their members/employees to take part in market research studies.

DD.

Payers and Influencers

24.1

Given the potentially sensitive nature of discussions with payers and influencers, care should betaken to ensure that their professional role is respected and they are not pressured to impart
inappropriate information.
Please note the guidelines provided within Section 5, K7 Sensitive Topics.

72

9.

Complaints and Grievance Procedure

25.1

Breaches of the Code of Conduct and complaints will be investigated in the first instance by
EphMRA’s Ethics Group, and if necessary concerns/complaints upheld by EphMRA may then bereferred to the appropriate regulatory body, following which disciplinary measures may be taken bythese organisations.

25.2

If the Data Protection Directive is breached, action can be taken by the appropriate body in therelevant country e.g. the Information Commissioner’s Office in the UK.

73

Glossary of Key Terminology
Ad hoc market research – Is designed and paid for by just one company, the research is exclusive to the commissioning
company, who own the resulting data.
Agency – any individual, organisation or department, which is responsible for, or acts as, a supplier on all or part of amarket research project.
Anonymisation – the process of removing, obscuring, aggregating or altering identifiers to prevent the likely
identification using reasonable means of the individuals to whom the data originally related.
Anonymity has two interpretations:⎯ Non-disclosure of a client’s identity⎯ Protection of a MR subject’s identity
Carer – Professionals or unpaid relatives/friends who provide care for those who because of illness or disability require
support, this care may be medical and non-medical.
Client – Any individual or organisation that commissions (including requesting or subscribing) all or part of a market
research project.
Confidential Research – Research projects for the purposes of market research that do not disclose personal details at
an identifiable level.
Consent – The freely given and informed agreement by a person to take part in the market research and the processingof his/her personal data
Consultant – Any individual or organisation that provides research services. Consultants can also be a sub-contractor in
the research relationship.
Data Controller – A person who alone, jointly or in common with others determines the purposes for which and themanner in which any personal data are processed and is responsible for ensuring that the provisions of Data Protection
legislation are complied with.
Data Processor – Any person (other than an employee of the Data Controller) who processes data on behalf of the Data
Controller.
Data subject – any individual whose personal data is used for market research.
Digital listening is the process of extracting data from social media data for analysis. This can be automated or done
manually.
Harm –means tangible and material harm (such as physical injury or financial loss), intangible or moral harm (such as
damage to reputation or goodwill), or excessive intrusion into private life, including unsolicited personally-targetedmarketing messages.
Healthcare professional (HCP) any licensed member of the medical, dental, pharmacy or nursing professions or any
other person who, in the course of their professional activities, may administer, prescribe, purchase, recommend or supply
a medicine. Non-HCP could include a patient, sufferer, carer, family member or member of the public.
Identity – The identity of a MR subject includes, as well as his/her name and/or address any other information which
offers a reasonable chance that he/she can be identified by any of the recipients of the information.
Interview – Any form of contact with a MR subject to collect information for market research purposes.
Interviewer – The person who collects data from MR subjects for market research purposes.

74

Masking is a technique whereby the original social media data such as comments, photos or videos is altered to a pointthat it cannot be traced back or attributed to the original user (e.g. using a search engine).
MR subject – an individual or organisation that is approached for interview or from which information is collected forthe purposes of a market research project, whether they are aware of it or not. This term individuals and organisations
who that are involved actively or passively and replaces the use of the term respondent and participant.
MROC (Market Research Online Community) describes an online community created specifically for the purposes ofmarket, social and opinion research. Others include DORC (Dedicated Online Research Community).
Passive social media monitoring – is the extraction of data from social media for analysis, there is no interaction withthe contributor. It is also known as digital listening or scraping.
Primary market research – Generates original data collected to solve the problem in hand, data is collected directlyfrom MR subjects. Primary data is derived from new and original research designed to address a specific purpose.
Privacy notice/policy – Published summary of an organisation’s privacy practices, it describes the ways in which theorganisation gathers, uses, discloses and manages a data subject’s personal data.
Public Domain – Information, which is published and generally accessible or available to the public, content that is not
owned or controlled by anyone, intellectual property being not protected under patent or copyright, in market researchcontext it refers to information that is freely available, without restriction.
Public Place – One to which the public has free access and where an individual reasonably could expect to be observed
and/or overheard by other people (e.g., in a shop or on the street).
Record – Defined as any brief, proposal, questionnaire, MR subject identification, check list, record sheet, audio oraudio-visual recording or film, tabulation or computer print-out, EDP disc or other storage medium, formula, diagram,report, etc. in respect of any marketing research project, whether in whole or in part. It covers records produced by theclient as well as by the researcher.
– Primary records are the most comprehensive information on which a project is based, including not only
original data records but also anything needed to evaluate those records e.g. quality control documents– Secondary records are any other records about the MR subject and the research results
Recruiter – The person who identifies and invites MR subjects to take part in a market research project.
Researcher – An individual or organisation carrying out, or acting as a consultant on, a market research project,including those working in client organisations.
Secondary market research – Involves collecting and using data that already exists. This data is then re-used and reanalysed, so it is data already gathered for one use that is then utilised for another purpose.
Sensitive Data – Defined as personal information covering the racial or ethnic origin of the MR subject; their politicalopinions; religious beliefs of a similar nature; whether he/she is a member of a trade union; their physical or mental
health or condition; sex life; the commission or alleged commission by him/her of an offence or any proceedings for an
offence committed and the outcome.
Scraping is the process of extracting data from social media data for analysis. This can be automated or done manually.
Social media data refers to the information (photos, comments, etc.) that users generate or share while engaged in orwith social media. It often includes personally identifiable data.
Stimulus material – Material shown or referred to or read out to a MR subject during fieldwork
Sub-Contractor – Any individual or organisation that undertakes a part of a research project (such as the fieldwork).
Syndicated market research – Is shared – both the findings and the costs – by a number of clients, however the data is
owned by the market research agency.

75

Transparency – Ensuring individuals have a very clear and unambiguous understanding of the purpose(s) for collecting
the data and how it will be used.
Walled garden is an online service which requires users to register or apply for membership before being permitted toparticipate. A walled garden can only be accessed after the user has obtained a login and/or password, even if entry is
automatic.

76

Sources
Legislation Supporting The Code of Conduct– Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and on thefree movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation)– EU Directive 2001/83/EC on the Community Code relating to Medicinal Products for Human
Use– EU Regulation 726/2004 Community procedures for the authorisation and supervision of
medicinal products for human and veterinary use and establishing a European Medicines
Agency– EU Council Directive 93/42/EEC concerning medical devices– EU Directive on Privacy and Electronic Communications (2002/58/EC) 2003
– Health Insurance Portability and Accountability Act (HIPAA)
Canada


MRIA’s Revised Code of Conduct and Research Neutrals Advisory Service Jan 2015
Innovative Medicines Canada, Code of Ethical Practices, 2016

France

ASOCS Charte De Pratiques Loyales En Matière D’Etudes Des Opinions Et Comportements Dans Le
Domaine De La SanteASOCS, INFOSTAT & UDA Le Guide Des Relations Entre Laboratoires Et Societes D’Etudes

GermanyArbeitskreis Deutscher Markt- und Sozialforschungsinstitute e. V. (ADM), Declaration of the Federal
Republic of Germany concerning the ICC/ESOMAR International Code of Market and Social Research
2008ADM, Guideline for Studies in Public Health Service for Purposes of Market and Social Research Apr
2013

ADM, Guideline Concerning Recording and Observation of Group Discussions and Qualitative
Interviews 2006

ADM, Standards for Online Surveys 2007

ADM, Guideline on the Interviewing Minors Jul 2006

ADM Guideline on Telephone Surveys Jan 2008

ADM, Guideline on the Treatment of Addresses in Market and Social Research May 2011

ADM, Guideline on the Treatment of Databases in Market and Social Research Jul 2010

Freiwillige Selbstkontrolle für die Arzneimittelindustrie e.V. (FSA) FSA Code of Conduct on the
Collaboration with Healthcare Professionals 2017
Greece

Code Of Ethics on the Promotion of Prescription-Only Medicinal Products & Disclosure of Transfers ofValue by Pharmaceutical Companies to Healthcare Professionals and Healthcare Organisations June
2017

Italy



ASSIRM, Code of Professional Ethics 2014
Farmindustria, Code of Professional Conduct Oct 2016

Mexico
AMAI: Estándar de Servicio para la Investigación de Mercados en México – ESIMM V2.0

77

LFPDPPP – Ley Federal de Protección de Datos Personales en Posesión de los Particulares
Cofepris: Guías, Lineamientos y Requerimientos de Farmacovigilancia
PROFECO Repep - Regístro Público para Evitar PublicidadNetherlands
Code of Conduct for Pharmaceutical Advertising Jan 2017
Concept Gedragscode Voor Marktonderzoek In De Healthcare Markt Draft Code of Conduct for Market
Research in the Healthcare Market, Oct 2015

MOA Code of Conduct for research and statistics (Gedragscode voor onderzoek en statistiek)
Wet bescherming persoonsgegevens
Telecommunicatie wet
CGR Richtlijnen niet-WMO plichtig onderzoek

Gedragscode Geneesmiddelenreclame
CGR Uitwerking Normen Gunstbetoon
Toelichting gedragsregels openbaarmaking financiële relaties,
MOA guideline Publiceren over marktonderzoek

MOA Onderzoekfilter
Scandinavia
Denmark
The Danish Ethical Rules for Promotion of Medicinal Products towards Healthcare Professionals 2014
Finland
Pharma Industry Finland (PIF), Code of Ethics, 2017Market Research Association SMTL, Code of Ethics, 2011
Market Research Association SMTL, Tietosuojakäytänne (Privacy Policy) 2003
Norway
Legemiddelindustriforeningen (LMI) – the Norwegian Association of Pharmaceutical Manufacturers Rules
For Marketing Of Medicinal Products 2017
Sweden
De forskande läkemedelsföretagen (LIF), Ethical rules for the pharmaceutical industry in Sweden, 2017
Svenska Marknadsundersökningsföretag (SMIF), Children and Youth Policy, Jan 2013

Svenska Marknadsundersökningsföretag (SMIF), Tillämpningsregler PUL, Privacy Application Rules ,
2010
Spain
AEDEMO, Proteccion de Datos e Investigacion de Mercados 2007 Privacy & Market Research
Farmaindustria, Code of Practice for the Pharmaceutical Industry 2016



Turkey

AIFD Code of Good Promotional Practice and Good Communication Edition 5.2 February 20, 2015

UK










Association of the British Pharmaceutical Industry (ABPI), Code of Practice 2016
Association for Qualitative Research (AQR), Qualitative Research Recruitment 2002
British Healthcare Business Intelligence Association (BHBIA), Legal & Ethical Guidelines 2016
Market Research Society (MRS), Administering Incentives and Free Prize Draws July 2015
MRS Best Practice Guide on research Participant Vulnerability Jan 2016
MRS Code of Conduct 2014
MRS Guidance on Collecting Data on Sex and Gender Jan 2016
MRS Guidelines for Research with Children and Young People Sep 2014
Data Protection & Research: Guidance for MRS Members and Company Partners 2018

78














MRS Guidelines on the Privacy and Electronic Communications Regulations May 2011
MRS Guidelines for Online Research Sep 2014
Guide to Observers’ Legal & Ethical Responsibilities Oct 2015
MRS DRAFT Mobile Research Guidelines Aug 2013
MRS Online data Collection and Privacy Discussion Paper Jul 2011
MRS Online data Collection and Privacy Response to Submissions Apr 2012
MRS Qualitative Research Guidelines including Observational and Ethnographic and deliberative
Research Sep 2014
MRS Questionnaire Design Guidelines Sep 2014
MRS Use of Predictive Diallers Mar 2017
MRS Using Research Techniques for Non-Research Purposes Nov 2010
Office of Information Commissioner (ICO), Guide to Data Protection

Europe














European Federation of Pharmaceutical Industries and Associations (EFPIA) Code on the Promotion of
Prescription-Only Medicines to, and Interactions with, Healthcare Professionals 2014
EFPIA Code On Disclosure Of Transfers Of Value From Pharmaceutical Companies To Healthcare
Professionals And Healthcare Organisations 2014
European Society for Opinion and Marketing Research (ESOMAR), Online Research Guideline, 2015
ESOMAR Guideline for Conducting Mobile Market Research Oct 2012ESOMAR Guideline on Social Media Research Jun 2011ESOMAR Guidelines on the Mutual Rights and Responsibilities of Researchers and Clients Oct 2010ESOMAR How to Commission Research 2009
ICC/ESOMAR International Code on Market, Opinion and Social Research and Data Analytics 2017
ESOMAR Interviewing Children and Young People 2009ESOMAR Distinguishing Market Research from Other Data Collection Activities Mar 2009ESOMAR Passive Data Collection, Observation and Recording Feb 2009

Korea


Korea Research-based Pharmaceutical Industry Association (KRPIA) Fair Competition Code 2014

USA







Council of American Survey Research Organisations (CASRO) Code of Standards and Ethics for Survey
Research
Children’s Online Privacy Protection Act (COPPA) 1998
Health Insurance Portability and Accountability Act (HIPAA) 1996
Marketing Research Association (MRA), Code of Marketing Research Standards 2013
Pharmaceutical Research and Manufacturers of America (PhRMA), Code on Interactions with
Healthcare Professionals Jan 200979

Appendices
THE PRO FORMAS PROVIDED IN THE FOLLOWING PAGES PROVIDE TEMPLATES BUT MAY NEED TO BE
ADJUSTED TO TAKE INTO ACCOUNT LOCAL/NATIONAL REQUIREMENTS.
Pro Forma 1 – Recruitment Agreement

Recruitment Agreement
TO BE USED IN CONJUNCTION WITH A RECRUITMENT SCRIPT THAT DETAILS THE MR TERMS

Project Title:

Project No:

Nature of Project

Subject and purpose of
market research study:

Methodology
and Approach
Fieldwork

Location: (If online or telephone, please state this)Duration:

Date:

Start Time:

Incentive

Type:

Amount:(e.g. cash)
MR Subject Agreement and Signature

By signing below/clicking on the box below/returning this email (AMEND AS APPROPRIATE)
I consent to <agency name> collecting and using the information about me that I voluntarily
provide for the purposes of market research
YESNO
I have read, understand and agree to the terms described.

YES

NO

OTHER CONSENTS MAY NEED TO BE ADDED
Signature:

Name (please print)

MR Subject Code Number

Code Number

80

Pro Forma 2 – Receipt of Incentive

Receipt of Incentive
Project Details

Project Title:

Project No:

Agency:Agency Contact:

Fieldwork

Date of receipt:

Start Time:

Location: (If online or telephone, please state this)Duration:

Incentive

Incentive Type:

Incentive Amount:(e.g. cash)
Declaration

I confirm that the information I have given during the course of this interview/group discussion
represents my views on the subject matter.
I confirm that I have received the incentive detailed above in appreciation for my contribution to
the project.
MR Subject Signature

Signature:

Name (please print)

MR Subject Code Number

Code Number

81

Pro Forma 3 – MR Subject Consent Allowing Client Access to Recordings

MR Subject Consent Allowing Client Accessto Market Research Fieldwork
Project Details

Project Title:

Project No:

Agency:Location of Fieldwork:

Date of Fieldwork:

Start Time of Fieldwork:

Declaration

I understand that the company that commissioned this market research study___________________________________________________________(name of recipient organisation(s) may or may not be required will:
DELETE AS APPROPRIATE– Watch through a one way mirror (watching organisations do not need to be named) but type oforganisation(s) should be specified– Listen to an audio recording at their offices (organisations listening in may or may not need tobe named depending on whether audio information is considered personal data or not)
– Watch a video recording at their offices (watching organisation(s) must be named but naming
may be delayed until the end of the interview if viewing is not live)
I understand that the purpose(s) of the company having access is:

The people in the company who will listen to or view the recordings will be in the following
functions/roles:

I understand that all those listening, watching or viewing the recording MUST respect theconfidentiality of all information exchanged in market research interviews/groups and that no sales
approaches will ever be made to me as a consequence of the company having this access.
I understand that I can withdraw my consent at any stage.
IF APPROPRIATE We would prefer not to reveal the name of the healthcare/pharmaceuticalcompany until the end of the interview, just in case knowing this affects any responses. Is thisacceptable to you or not? YES NO
Signatures

I have read, understand and agree to the terms above.
MR Subject Signature:

Name (please print)

Agency Signature:

Name (please print)

MR Subject Code Number

Code Number

82

Pro Forma 4 – Client Agreement to Safeguard Confidentiality of Recordings

Client Agreement to Safeguard Confidentialityof Recordings of Market Research Fieldwork
Project Details

Project Title:

Project No:

Agency:Location(s) of Fieldwork:

Date(s) of Fieldwork:

Start Time(s) of Fieldwork:

Commissioning Client Company
Declaration

On behalf of <the commissioning client company> I can confirm that the recording(s) of market
research fieldwork from the above study will only be used for the following purpose(s):The only people in the company who will listen to or view the recordings will be in the following
functions/roles:

And the recording(s) will be in the secure care of:
On behalf of the commissioning client company I can confirm that:– Those listening to or viewing the recording will respect the confidentiality of all informationexchanged in market research interviews/groups– No sales approaches will ever be made to MR subjects as a consequence of having this access.
– No attempt will be made to reverse any anonymisation– The recording will be stored securely, kept separate and processed in accordance withapplicable data protection/privacy laws and market research professional codes– The recordings will be destroyed or handed back to the agency as soon as is required.
– If video streaming has been used to allow remote viewing it is possible that the video
transmission system used delivered a copy of the recording to the receiving computer. If this is
the case any copy of the video stream saved on the observer’s computer MUST be deleted.
Signatures

I have read, understand and agree to the terms above
Company Signature:

Name (please print)

Agency Signature:

Name (please print)

83

Pro Forma 5 – Observer Agreement

Observer Agreement
Project Details

Project Title:

Project No:

Agency:Agency Contact:

Location of Fieldwork:

Date of Fieldwork:

Time of Fieldwork
Declaration

I understand that I MUST be familiar with and adhere to the EphMRA’s Observers’ Guidelines.
Observer Signature

I have read, understand and agree to the terms
Signature:

Name (please print)

Observers’ Guidelines
Client observers MUST be introduced openly and honestly to respondents. Actual company identity does
not necessarily have to be revealed and if it does, it may be withheld until after fieldwork if this information
is likely to bias the discussion.
Clients or their sub-contractors MUST NOT be passed off as members of the research agency.
Observers MUST agree to withdraw from observing if any MR subject is known to them or recognised toprotect the MR subject’s anonymity. If an observer knows that they will subsequently have to deal with a
MR subject, the attendee MUST also withdraw from observing. However, if respondents are made fully
aware of the presence of an observer known to them and give explicit consent for that individual to observe
then that person may remain at the session, care should be taken that the respondents are completely
comfortable if ‘put on the spot’ in this way.
Observers MUST respect the confidentiality of all information exchanged in market researchinterviews/groups. They MUST NOT:
– Record any MR subject’s personal data or record any information with the specific aim of establishingthe identity of a MR subject.
– Not make any separate identifiable notes or recordings that could be attributed to an individual MR
subject.
– Attempt to influence how any MR subject is approached in future for sales/promotion.
– Not use information gleaned from the observation to amend or build databases.

84

CODE of CONDUCTAugust 201885