GDPR Assessment and U.S. Data Privacy Laws Action Plan for a Global Biopharmaceutical Company

A California-based clinical-stage biopharmaceutical company with U.S. and UK operations wanted to step up its compliance with U.S. and EU/UK data privacy laws. The company was in need of a plan that required a privacy compliance roadmap to deploy adequate controls and governance, where necessary, to demonstrate appropriate and sustainable compliance and accountability with the General Data Protection Regulation (GDPR) and relevant U.S. Data Privacy Laws, including HIPAA.

The Challenge

The company collects and maintains anonymized and de-identified clinical trial patient data. However, when this data is linked with additional available personal information, the potential risk of re-identification of trial participants increases, raising potential privacy concerns. The company also collects personal information from vendors, partners, employees and other third parties.

The company currently has an active compliance program in motion. Still, they wanted to show that they are dedicated to and capable of complying with the EU GDPR and major U.S. data privacy laws. To help them achieve their goals, the company enlisted Kroll’s expertise to craft a privacy compliance roadmap to establish the necessary controls and governance to support its goals.

The Solution

The client urgently needed an aggressive implementation timeline for launching clinical trials in the EU. To help them meet this goal, Kroll joined forces with Red Clover Advisors, a trusted privacy operations partner. We collaborated closely with the client’s compliance team and EU-based data protection officer to assess the company's core business, marketing activities and employee practices against the stringent requirements of the EU GDPR and various U.S. data privacy laws. To gather insight, our team interviewed key stakeholders to identify the scope of activities that process personal information, documenting the client’s collection, storage and access practices.

We subsequently configured the OneTrust Data Mapping module, tailoring it to fit the client’s specific needs. This comprehensive data map inventory became the cornerstone of our approach, enabling us to prioritize a holistic privacy compliance initiative. It allowed us to review the client’s data collection, sharing and consent practices thoroughly. In addition, our collaboration supported a variety of supplementary activities and best practices, including but not limited to:

• Developing external and employee privacy notices
• Establishing processes for individual rights requests
• Building operational workflows, policies and training aligned with the OneTrust configuration
• Customize general employee privacy awareness and training programs supported with standard operating procedures (SOP)

The Impact

The data mapping activities carried out by Kroll and Red Clover Advisors offered valuable insights into the storage and transfer of personal information. This transparency allowed the client to pinpoint potential risks related to its clinical trials, core business and privacy regulations. With this comprehensive understanding in hand, we helped the client establish detailed privacy controls, policies, SOP and training materials. These crucial resources now form the foundation of a robust compliance program that addresses current regulatory requirements and serves as a proactive approach to meeting new privacy regulations. Throughout the process, we worked as a trusted partner, working hand in hand with the client to accomplish these tasks within an aggressive timetable.
Seeing our collaborative efforts result in tangible outcomes that benefit our clients and ensure their adherence to privacy regulations is always rewarding.