PD in pharmacovigilance

4 elements of a valid adverse reaction report

Reporter

identifiable source: qualification, name or initials, address or contacts

Patient

one attribute suffices: initials, medical record no., date of birth, age, sex

Medicine

suspected medicinal product

Reaction

the adverse reaction itself

Health and AR data are special category PD (Art. 10, Law 152-FZ), and a nominally depersonalised case can be restored from date, sex, age, history

Conclusion

an AR report contains PD by default, including special categories

a single case's anonymity is usually illusory

a minimal valid case has 4 elements

Basis: EAEU GVP Rules, paras. 385, 407

Criterion 1 of 6, subject matter: any information about a person is PD unless proven otherwise (Art. 3(1) of Law 152-FZ). General criterion: Section 06 "Permissibility"

Purpose is fixed by law, not by the operator

ensuring medicine safety and monitoring the benefit-risk balance (Art. 64 of 61-FZ)

specific, lawful and socially significant purpose: protecting public life and health

Without it the purpose fails: identifiability is needed for

1

Verification

checking reports and removing duplicates

2

Follow-up

asking the reporter for more information

3

Assessment

causality and severity of the AR

Conclusion

the law sets the purpose, not operator discretion

data cannot be depersonalised at intake, or the case is unfit for safety assessment

Basis: Art. 64 of 61-FZ, EAEU GVP Rules

Criterion 2 of 6, purposefulness: purposes are specific, predefined and lawful, a new purpose is compatible with the original (Art. 5(2) of Law 152-FZ). General criterion: Section 06 "Permissibility"

• 1
• Minimise, but not below the mandatory minimum

The 4 elements of a valid AR report are always collected, otherwise the case is invalid. Only relevant history is collected, with no hoarding "just in case"

• 2
• Separate storage and coding

reporter and patient identifiers are separated from medical data: pseudonymisation, case code

• 3
• Targeted use of third parties

call centres and IT system vendors work on instruction and under control; minimise such cases: responsibility stays with the MAH

Conclusion

minimum data = minimum valid case

instruct third parties selectively, under operator control

Basis: EAEU GVP Rules, Art. 5 and Art. 6(3) of 152-FZ

Criterion 3 of 6, proportionality: minimising the data set, separate storage and no hoarding "just in case" (Art. 5(3)-(7) of Law 152-FZ). General criterion: Section 06 "Permissibility"

processing of personal data by pharmaceutical companies in performance of federal laws, by-laws and the EAEU Good Pharmacovigilance Practice Rules of 03.11.2016 No. 87 falls under the legal grounds in Art. 6(1)(2) of Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" and does not require the data subject's written consent

RKN letter of 25.11.2025 No. 08-604997

Third parties

call centres and IT vendors: instruction under Art. 6(3) of 152-FZ

Beyond pharmacovigilance

marketing, other subject contacts and actions outside GVP and the master file need a different basis, such as consent

Disputed

Art. 10(2) lacks a "legal duty" ground, and history is special category

Criterion 4 of 6, legality: the main quartet of grounds is Art. 6(1)(1), (2), (5), (7) of Law 152-FZ, the auxiliary quintet (3), (3.1), (6), (8), (9). General criterion: Section 06 "Permissibility"

Direct notification is hard

an AR report often comes from a medic or relative; the patient may be unreachable

Managing expectations

AR report processing for medicine safety is a MAH activity data subjects reasonably expect

Exception

a statutory-duty report falls under Art. 18(4)(2); otherwise channels only lower the Art. 18(3) risk

Information channels

• PD processing policy
• package leaflet

• MAH website
• AR report form

spoken notice at intake

Conclusion

inform via available channels, given the data source

aim: justified expectations and data subject trust

Basis: Art. 14 of 152-FZ, EAEU GVP Rules

Criterion 5 of 6, transparency: the subject knows of the processing before it starts and can reasonably expect it (Art. 14(1)-(2) of Law 152-FZ). General criterion: Section 06 "Permissibility"

Special category

enhanced Art. 19 protection measures

Case codes

anonymisation does not work: case traceability is lost

Access

pharmacovigilance officer and specialists

Instruction and CBT

call centres, IT vendors, global databases: per 152-FZ

Order No. 140

Formal depersonalisation is a real headache

needs dedicated internal regulations, separate storage of source and depersonalised data and an action log. Wiser: pseudonymisation, coding, decomposition as protection measures

Conclusion

pseudonymisation, not depersonalisation

special-category protection with case traceability kept

depersonalisation methods without Order No. 140 formalities

Basis: Art. 19 of 152-FZ, RKN Order No. 140, EAEU GVP

Criterion 6 of 6, security: classic IS of 30+ subsystems; depersonalisation is reversible and does not end processing (Arts. 7 and 19 of Law 152-FZ). General criterion: Section 06 "Permissibility"