How the EU’s GDPR will be a positive catalyst for change

Now that the GDPR deadline of May 25 has come and gone, many life sciences companies will have come to realise that GDPR compliance is not simply a legal problem or an IT project, but an enterprise-wide issue requiring a robust and comprehensive approach.

Here, I explain some of the steps we took towards GDPR readiness and why we consider the new regulation to be a positive catalyst for change.

Navigating the GDPR

Intended to harmonise national data protection laws across the EU and give greater protection and rights to individuals, the GDPR is designed to make companies more accountable for how they process personal data. It expands the territorial scope of EU data protection regulation to companies processing personal data of EU residents, regardless of the company’s location. The GDPR introduces important new requirements about valid consent, in addition to giving individuals in the EU greater control over how their data is being used through stronger and more specific rights. And it introduces stringent penalties for non-compliance, with fines of up €20 million or 4% of turnover (whichever is greater) for violations.

As a provider of multi-tenant cloud solutions, the importance of privacy and security is part of Veeva’s DNA, and it is something we regularly discuss with our customers. The overarching principles of the GDPR, therefore, are an extension of something already familiar to us – but we knew we needed to adapt to the key principle of accountability. This meant putting the necessary documents together to enable us to be more transparent about our data processing activities and even more rigorous in our risk assessments. And so, our journey to GDPR compliance began.

Understanding the responsibilities
Clearly understanding your company’s role as a data controller or a data processor – both key terms in the GDPR text – is critical to determining the extent to which you are subject to obligations. Like many companies, Veeva acts as both a data controller and a data processor.

Under the GDPR, the controller determines the purpose and means of processing personal data, while the processor is responsible for processing personal data on behalf of the controller in accordance with its instructions. Processors now must maintain records of personal data and processing activity, and they have liability for data breaches. Controllers must ensure their contracts with processors include all of the cooperation obligations.

Moving towards certification
Historically, privacy fell under the umbrella of our global information security officer, David Tsao, based at our California headquarters. However, a fundamental turning point in our GDPR journey was appointing a dedicated data protection officer (DPO). Under the GDPR, a DPO is mandatory for any entity involved in processing data on a large scale. Not to mention, it is a business imperative and common sense to have a single point of contact to oversee privacy.

I joined Veeva in 2015 as lead data counsel and quickly gained certification as an EU data protection officer, becoming one of the first within our industry to hold the title. Based in our Paris office, I began to set out a roadmap to leverage our existing privacy and security controls.

Building the foundation
To bring privacy to the next level, we realised that we needed a critical mass of dedication to the GDPR. We decided to create a network of privacy champions made up of individuals in leadership roles whose jobs demanded deeper understanding and knowledge of data protection, or who demonstrated strong understanding of the regulations. These people would become the points of contact for their teams – and integral to turning GDPR compliance from a potential add-on to an employee’s day job to something second-nature for every individual across the organisation.

The true measure of GDPR compliance is whether it permeates the culture at every level, not only from a top-down mandate of the DPO or the legal team. Once individuals think about how they use personal data – and, indeed, how their own data is used – a shift towards individual responsibility and accountability emerges. With our Veeva privacy champions group and a ‘train the trainer’ approach, we are already seeing this cultural shift.

Spreading the word
As a company, we are working hard to communicate both the intricacies and the impact of the GDPR to employees and, in turn, our customers, in a way that makes sense to them. Training plays a big part in this – considering the GDPR is such a wide, far-reaching topic, tailoring the right information to the right audience is essential.

As DPO, one of my jobs is to help design interactive, online, role-based training that will resonate with each individual in terms of their day-to-day work. Every team is given a slightly different training program, depending on how the GDPR impacts its area of business. We also provide ad hoc, face-to-face training around particular issues, plus events and webinars focused on our GDPR approach.

Signing on the dotted line
The GDPR stipulates that there must be a contract in writing between the controller and processor which clearly sets out the subject matter of the processing and its duration, as well as the nature and purposes of processing, the types of personal data, any particularly special categories of data, and the obligations and rights of both parties. Failure to have a suitable data processing agreement (DPA) in place is a breach of the law under the GDPR.

Contracts, therefore, needed to be revised according to those requirements. The fact that controllers must be very precise with their processors regarding cooperation on a variety of different aspects impacts not only our customers, but also our partners and vendors. So, we have spent a lot of time working closely with these stakeholders to make sure we are aligned, with the required documentation in place.

Embracing the Future
Throughout the prolonged effort, we have sought to focus on the positive aspects of preparing for the GDPR. Already, we can see a much deeper level of transparency with our customers and those whom they ultimately serve – patients who need life-saving and life-prolonging medicines.

Ultimately, transparency promotes trust – and creating trust is valuable on so many levels across the data life cycle. To benefit from optimal care, patients need to trust that their healthcare professionals have the most accurate and up-to-date details about treatments they receive. Healthcare professionals need to feel confident that life sciences companies will treat their information in a fair and responsible way. And life sciences companies rely on Veeva to deliver innovative technology that enables them to manage value- and compliance-driven data more efficiently.  If a new culture of trust is what the GDPR can bring, that can only be positive.

About the author:

Ashley Slavik is data protection officer and lead data counsel at Veeva Systems