EMA says it takes ultimate responsibility for protecting online meeting registration, survey information
The European Medicines Agency (EMA) has issued notices stating how it will comply with certain stakeholder information protection under the Data Protection Regulation for EU institutions, bodies, offices, and agencies (EUDPR). Under the regulation that went into effect in 2018, also known as EU 2018/1725, the agency said it is responsible for managing and protecting information received from stakeholders through registration forms and online surveys.
On 24 July, EMA published two notices outlining how it will manage Microsoft Forms and updated two others regarding its use of EUSurvey to ensure its actions comply with data protection regulations. The agency uses both Microsoft Forms and EUSurvey for meeting registrations and surveys.
European regulators said that EMA is ultimately responsible for complying with data protection rights and freedoms, and that, internally, the agency's head of division and the task force responsible for organizing meetings or conducting surveys will be appointed as the ‘Internal Controller.’
Information submitted via MS Forms is hosted on EMA's Azure cloud, and the data processor is based in Ireland. EMA noted that it may also engage third parties to process the data on its behalf, and Microsoft may store cookies on the user's device. When using the service, the agency may collect personal data, including names, titles, places of employment, IP addresses, and more. Similar information may also be collected by users of EUSurvey.
"The EC DG-DIGIT acts as the processor for the web-based interface of EUSurvey and the hosting of survey data and submitted responses," said EMA. "The [DG-DIGIT] is responsible for the processing of personal data collected and processed for traffic statistics and analytics via Europa Analytics, the corporate service that monitors and evaluates the effectiveness and efficiency of the EC's websites on europa.eu."
The agency again noted that it may use a third party to process EUSurvey data on its behalf.
All survey information will be kept in its respective forms until the end of the response period, according to EMA. After that, it will be securely stored in its document and record management system until regulators have analyzed the information, and then deleted a year after the survey is completed. Within that period, only authorized EMA staff will have access to the information, and personal data will not be published, but aggregated survey results may be shared with interested parties.
Similarly, EMA said it will retain meeting registration information for 2 years after the end of a public hearing and for 5 years after other meetings and events. The agency also said it will delete information on mobility and dietary requirements after an event is over but will continue to retain records of participation in meetings.
"The Agency may be required to share personal data with the Court of Justice of the EU, the European Ombudsman or the European Data Protection Supervisor (EDPS) if necessary in the framework of the performance of their duties," said EMA. "This is without prejudice to Regulation (EC) 1049/2001 regarding public access to documents."
