BRAZIL Law and Practice Contributed by: Bruna Rocha, Jessica Filka, Juliana Marcondes and Victoria Cristofaro, COSRO
Resulting data may be transferred to a third party or an affiliate, but the transfer must comply with the LGPD governance framework and the specific rules applica- ble to clinical research. Under Law No 14.874/2024, the research institution must protect confidentiality and share only anonymised or coded data; where coded data is shared, the re-identification key must remain with the data manager, so the recipient should not be able to re-identify participants. Where a trans- fer would involve identifying information (or access that enables re-identification), Brazil’s ethics frame- work generally expects that such flows are foreseen and justified in the protocol and/or relevant contracts, implemented through secure channels and handled under the oversight of the CEP/CONEP system, with appropriate documentation governing the transfer and responsibilities. Affiliates are not automatically exempt from these requirements: unless the recipi- ent is clearly within the same controller structure and access is demonstrably restricted on a need-to-know basis, they should be treated as a third party for com- pliance purposes. Finally, if the recipient is located outside Brazil, inter- national transfer must meet the conditions set out in Articles 33–36 of the LGPD (eg, adequacy, contractual safeguards or another valid legal mechanism). 2.6 Personal or Sensitive Data In Brazil, creating a database is not subject to a stan- dalone authorisation merely because it contains per- sonal or sensitive data; however, once the database is created for research purposes, it becomes subject to specific governance and ethics requirements, in addi- tion to the LGPD’s general duties. In particular, CNS Resolution No 738/2024 regulates the constitution and use of research databases involv- ing human subjects and requires that the protocol be submitted to the CEP/CONEP system when the pro- ject intends to constitute a database or use an exist- ing one for research. It also expects the protocol to define key governance elements (eg, identifying the controller(s), describing the categories of data, the confidentiality/security mechanisms and the criteria for sharing/transfer), with an emphasis on risk/benefit assessment and, where possible, anonymisation.
Separately, Law No 14.874/2024 reinforces database design constraints in clinical research by requiring mechanisms to protect confidentiality and limiting sharing to anonymous or coded data, with the re- identification key retained by the data manager. The LGPD applies subsidiarily in this context and fills in broader privacy duties (security, accountability and, if applicable, international transfer mechanisms).
3. Marketing Authorisations 3.1 Product Classification
In Brazil, the classification of a health product as a medicinal product or as a medical device follows well- defined legal and technical criteria, centred on the product’s primary mechanism of action, its intended purpose and how the intended therapeutic effect is achieved. The legal and regulatory framework is primarily based on Law No 5,991/1973 and Law No 6,360/1976 and, with respect to medical devices, on ANVISA RDC No 751/2022 and related subsequent and supplementary resolutions. For medicinal products, ANVISA adopts the statutory concept of a medicine as a pharmaceutical product, obtained or technically prepared, intended for prophy- lactic, curative, palliative or diagnostic purposes. In practice, products whose primary intended action is achieved through a pharmacological, immunological or metabolic effect tend to fall within the medicinal product framework. A health product classified as a medical device, in turn, is intended for use in human beings for specific medical purposes whose principal action is not achieved by pharmacological, immuno- logical or metabolic means, even though such actions may be ancillary. For medical devices, the assessment focuses on the concept of a device within the medical device regulatory framework and on the product’s intended purpose. For example, ANVISA’s own guidance on “materials for use in healthcare” describes them as non-active health products, meaning that their opera- tion does not depend on an external energy source other than that generated by the human body or by
38 CHAMBERS.COM
Powered by FlippingBook