FRANCE Law and Practice Contributed by: Emmanuelle Trombe, Anthony Paronneau, Anne-France Moreau and Lorraine Maisnier-Boché, McDermott Will & Emery
3. Marketing Authorisations for Pharmaceuticals or Medical Devices 3.1 Product Classification: Pharmaceuticals or Medical Devices The classification of a product as either a phar- maceutical or a medical device is determined by its intended purpose and mode of action, in accordance with EU law. In essence, classifica- tions are as follows. • A product is classified as a pharmaceutical product if it is intended to be used for medical purposes through pharmacological, immu- nological or metabolic means. This includes substances or combinations of substances used to treat or prevent diseases, restore, correct or modify physiological functions, or make medical diagnoses. • A product is classified as a medical device if it is intended to be used for medical purposes without relying on pharmacological, immuno- logical or metabolic means. Medical devices include instruments, apparatus, appliances, software, implants, reagents, materials or other articles used alone or in combination for medical purposes. Some products may have characteristics of both pharmaceuticals and medical devices, known as “borderline” , “hybrid” or even “combination” products. In such cases, the ANSM may assess the product on a case-by-case basis to deter- mine the applicable regulatory framework. This assessment considers the product’s intended purpose, its mode of action and the claims made by the manufacturer.
2.6 Databases Containing Personal or Sensitive Data In addition to the usual conditions for processing of sensitive data under the GDPR and French law (see 2.5 Use of Data Resulting From Clinical Trials ), databases containing personal or sen- sitive data can be subject to the requirements applicable to Health Data Warehouses. The CNIL considers that databases designed for facilitat- ing secondary use of health data (eg, research, studies and in some cases, AI training), named “Health Data Warehouses” , qualify as autono- mous health data processing and should be grounded on one of the exemptions of Article 9 of the GDPR. In practice, the legal grounds for such Health Data Warehouses are either the explicit consent from data subject or a CNIL authorisation. A standard CNIL authorisation can be granted for organisations which comply with the framework on Health Data Warehouses – however, this framework is designed for Health Data Warehouses justified by a public interest mission. The data protection requirements imposed by GDPR can be supplemented by health law requirements, mainly from the French Public Health Code (FPHC), if the databases contain medical data. Organisations hosting personal health data collected in the course of preven- tive, diagnostic, care or medico-social monitor- ing activities ( “HDS data” ) on behalf of a data controller must hold a specific Hébergeurs de données de santé or HDS certification (Article L.1111-8 of the FPHC). Processing of medical information is also frequently subject to a strong duty of confidentiality ( “medical secrecy” ) under Article L.1110-4 of the FPHC.
101 CHAMBERS.COM
Powered by FlippingBook