SERBIA Law and Practice Contributed by: Bisera Andrijašević and Anja Gligorević, BDK Advokati
information to, and secure the consent of, the subjects and to protect their personal data. 2.5 Use of Data Resulting From Clinical Trials In accordance with the Data Protection Act (2018), data resulting from clinical trials is per- sonal data, specifically special category data (health data), as long as a particular individual is identifiable from that data. As it follows from an opinion of the Data Protection Commission- er, expressed in its ninth publication Protection of Personal Data: Opinions and Stances of the Commissioner (2024), the Commissioner con- siders clinical trial data identifiable (and there- fore, personal) as long as any party, whether the controller or a third party, can identify the data subject. Data processing of the resulting data, including sharing the data with third parties or affiliates, may be permitted, however, the supervisory authority and courts have not given any clari- fication as to which legal bases and conditions for the processing are applicable. In particular, the Commissioner has not opined on whether consent from clinical trial participants can be freely given and thus serve as a legal basis for the processing of their personal data. Clinical trial data may be transferred abroad to countries that are members of the Council of Europe Convention for the Protection of Indi- viduals with Regard to Automatic Processing of Personal Data, and to countries determined by the European Union to provide an adequate level of protection. Transfer to other countries is allowed if the data exporter applies one of the prescribed safeguards, such as the conclusion of controller-to-processor standard contractual clauses, adopted by the Commissioner, with the data importer. Controller-to-controller clauses
are not available in Serbia because the Data Protection Act does not authorise the Commis- sioner to adopt them. Alternatively, data transfer may occur in specific situations outlined in the Data Protection Act, such as transfer based on explicit and informed consent. 2.6 Databases Containing Personal or Sensitive Data Creation of a database with the resulting data from the clinical trials would require carrying out a data protection impact assessment, in line with the Decision of the Serbian Data Protection Commissioner on the list of categories of data processing activities for which a data protection impact assessment must be carried out. 3. Marketing Authorisations for Pharmaceuticals or Medical Devices 3.1 Product Classification: Pharmaceuticals or Medical Devices An assessment of whether a product should be classified as a pharmaceutical or as a medical device is carried out by the ALIMS in the pro- cess of issuing of a marketing authorisation for a pharmaceutical product or registration of a med- ical device. The Medicines Act and the Medical Devices Act contain the criteria for classification. The main criterion for differentiating between pharmaceuticals and medical devices is the fol- lowing: pharmaceuticals are applied to humans or animals with the intention to restore, improve or modify physiological function by pharmaco- logical, immunological or metabolic action, or by setting up a medical diagnosis; however, medi- cal devices do not fulfil their principal intended purpose in or on the human body by pharma- cological, immunological or metabolic means,
261 CHAMBERS.COM
Powered by FlippingBook