Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / Navigating GDPR in the Pharmaceutical Sector

Transcript

Navigating GDPR in the Pharmaceutical Sector · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  How do financial or not financial, I should say
• 0:02
  pharmaceutical companies navigate the challenge of GDPR,
• 0:07
  the new laws that are coming up, and especially HIPAA in the USI
• 0:10
  mean, what's happening? How do they see it?
• 0:13
  Do they see it as a problem? Do they see it as a solution?
• 0:16
  Do they see it as a business enabler?
• 0:18
  What do you observe? I observe D all of the above.
• 0:23
  So you know that that said, what we most commonly see is, you
• 0:28
  know, hey, the regulatory landscape is changing, right?
• 0:31
  So technology all around us is changing.
• 0:33
  And then the use cases in which data can be valuable to these
• 0:37
  companies is also very rapidly evolving and without the
• 0:41
  appetite to try new things is evolving.
• 0:42
  But then how do you do that against the backdrop of the
• 0:45
  regulatory frameworks? Where we see companies be the
• 0:48
  most successful is when they think about it, not necessarily
• 0:51
  in the explicit letter of the law.
• 0:53
  And to be clear, I'm not saying we don't pay attention to the
• 0:55
  letter of the law, but they kind of distil it.
• 0:57
  So what are the core concepts? And the idea of mitigating the
• 1:00
  risk of re identification is actually a central theme to
• 1:03
  pretty much any territories regulation on consumer or
• 1:07
  patient privacy. And so now they word it
• 1:10
  differently. They sometimes describe it in
• 1:12
  different ways, but at the same time, at its core, that's what
• 1:15
  they're after. These companies are really
• 1:17
  taking this approach of like, OK, so how can I extract utility
• 1:21
  from the information without actually, you know, raising the
• 1:24
  risk of re identifying an individual?
• 1:26
  And if we do that, then we have the opportunity to produce
• 1:29
  strategic advantage because, you know, especially as you start
• 1:32
  thinking about machine learning, you know, data science
• 1:34
  capabilities, the almost dreaded buzzword of AI, you know, in
• 1:39
  some extent that gets a lot more, you know, kind of
• 1:42
  complicated, but it also becomes a lot more unique because No2,
• 1:46
  even if you're running the same type of models, you get 2 very
• 1:48
  different answers at the end based on what your business
• 1:51
  knows about the domain and then the types of information that
• 1:55
  you give it. And so starting in that position
• 1:58
  enables the companies to better navigate the various territorial
• 2:02
  regulations. Yeah, I agree with you.
• 2:04
  And in this multi, what do you say landscape, multi law
• 2:09
  landscape, especially for companies that are conducting
• 2:13
  clinical trials and clinical trials as you would imagine they
• 2:17
  have to be conducted across the board.
• 2:20
  You can't say we'll conduct it with European data or U.S. data
• 2:23
  or African data. It has to be globally done.
• 2:26
  So what kind of challenge do they face and how can that
• 2:29
  challenge be solved? Because it's practically very
• 2:31
  challenging to comply law by law.
• 2:34
  Yeah. And clinical trials are an
• 2:36
  extremely complicated thing, you know, whether it be site
• 2:38
  selection or how do you, you know, attract qualified
• 2:42
  participants and how do you sort of reduce waste and time?
• 2:45
  You know, the, the most heartbreaking thing is, you
• 2:47
  know, the pursuit of a a trial and it takes 5 or 6 years to
• 2:50
  even build the panel for participants, right.
• 2:52
  And so with that, though, you know, again, kind of a similar
• 2:56
  spirit to the previous answer is that when you're kind of focused
• 3:00
  on what are the, you know, kind of particular spirit of the law,
• 3:04
  where how how might you approach the idea of, hey, are there
• 3:09
  other data points that I can pull from sort of non
• 3:12
  traditional considerations? And how, you know, how might
• 3:14
  that be used to go create look, alikes and audience panels that,
• 3:19
  you know, aren't actually getting at one individual
• 3:21
  uniquely? But how could you use historic
• 3:23
  information out of consumer data and you know, clinical data from
• 3:29
  say you know, medical claims, you know, and equivalents around
• 3:33
  the world to kind of understand the types?
• 3:35
  Of. You know, preceding conditions
• 3:38
  that often lead to the things that are of concern for a trial,
• 3:42
  you know, where diagnosis have been made in the past, those
• 3:45
  types of things. And then how might you merge
• 3:46
  those, you know, in a way that is compliant.
• 3:48
  And that's where there's a lot of very robust privacy enhancing
• 3:52
  technologies, tokenization capabilities, and then also very
• 3:58
  robust statistical models to help with some of the
• 4:00
  remediation and then models to help with what are the look
• 4:04
  alikes, You know, what are where how can you go attract, you
• 4:08
  know, clinical participants? And what what's kind of
• 4:12
  interesting in these types of approaches where we've seen them
• 4:14
  deployed so far is that the ability to kind of clear the
• 4:17
  territory regulations starts to increase because at the core,
• 4:21
  you're kind of in a rolling start.
• 4:22
  And so then it's really more around, are there other
• 4:24
  considerations for how you manage consent for, you know,
• 4:28
  how, how do you manage like the ability to be forgotten, you
• 4:31
  know, those types of things. So they become a little bit more
• 4:33
  administrative versus the core data set.
• 4:36
  And the secondarily, it also allows you to kind of spin up
• 4:37
  the idea of running the recruitment in parallel to the
• 4:42
  site selection versus what's often a bit of a kind of chicken
• 4:45
  and egg argument that, well, if I don't have this, I can't go
• 4:49
  get people, but then it takes a whole long time to get people.
• 4:51
  So you know, then the clinical side's on hold and you know,
• 4:55
  just produces a lot of frustration for all involved
• 4:57
  because you know, the intention behind it is still, you know,
• 5:00
  very good, very pure, but. You know, it's like, how do you?
• 5:03
  Get rid of the regulation as being the core challenge.
• 5:05
  And so that's that's a bit of the way we can network that
• 5:07
  makes sense. And if we continue the
• 5:10
  conversation between the GDPR and hip hop, I think the US and
• 5:15
  the EU have taken different approaches towards the
• 5:18
  regulation. Is there anything?
• 5:20
  And of course, end of the day, the regulation is same as you
• 5:23
  mentioned earlier, it's about achieving certain objectives.
• 5:27
  But what is it that can be learned from both perspectives
• 5:30
  or both approaches? Yeah.
• 5:32
  So you know GPR, you know, strictly my opinion, GPR has
• 5:35
  done a really good job about us as individuals, right.
• 5:38
  So they were very thoughtful and the way they lay out the
• 5:42
  framework to give we as individuals a lot more rights to
• 5:46
  control over our data and that kind of has a universal
• 5:49
  application. And you know, here in domestic
• 5:51
  US, we saw the state of California, as it started to
• 5:54
  introduce its Consumer Protection Act, it, it actually
• 5:58
  had a lot of sort of kindred spirit, if you will, to GDPR in
• 6:02
  terms of introducing very similar types of rights, you
• 6:05
  know, for as individually as consumers.
• 6:08
  HIPAA, on the other hand, kind of originated from a slightly
• 6:10
  different place. And you know, it, it's, it's
• 6:13
  always kind of fun to remember that HIPAA actually started with
• 6:16
  the intention of being it preventing the idea of
• 6:19
  discrimination based on a health condition, right?
• 6:22
  And then it evolved very quickly from that, where it's also
• 6:25
  really important to be able to share information around and
• 6:27
  then the idea of minimum necessary.
• 6:29
  So like, how much information really is required to, you know,
• 6:32
  handle the task at hand? And then how do you use this
• 6:36
  data in such a way that you're not betraying someone's
• 6:38
  identity, thus increasing the risk of discrimination?
• 6:41
  And so, you know, their starting points are very different, but
• 6:44
  overtime, you know, they are kind of starting to come towards
• 6:47
  the middle of it. You know, whether or not the US
• 6:50
  will ultimately adopt, you know, a federal that's a national
• 6:53
  standard similar to GDPR. You know, that's up for, you
• 6:57
  know, our, our friends in Washington to figure out, you
• 7:00
  know, but that that said it, it has been very interesting to
• 7:05
  watch how companies that act in the US, you know, that are
• 7:07
  global. So they're headquarters
• 7:09
  somewhere in the EU are just kind of coming up with a default
• 7:11
  position of saying, hey, we're, we're going to balance these two
• 7:14
  things. And then, you know, how do we
• 7:16
  harmonise across the regulatory standards and then here in the
• 7:20
  US in particular, how do we navigate what our state level
• 7:22
  regulations where they they might have a different or
• 7:25
  slightly more strict interpretation.