DATA PROTECTION, INFORMATION SECURITY AND INTERNATIONAL DATA TRANSFERS: A PRACTICAL GUIDE THROUGH KEY PROVISIONS AND COMPLIANCE TOOLS

Abstract

European data protection law has changed markedly in the last two years, since the introduction of the European General Data Protection Regulation (GDPR), which is increasingly seen as a benchmark for data protection frameworks around the world. Companies operating in the healthcare sector carry greater responsibilities under the GDPR than many companies in other sectors, because of the large volume of sensitive personal data that they inevitable control and process. Moreover, HealthTech companies rely heavily on apps linked to physical medical devices, which makes them subject not only to the GDPR, but also the e-Privacy Directive and medical device regulation. This chapter provides a thorough overview of the application of the relevant GDPR and e-Privacy Directive provisions in the healthcare sector, particularly with respect to HealthTech companies. Given that the GDPR has changed the way in which companies communicate with their customers, this chapter zooms in on marketing activities in the healthcare sector and guides readers through various security measures that organisations are required to put in place.