GDPR and MDR/IVDR

The General Data Protection Regulation (GDPR) stands as a cornerstone in safeguarding personal data privacy, while the Medical Device Regulation (MDR) and the In Vitro Diagnostic Medical Device Regulation (IVDR) set forth standards for the safety and performance of medical devices. However, when a product bridges both realms serving as a medical device while simultaneously collecting and handling personal data - compliance obligations become intertwined. In this context, adherence to both GDPR and MDR/IVDR is imperative, ensuring not only the efficacy and safety of the medical device but also the privacy and security of sensitive personal data.

What data is covered by GDPR?

The General Data Protection Regulation applies to the processing of personal data of individuals located within the European Union regardless of their citizenship or residency status. Additionally, GDPR also applies to the processing of personal data by organizations outside the EU if they offer goods or services to individuals in the EU or monitor the behavior of individuals within the EU.

GDPR primarily applies to the processing of personal data, which is defined as any information relating to an identified or identifiable natural person. This includes not only common identifiers such as names, addresses, and identification numbers but also other factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of individuals.

Besides, GDPR may also apply to certain special categories of data. These categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

Additionally, GDPR imposes obligations on the processing of personal data relating to criminal convictions and offenses, known as "criminal data."

What data is not covered by GDPR?

The General Data Protection Regulation generally applies to the processing of personal data, which is defined as any information relating to an identified or identifiable natural person. Other types of data are not covered by GDPR, such as:

• Data that has been anonymized or de-identified in such a way that it cannot be used to identify individuals is not considered personal data and therefore falls outside the scope of GDPR
• Data relating to legal entities, such as companies, partnerships, or organizations, is generally not considered personal data and is not covered by GDPR. However, data related to individuals acting in their capacity as representatives or employees of such entities may be considered personal data.
• Information that is publicly available and easily accessible to the general public through lawful means, such as public registers, official gazettes, or publicly accessible websites, is not subject to GDPR. However, if the data subject has restricted the processing of their publicly available information, GDPR may still apply.
• GDPR does not apply to the processing of personal data for national security or law enforcement purposes. These activities are subject to separate legal frameworks established by EU member states.
• The processing of personal data by individuals for purely personal or household activities, such as keeping address books or family photo albums, is not covered by GDPR.

What medical devices and IVDs may be subject to GDPR?

Gererally, compliance with GDPR is necessary whenever personal data is involved in the operation, use, or processing of medical devices or IVDs to ensure the protection of individuals' privacy rights and data security.

So the simple rule to determine whether or not your device must be GDPR-compliant is: if your device collects or processes personal data of patients or users, it must be GDPR-compliant. If it does not, GDPR does not apply.

Some medical devices and in vitro diagnostic medical devices that may be required to comply with the General Data Protection Regulation include:

• Wearable health devices that collect personal health data, including heart rate, activity levels, and sleep patterns.
• Medical devices equipped with connectivity features, such as pacemakers, insulin pumps, and continuous glucose monitors, that transmit patient data to healthcare providers or cloud-based platforms.
• Devices used in telemedicine or remote monitoring applications, such as telehealth platforms, remote patient monitoring systems, and video conferencing tools, which involve the processing of patient data.
• Mobile applications or software platforms designed for health monitoring purposes, including symptom trackers, medication management apps, and chronic disease management tools.
• In vitro diagnostic devices used for genetic testing or personalized medicine applications, such as direct-to-consumer genetic testing kits, which collect and process sensitive genetic information.
• Laboratory equipment used for in vitro diagnostic testing, including automated analyzers, PCR machines, and next-generation sequencing platforms, which generate and process patient data
• Integrated healthcare information systems, electronic health records (EHRs), and hospital information systems (HIS), which store and manage patient health data across healthcare facilities.
• Remote monitoring devices used for patient surveillance or remote patient monitoring, including cardiac monitors, pulse oximeters, and respiratory monitoring devices.
• Implantable medical devices, such as neurostimulators, cochlear implants, and orthopedic implants, which may collect and transmit patient data for diagnostic or therapeutic purposes.
• Point-of-care testing devices used for rapid diagnostic testing, such as blood glucose meters, pregnancy tests, and infectious disease testing kits, which process patient samples and generate test results.

These examples illustrate the diverse range of medical devices and IVDs that may collect, process, or transmit personal data, thereby necessitating compliance with GDPR requirements to ensure the protection of patient privacy and data security.