• Home
  • Policies
  • European Union and Switzerland Data Handling and Transfer Policy

European Union and Switzerland Data Handling and Transfer Policy

Effective Revision Date (December 4, 2015)

Change synopsis: In light of the recent decisions invalidating the U.S.-EU and U.S.-Swiss Safe Harbor Frameworks, this policy has been reviewed and modified to reflect SJM’s continued commitment to protecting personal information and SJM’s practices in collecting, handling, and transferring data from member countries of the European Union and Switzerland to the United States.

 

Scope

St. Jude Medical (SJM) respects and protects personally identifiable information that we collect and/or maintain. As part of our commitment, SJM works to ensure that all EU and Swiss data transfers to the US are appropriate and allowed under applicable laws, regulations, certifications, contractual agreements, and consent forms.

Although the U.S.-EU and U.S.-Swiss Safe Harbor Framework Agreements have recently been invalidated, SJM continues our commitment to ensure that any data collected and transferred from countries in the EU and Switzerland to the U.S. are protected and legally authorized. SJM has and will continue to maintain contractual agreements and consent forms which independently allow for the collection and transfer of data.

This policy describes the principles we follow with respect to transfers of personal information belonging to employees, patients enrolled in clinical trials, and customers and patients enrolled in the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System, whether in electronic, paper, or verbal format, between countries in the European Union (EU), Switzerland, and the United States.

European Union and Switzerland Data Handling and Transfer Policy

St. Jude Medical (SJM) respects and protects personally identifiable information that we collect and maintain. As part of our commitment, SJM works to ensure that all data transfers to the United States from the European Union and Switzerland are appropriate and allowed under applicable laws, regulations, certifications, contractual agreements, and consent forms. This policy describes the principles SJM follows with respect to transfers of personal information of our employees, customers, and patients.

Definitions

Agent - Any third party that processes personal information under the instructions of, and solely for, SJM or to which SJM discloses personal information for use on SJM’s behalf. Customer - A hospital or clinic that provides treatment using SJM devices and the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System, and/or the individual medical personnel (i.e. physicians and nurses) that use the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System.

Data Controller – The legal entity responsible for determining the means and purposes of collecting and processing Personal Information and Sensitive Personal Information. SJM’s Customers are Data Controllers of information related to SJM’s customers and patients enrolled in clinical trials, and customers and patients enrolled in the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System. SJM is the Data Controller of information related to SJM’s employees.

Data Processor – The legal entity who processes Personal Information or Sensitive Personal Information on behalf of the Data Controller. SJM is the Data Processor as we are processing information on behalf of our Customers.

Employee - An individual employed by a SJM affiliate located in one of the EU member countries or Switzerland.

Patient - An individual in one of the EU member countries or Switzerland enrolled in a clinical trial sponsored by St. Jude Medical or one of its affiliated companies, or an individual or customer enrolled in the Merlin.net™ Patient Care Network and/or CardioMEMSTM Heart Failure Monitoring System by their physician or clinic.

Personal Information - Any information or set of information that identifies or could be used by or on behalf of SJM to identify an employee, patient enrolled in a clinical trial, or patient and customer in the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System. Personal information does not include information that is encoded or anonymized and is not subject to re-identification, or publicly available information that has not been combined with non-public personal information.

Sensitive Personal Information - Personal information that receives heightened protection under various laws of countries in which St. Jude Medical operates, including but not limited to: race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information that concerns health or sexual orientation.

St. Jude Medical or SJM - St. Jude Medical, Inc. For employee data, SJM includes St. Jude Medical, Inc. (Corporate) and St. Jude Medical Cardiology Division, Inc., in the United States and territories. For patient data from clinical trials conducted in the EU or Switzerland, SJM includes St. Jude Medical, Inc. (Corporate), St. Jude Medical Cardiology Division Inc., Pacesetter, Inc., St. Jude Medical Atrial Fibrillation Division, Inc., Irvine Biomedical, Inc., and Advanced Neuromodulation Systems, Inc., and CardioMEMS, LLC. For patient data collected in the EU or Switzerland and processed by the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System, SJM includes St. Jude Medical, Inc. (Corporate) and Pacesetter, Inc., and CardioMEMS, LLC.

Privacy Principles

SJM adheres to the following privacy principles when transferring data from the EU or Switzerland to the U.S. These privacy principles are part of the ISO 29100:2011 based data privacy framework followed as part of SJM’s commitment to using best practices in transferring, handling, and protecting data. ISO standards are issued by the International Organization for Standardization and are accepted internationally as risk-based auditable principles.

Notice

Where SJM collects personal information directly from employees or patients enrolled in clinical trials, we will inform them about the purposes for which we collect, process, and use personal information about the employee, customer, or patient, the types of non-agent third parties to which SJM discloses that information, and the choices and means, if any, SJM offers individuals for limiting the use and disclosure of their personal information. Notice will be provided in clear and plain language at the time of collection, or as soon as practicable thereafter, and in any event, before SJM uses the information for a purpose other than that for which it was originally collected. Personal Information about patients enrolled in clinical trials may be used in a manner consistent with the general research purpose for which the data were originally collected; this includes use in future medical and pharmaceutical research activities that are unanticipated at the time of original collection. Where SJM acts as a data processor for the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System, we will provide information to the data controller (the Customer) about how the system processes personal information, and the data controller will be responsible for informing its patients and staff about the collection, processing, and use and will obtain consent from patients and, where necessary, from their staff as part of the enrollment process in the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System. The personal information of individuals enrolled in the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System may be used in a manner consistent with the consents obtained or information provided by the Customer at the time of enrollment.

Choice

Where SJM collects personal information directly from employees in the EU or Switzerland, or patients enrolled in clinical trials in the EU and Switzerland, we will offer the opportunity to choose (opt-out) whether their personal information is (a) to be disclosed to a non-agent third party or (b) to be used for a purpose other than the purpose for which it was originally collected or subsequently authorized. SJM will provide individuals with reasonable mechanisms to exercise their choices. Where SJM receives personal information as a data processor for the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System, SJM will work with the data controller to provide reasonable mechanisms for individuals to exercise their choices and process the data as directed by the data controller.

For sensitive personal information, SJM will give employees, or patients enrolled in clinical trials, the opportunity to affirmatively and explicitly consent (opt-in) to the disclosure of the information to a non-agent third-party or the use of the information for a purpose other than the purpose for which it was originally collected or subsequently authorized by the employee or patient. Where SJM is the data processor for the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System, SJM will process the data as directed by the data controller.

 

Onward Transfers to Third Parties

In cases of onward transfers to third parties, SJM will obtain assurances from third party business partners (agents) that they will safeguard personal information consistent with our policies. Examples of appropriate assurances that may be provided by third party business partners include: a contract obligating the third party to provide at least the same level of protection as is required by the applicable laws and regulations, including the EU Directive 95/46/EC (the EU Data Protection Directive), or being subject to another European Commission adequacy finding. Where SJM has knowledge that a third party business partner is using or disclosing personal information in a manner contrary to the company policy, SJM will take reasonable steps to prevent or stop the use or disclosure.

Security

SJM will take reasonable precautions to protect personal information in its possession from loss, misuse, and unauthorized access, use, disclosure, alteration, and destruction.

Data Integrity

SJM will use personal information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the employee or patient enrolled in a clinical trial. Where SJM is a data processor for patient or customer data in the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System, SJM will process that data consistent with the direction of the data controller. SJM will take reasonable steps to ensure that personal information is accurate, complete, current, and relevant to its intended use.

Access

Upon request, SJM will grant employees, or patients enrolled in a clinical trial, reasonable access to personal information that it holds about them. In addition, SJM will take reasonable steps to permit individuals to correct, amend, or delete information that is demonstrated to be inaccurate or incomplete. Where SJM is a data processor for the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System, SJM will act at the direction of the data controller.

Verification

SJM will use a self-assessment verification approach and conduct compliance audits of its applicable privacy practices to verify adherence to this policy. St. Jude Medical’s employees receive an annual training on SJM’s privacy principles and practices.

Enforcement and Dispute Resolution

Complaints or concerns for employee, patient clinical trial data, customer or patient data in the Merlin.net™ Patient Care Network and CardioMEMSTM Heart Failure Monitoring System should be addressed to the Chief Privacy Officer. Any employee that SJM determines is in violation of this policy will be subject to disciplinary action up to and including termination of employment. Any complaints or concerns that cannot be resolved internally will be referred to the Swiss Federal Data Protection and Information Commissioner or the applicable EU Data Protection Authorities. SJM is committed to following the determination and advice of these authorities.

Limitation on Scope of Principles

Adherence by SJM to this policy may be limited to the extent required to meet legal, governmental, or national security obligations, including requirements to cooperate with law enforcement.

 

Changes to This Policy

This policy may be amended from time to time, consistent with the requirements of applicable laws and regulations. The revisions will take effect on the date of publication of the amended policy, as stated. The change synopsis will state any material changes to the policy.

Contact Information

Complaints, questions, comments, or concerns on this policy, data collection, or data processing practices should be sent to:

Chief Privacy Officer
St. Jude Medical, Inc.
One St. Jude Medical Drive
St. Paul, MN 55117 USA
1-651-756-2000
1-800-328-9634
Privacy@sjm.com