How the Danish Medicines Agency uses personal data – for healthcare professionals

If you have any questions about our processing of personal data, please do not hesitate to contact us

You can contact us in the following ways:

• By e-mail: Send an email. If your inquiry contains sensitive or confidential information (such as CPR number (civil registration number) or health data), you should always use a secure communication method. Address your inquiry to “data protection”. You can see here how to send secure emails to the Danish Medicines Agency on the website of the Danish Medicines Agency.
• By letter: Danish Medicines Agency, Axel Heides Gade 1, 2300 Copenhagen S, Denmark, attn. “data protection”.

You are also welcome to contact Helle Ginnerup-Nielsen, group-wide data protection officer at the Ministry of the Interior and Health. You can contact the data protection officer in the following ways:

• By e-mail: Send an email. If your inquiry contains sensitive or confidential information (such as CPR number (civil registration number) or health data), you should always use a secure communication method. Address your inquiry to the “data protection officer”. You can see here how to send secure emails to the Ministry of the Interior and Health on the website of the Ministry of the Interior and Health.
• By letter: Ministry of the Interior and Health, Slotsholmsgade 10-12, 1216 Copenhagen K, Denmark, attn. “data protection officer”.

The purposes and legal basis of the processing of your personal data

We process your personal data for the following purposes:

• The Danish Medicines Agency monitors the safety of medicines.
• The ADR report that the Danish Medicines Agency receives is registered in our Danish ADR database and is used in our work with the monitoring of the safety of medicines.
• The Danish Medicines Agency forwards the ADR report to the European database of adverse drug reaction reports (the EudraVigilance database) of the European Medicines Agency (EMA).
• Access to the data in the EudraVigilance database is given to the manufacturer of the medicine, the EMA, the national competent authorities in the EU-EEA countries as well as the European Commission for them to monitor the safety of medicines. The EMA also sends information from the EudraVigilance database to the WHO.
• The Danish Medicines Agency collaborates with the EMA and the other national competent authorities. We continually assess if new information on ADRs gives rise to changing, for example, the medicine's package leaflet. The pharmaceutical company is also required to assess the medicine's safety continuously, and in this connection, they use all the information on ADRs that they receive from all over the world.

The legal basis for our processing of your personal data follows from:

Section 56(1) and (2) of the Danish Medicines Act, the Danish Executive Order on Monitoring of Adverse Reactions, the Regulation of the European Parliament and of the Council laying down Community procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency, the European Commission's Implementing Regulation on the performance of pharmacovigilance activities.

Categories of personal data

We process the following categories of personal data about you:

• Basic information, e.g. name, title, workplace.
• Health data if you report an ADR you have experienced yourself.

Recipients or categories of recipients

We disclose or transfer your personal data to the following recipients:

• The Danish Medicines Agency forwards the ADR report to the European database of adverse drug reaction reports (the EudraVigilance database) of the European Medicines Agency (EMA).
• Access to the data in the EudraVigilance database is given to the manufacturer of the medicine, the EMA, the national competent authorities in the EU-EEA countries as well as the European Commission for them to monitor the safety of medicines. The EMA also sends information from the EudraVigilance database to the WHO.
• The Danish ADR database is a database established and operated by the British Medicines and Healthcare products Regulatory Agency (MHRA). The Danish Medicines Agency thus uses the MHRA as a data processor.
• The Danish Medicines Agency uses Devoteam Management Consulting A/S and Microsoft Ireland Operations, Ltd. as data processors.

Transfer to recipients in third countries, including international organisations

Your personal data is transferred to recipients outside the EU and the EEA.

The Danish Medicines Agency's data processor, MHRA, is located in England. On the 28th of June 2021, the European Commission decided that England ensures an adequate level of protection and thus is considered a safe third country according to article 45 in the General Data Protection Regulation.

MHRA uses a subcontractor, Accenture India, located in India.

The Danish Data Protection Agency has authorised the specific transfer of data to a third country in its authorisation dated 8 October 2010, cf. article 46(5) of the General Data Protection Regulation. You can request a copy of the authorisation granted by the Danish Data Protection Agency by contacting us.

Storing of your personal data

Reports of suspected ADRs are part of the Danish Medicines Agency's monitoring of the safety of specific medicines. Pharmacovigilance data must according to article 16 (2) in the Commission’s Implementing Regulation on the performance of pharmacovigilance activitites be stored for as long as the medicine is authorised and for at least 10 years after the marketing authorisation has expired.

Your rights

The General Data Protection Regulation gives you a number of rights in respect of our processing of your personal data. 

If you want to make use of your rights, you need to contact us.

Right to see your data (right of access)

You have the right to access the information we process about you as well as other information.

Right to rectification (correction)

You have the right to have incorrect information about you corrected.

Right to erasure

In exceptional cases, you have the right to have information about you erased before the time we would generally erase the information.

Right to restriction of processing

In certain cases, you have the right to have the processing of your data restricted. If you do have the right to restriction of processing, then we are only allowed to process your data, with the exception of storage, with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another person or for reasons of important public interest.

Right to object

In certain cases, you have the right to object to our otherwise legal processing of your personal data.

You can read more about your rights in the Danish Data Protection Agency's guidelines on the rights of data subjects. The guidelines are available in Danish at the website of the Danish Data Protection Agency: www.datatilsynet.dk.

Lodging a complaint with the Danish Data Protection Agency

You have the right to lodge a complaint with the Danish Data Protection Agency if you are displeased with the way in which we process your personal data. The contact details of the Danish Data Protection Agency are available at www.datatilsynet.dk (in Danish only)