Common use of Confidentiality Data Protection and Freedom of Information Clause in Contracts

Confidentiality Data Protection and Freedom of Information. 6.1 Medical Confidentiality, Data Protection and Freedom of Information The Parties agree to adhere to the principles of medical confidentiality in relation to Clinical Trial Subjects involved in the Clinical Trial. Personal data (as defined in the Data Protection Act 1998) shall not be disclosed to the Sponsor or CRO by the Trust save where this is required to satisfy the requirements of the Protocol or for the purpose of monitoring or adverse event reporting, or in relation to a claim or proceeding brought by the Clinical Trial Subject in connection with the Clinical Trial. Neither the Sponsor nor CRO shall disclose the identity of Clinical Trial Subjects to third parties without prior written consent of the Clinical Trial Subject, except in accordance with the provisions of the Data Protection Act 1998 and the principles set out in the NHS Confidentiality Code of Practice (November 2003), unless in relation to a claim or proceeding brought by the Clinical Trial Subject in connection with the Clinical Trial. All Parties shall comply with the Data Protection Act 1998 ("xxx 0000 Xxx") and any other applicable data protection legislation. In particular where any Party is acting as the data processor of another Party ("data controller"), the Party processing data on behalf of the other agrees to comply with the obligations placed on the data controller by the seventh data protection principle ("the Seventh Principle") set out in the 1998 Act, namely: to maintain technical and organisational security measures sufficient to comply at least with the obligations imposed on the data controller by the Seventh Principle; only to process Personal Data for and on behalf of the data controller, in accordance with the instructions of the data controller and for the purpose of the Clinical Trial and to ensure the data controller’s compliance with the 1998 Act; to allow the data controller to audit the processing party's compliance with the requirements of this clause on reasonable notice and/or to provide the data controller with evidence of its compliance with the obligations set out in this clause 6. the processing party shall obtain prior agreement of the data controller to store or process Personal Data at sites outside the European Economic Area (comprising the countries of the European Community, Norway, Iceland and Liechtenstein). all parties agree to use all reasonable efforts to assist the others to comply with the 1998 Act. For the avoidance of doubt, this includes providing the other with reasonable assistance in complying with subject access requests served under Section 7 of the 1998 Act and consulting with the other prior to the disclosure of any Personal Data created in connection with the conduct or performance of the Clinical Trial in relation to such requests. Freedom of Information The Sponsor and CRO acknowledge that the Trust is subject to the Freedom of Information Xxx 0000 ("FOIA") and the Codes of Practice issued under the FOIA as may be amended, updated or replaced from time to time.

Confidentiality Data Protection and Freedom of Information. 6.1 Medical Confidentiality, Data Protection and Freedom of Information The Parties agree to adhere to the principles of medical confidentiality in relation to Clinical Trial Subjects involved in the Clinical Trial. Personal data (as defined in the Data Protection Act 1998) shall not be disclosed to the Sponsor or CRO by the Trust Board save where this is required to satisfy the requirements of the Protocol or for the purpose of monitoring or adverse event reporting, or in relation to a claim or proceeding brought by the Clinical Trial Subject in connection with the Clinical Trial. Neither the Sponsor nor CRO shall disclose the identity of Clinical Trial Subjects to third parties without prior written consent of the Clinical Trial Subject, except in accordance with the provisions of the Data Protection Act 1998 and the principles set out in the NHS Confidentiality Scotland Code of Practice on Protecting Patient Confidentiality (November August 2003), unless in relation to a claim or proceeding brought by the Clinical Trial Subject in connection with the Clinical Trial. All Parties shall comply with the Data Protection Act 1998 ("xxx 0000 Xxx") and any other applicable data protection legislation. In particular where any Party is acting as the data processor of another Party ("data controller"), the Party processing data on behalf of the other agrees to comply with the obligations placed on the data controller by the seventh data protection principle ("the Seventh Principle") set out in the 1998 Act, namely: to maintain technical and organisational security measures sufficient to comply at least with the obligations imposed on the data controller by the Seventh Principle; only to process Personal Data for and on behalf of the data controller, in accordance with the instructions of the data controller and for the purpose of the Clinical Trial and to ensure the data controller’s compliance with the 1998 Act; to allow the data controller to audit the processing party's compliance with the requirements of this clause on reasonable notice and/or to provide the data controller with evidence of its compliance with the obligations set out in this clause 6. the processing party shall obtain prior agreement of the data controller to store or process Personal Data at sites outside the European Economic Area (comprising the countries of the European Community, Norway, Iceland and Liechtenstein). all parties agree to use all reasonable efforts to assist the others to comply with the 1998 Act. For the avoidance of doubt, this includes providing the other with reasonable assistance in complying with subject access requests served under Section 7 of the 1998 Act and consulting with the other prior to the disclosure of any Personal Data created in connection with the conduct or performance of the Clinical Trial in relation to such requests. Freedom of Information The Sponsor and CRO acknowledge that the Trust Board is subject to the Freedom of Information (Scotland) Xxx 0000 ("FOIA") and the Codes of Practice issued under the FOIA as may be amended, updated or replaced from time to time.

Confidentiality Data Protection and Freedom of Information. 6.1 Medical Confidentiality, Data Protection and Freedom of Information The Parties agree to adhere to the principles of medical confidentiality in relation to Clinical Registry Trial Subjects involved in the Clinical Registry Trial. Personal data (as defined in the Data Protection Act 1998) shall not be disclosed to the Sponsor or CRO by the Trust Board save where this is required to satisfy the requirements of the Protocol or for the purpose of monitoring or adverse event reporting, or in relation to a claim or proceeding brought by the Clinical Registry Trial Subject in connection with the Clinical Registry Trial. Neither the Sponsor nor CRO shall disclose the identity of Clinical Registry Trial Subjects to third parties without prior written consent of the Clinical Registry Trial Subject, except in accordance with the provisions of the Data Protection Act 1998 and the principles set out in the NHS Confidentiality Scotland Code of Practice on Protecting Patient Confidentiality (November August 2003), unless in relation to a claim or proceeding brought by the Clinical Registry Trial Subject in connection with the Clinical Registry Trial. All Parties shall comply with the Data Protection Act 1998 ("xxx 0000 Xxxthe 1998 Act") and any other applicable data protection legislation. In particular where any Party is acting as the data processor of another Party ("data controller"), the Party processing data on behalf of the other agrees to comply with the obligations placed on the data controller by the seventh data protection principle ("the Seventh Principle") set out in the 1998 Act, namely: to maintain technical and organisational security measures sufficient to comply at least with the obligations imposed on the data controller by the Seventh Principle; only to process Personal Data for and on behalf of the data controller, in accordance with the instructions of the data controller and for the purpose of the Clinical Registry Trial and to ensure the data controller’s compliance with the 1998 Act; to allow the data controller to audit the processing party's compliance with the requirements of this clause on reasonable notice and/or to provide the data controller with evidence of its compliance with the obligations set out in this clause 6. the processing party shall obtain prior agreement of the data controller to store or process Personal Data at sites outside the European Economic Area (comprising the countries of the European Community, Norway, Iceland and Liechtenstein). all parties agree to use all reasonable efforts to assist the others to comply with the 1998 Act. For the avoidance of doubt, this includes providing the other with reasonable assistance in complying with subject access requests served under Section 7 of the 1998 Act and consulting with the other prior to the disclosure of any Personal Data created in connection with the conduct or performance of the Clinical Registry Trial in relation to such requests. Freedom of Information The Sponsor and CRO acknowledge that the Trust Board is subject to the Freedom of Information Xxx 0000 (Scotland) Act 2002 ("FOIA") and the Codes of Practice issued under the FOIA as may be amended, updated or replaced from time to time.