Medicines and Medical Devices Act 2021

8 Disclosure of information in accordance with international agreements

(1) This section applies to information which a relevant authority holds in connection with human medicines.

(2) The relevant authority may disclose information to a relevant person outside the United Kingdom where—

(a) the disclosure is required for the purpose of giving effect to an international agreement or arrangement concerning the regulation of human medicines, and

(b) the relevant authority considers that the disclosure is in the public interest.

(3) The relevant authority may not disclose commercially sensitive information in reliance on subsection (2) unless the relevant authority—

(a) considers that it is necessary to do so for the purpose mentioned in that subsection, and

(b) is satisfied that the making of the disclosure is proportionate to what is sought to be achieved by it.

(4) Except as provided by subsections (5) and (6), the disclosure of information in accordance with this section does not breach—

(a) an obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of the information (however imposed).

(5) Nothing in this section authorises a disclosure of patient information without the consent of the individual to whom that information relates.

(6) Nothing in this section authorises a disclosure of information which—

(a) contravenes the data protection legislation (but in determining whether a disclosure would do so, take into account the powers conferred by this section), or

(b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(7) This section does not limit the circumstances in which information may be disclosed under any other enactment or rule of law.

(8) In this section—

• “commercially sensitive information” means commercial information whose disclosure the relevant authority thinks might significantly harm the legitimate business interests of the undertaking to which it relates;

• “data protection legislation” has the meaning given by section 3(9) of the Data Protection Act 2018;

• “patient information” means information (however recorded) which—

  (a)

  relates to—

  (i)

  the physical or mental health or condition of an individual,

  (ii)

  the diagnosis of an individual’s condition, or

  (iii)

  an individual’s care or treatment,

  or is (to any extent) derived directly or indirectly from information relating to any of those matters, and

  (b)

  identifies the individual or enables the individual to be identified (whether by itself or in combination with other information);

• “relevant authority” means—

  (a)

  the Secretary of State, or

  (b)

  the Department of Health in Northern Ireland;

• “relevant person” means—

  (a)

  the government of a country or territory outside the United Kingdom;

  (b)

  a person who exercises functions on behalf of such a government;

  (c)

  any other person who exercises functions or provides services relating to human medicines in a country or territory outside the United Kingdom;

  (d)

  an international organisation that exercises functions or provides services relating to human medicines.