1. Governing Texts

The increase of privacy and data protection regulations is imminent, and its implications in various areas of law practice are something that should not be overlooked. Guatemala is one of the few countries that have yet to issue a general privacy and data protection law. However, since the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') came into force with extraterritorial effects in 2018, even individuals without any physical presence in the EU could also be subject to its provisions if they process data outside the EU.

As mentioned above, Guatemala lacks a data protection law, and there are only a few general provisions included in some laws, but none are specific. Decree No. 57-2008 on the Law of Access to Public Information (only available in Spanish here) ('the Decree') defines what is considered to be personal and sensitive data, however, what is regulated in that law only relates to public activities.

Notwithstanding the above, it is recommended that all privacy issues should comply with the minimum requirements and standards established in the GDPR.

It is important to note that GDPR applicability might be extended to Guatemala, and, therefore, entities must comply with its regulations when processing data outside the EU in the following cases:

• when offering goods or services to consumers in the EU, irrespective of whether payment takes place in the EU;
• when monitoring the activities of persons in EU and EU residents when such processing takes place in the EU; or
• when an establishment is subject to EU legislation, according to public international law.

That being said, the pharmaceuticals sector has always relied on personal data. Therefore, when handling personal data, pharmaceuticals companies must now comply with the GDPR when applicable. Additionally, the Ministry of Public Health and Social Assistance ('MSPAS') issued, on 12 December 2019, the Ministerial Accord No. 299-2019 of 12 December 2019 (only available in Spanish here) ('Ministerial Accord No. 299-2019'), which establishes the specific regulation for privacy and data protection in relation to clinical research and clinical trials. Therefore, this specific area of the pharmaceuticals sector has to comply with this local regulation in addition to the GDPR.

1.1. Legislation

The main applicable legislation is as follows:

• Political Constitution of the Republic of Guatemala 1985 (only available in Spanish here) ('the Constitution');
• Decree No. 90-97 of the Congress of the Republic of Guatemala Promulgating the Health Code (only available in Spanish here) ('the Health Code'); and
• Ministerial Accord No. 299-2019.

1.2. Supervisory authorities

The MSPAS is the foremost authority responsible for enforcing the regulations discussed. It is assisted by various governmental regulators subject to its control, including:

• the General Directorate of Health Regulation, Vigilance, and Control which comprises:
  • the Department for the Regulation, Accreditation, and Control of Health Establishments, which regulates the accreditation and control of health facilities in the country so that they meet the qualification requirements and accreditation standards to provide the highest quality of care to the public, and which promotes the quality accreditation of health facilities to be certified internationally; and
  • the Department for the Regulation and Control of Pharmaceuticals and Related Products ('DRCPFA'), which regulates and controls pharmaceuticals and related products, and the entities that import, manufacture, and market such products in Guatemala;
• the National Program of Pharmacovigilance (only available in Spanish here) ('the Program') involves:
  • the National Pharmacovigilance coordinator centre, which is the national reference centre on pharmacovigilance, and is responsible for collecting and analysing information related to the safety and efficacy of medicines, adverse reactions, and issuing warnings on such matters, along with harmonising the functions of local centres and sentinel centres, managing the national database and representing Guatemala at the World Health Organization ('WHO');
  • local centres which may be hospitals or other places which provide health services in Guatemala with a Therapeutic Committee that designates one of its members as a monitor in relation to pharmacovigilance;
  • sentinel centres which are local centres specifically selected to identify, quantify, and evaluate adverse reactions and problems related to medications; and
  • the WHO Collaborating Centre for International Drug Monitoring in Uppsala, Sweden, which is a forum of WHO members that collaborate in relation to drug safety monitoring, and collect and store notifications of suspected adverse drug reactions in a common database; and
  • various regulatory and supervisory authorities responsible for enforcing the regulations discussed.

1.3. Guidelines

There are no local guidelines under Guatemalan Law regarding general privacy and data protection law. Local authorities and individuals are bound to act only according to what is established by law.

Please note that if any guidelines are issued they are not enforceable under Guatemalan law.

1.4. Definitions

Assent: Authorisation or permission granted in documented form by a child that participates in relevant investigations. The assent of children who can understand the explanations given to them is necessary. It is considered that children and young people between the ages of seven and 17 are capable of assenting.

Informed consent: A process by which a subject voluntarily confirms, in written form, their decision to participate or that one of their children, or any other person that they represent, participates in a clinical trial after being duly informed of all aspects of the trial, such as its nature, importance, implications, risks, alternative treatments available, the confidentiality of information, the rights of such persons, and whether procedures, treatments, or devices involved are considered experimental.

Clinical trial: Any investigation or experimental evaluation of a substance, medication, or medical device, through its application to humans that meets any of the following conditions:

• the test subject is assigned in advance to a specific therapeutic strategy, which is not part of the usual clinical practice;
• the decision to prescribe the drugs under investigation is taken together with that of including the subject in the clinical study; and
• diagnostic or follow-up procedures are applied to test subjects that go beyond normal clinical practice.

Genetic information: Information obtained from biological samples, which acquire meaning when associated with the patient's phenotypic information, in this case, their personal and family history, their current medical history, and their response to treatment.

2. Clinical Research and Clinical Trials

As mentioned above in the section on Legislation, the only regulation in Guatemala that specifically addresses data privacy is Ministerial Accord No. 299-2019, establishing the norms for the regulation of clinical trials in humans, the requirements for the development of clinical trials in humans in Guatemala, and the basic ethical principles, including data and privacy issues, that apply to such activities.

2.1. Data collection and retention

There is no general regulation regarding the collection and retention of data, only specific requirements.

In relation to the sample storage of pharmacogenetic studies, the following requirements must be observed and adhered to:

• the conservation systems and a place of conservation of each type of sample;
• the sample storage period in absolute (years since the procurement of the sample) or relative (e.g. with respect to the date of the final report of the clinical study), and if identifiable samples become non-identifiable, the moment of this change must be specified;
• the control of access to samples - for identifiable samples, there must be established security procedures that guarantee limited access, defining the authorised personnel and the access registration system; and
• sample destruction procedures if the patient requests it, where the procedures of action must be indicated according to the type and place of storage of the samples, terms of execution and control documents and their recipients.

In relation to procedures for the management of genetic information, genetic and phenotypic information can be stored, transferred electronically, and used in a way independent of the biological sample from which such information comes. It is necessary to make the considerations specific to genetic information, similar to considerations for biological samples.

Storage Systems, Control, and Custody of Data

In relation to the duration of information storage, when identifiable information is being stored, it can only be maintained as long as necessary to achieve the established objectives, unless an additional term is set and the donor assents to it. However, at any time the data subject may request that the obtaining of new information from their samples be stopped.

If it is non-identifiable information (dissociated or anonymous information), the indefinite storage of such information does not give rise to a violation. In such cases, the data subject to which this information relates cannot limit the use, or request the removal, of such anonymised information/data.

In cases concerning the transfer and use by third parties, such transfers and usage can only be done with the express authorisation of the data subject, either from the outset of the study or at the time when the data transfer becomes necessary. The data subject will receive information related to this transfer (including, the identification of third parties, objectives of the transfer, possible transactions, etc.). In any case, patient confidentiality must be guaranteed. In such circumstances, the anonymisation of information is most appropriate.

2.2. Consent

Participation in research must be voluntary. The research subject/participant in an investigation, or their representative, may revoke their consent at any time, without having to provide an explanation and without implying any responsibility or liability of, or prejudice to, the subject.

Clinical research and clinical trial can only be initiated when its research protocol has been authorised by the DRCPFA and, under the conditions described, ensuring that the informed consent of each of the test subjects is freely expressed, obtained, and documented, before its inclusion in the terms provided in Chapter III of the Decree.

Informed consent has to be documented. Any such documentation must be written clearly, in simple and understandable language free from technical terminology, so that the subject/participant may easily understand it. It must have all its pages numbered, and the version and date of such document must be indicated. If there are language or other communication barriers, the informed consent must be offered in the participant's native language.

The content and elements of informed consent include:

• the presentation of the research, which must indicate the title of the investigation, name of the sponsor, name of the researcher, address, and telephone number;
• the introduction, which must indicate what the clinical trial is about;
• the purpose of the study, which must clearly indicate what the contributions of the study will be, and how they relate to the scientific research and the study's objectives;
• the description of the process that participants will undergo, which must detail the treatment, associated procedures to the study (principally invasive ones), the product to be used, side effects, adverse reactions, responsibilities of participants, the number of participants, the locations where the study will be performed, whether the samples will be sent to a foreign country, and the duration of the participation;
• if applicable, data subject's separate authorisation for the samples to be stored for a certain period of time after the clinical trial has concluded, as stipulated in the protocol or consent report;
• any previous experimental and clinical experience with the product and the result of these experiences must be shared with prospective participants; and
• information about the likely discomfort and risk that could be expected by participants - participants should also be informed that it is possible that unknown side effects and discomfort may also occur.

The rules contemplate exceptional cases, including cases where, due to the urgency of the application of the treatment, it is not possible to have the consent of the subject or their representative at the time of their inclusion in the clinical trial. Any such situation must be reported to the relevant research ethics committee and to the sponsor, by the researcher, for their supervision, explaining the reasons they have proceeded without consent.

This situation must be foreseen in the clinical trial protocol approved by the corresponding research ethics committee and will only proceed when it has a particular therapeutic interest for the patient. The subject or their representative and witness will be informed as soon as possible and their informed consent to the continuation in the trial should be sought. This refers to the exceptional cases which the norm identifies where there is an urgency for the application of the treatment and it is not possible to obtain consent from the patient or their representative at the time of the patient's inclusion in the clinical trial.

Informed consent can be revoked by the research subject/participant, or their representatives at any time, without explanation of reasons, and without implying any responsibility or liability of, or prejudice to, the research subject/participant.

The revocation of consent will not retrospectively affect the activities carried out, or the data obtained, prior to the withdrawal of consent. At the same time, neither the data nor the samples obtained on the basis of such consent may be used in the analysis or studies after the withdrawal date, unless further consent has been obtained to make use of them later or, if the purpose is legitimate, information can be obtained from sources accessible to the public.

In the case of minors, the person exercising their legal representation will be responsible for giving informed consent and signing the necessary documentation. In extraordinary cases of non-therapeutic investigations involving minors or persons with diminished legal competence/capacity, measures will be taken that are necessary to avoid the possible exploitation of any such persons and the damage to their health. The assent of minors who have the appropriate maturity or age must be sought in order for such persons to participate in the study. According to the WHO, the assent of minors of the age of seven and above must be sought. If the minor does not agree, the study will not be performed even if the parents have consented.

If, during the clinical trial, the minor reaches majority and is thus able to offer their informed consent, their express informed consent must be obtained before their participation in the clinical trial may continue.

In the case of a person who is legally incapacitated on account of their mental health or a state of interdiction, a legal representative must consent and sign the informed consent documentation on behalf of the participant, after having been informed about the likely risks, discomfort, and benefits of the clinical trial. The scope of the research must be explained to the participant to the extent of their ability to understand.

2.3. Data obtained from third parties

A clinical trial with blind evaluation by third parties is a clinical trial in which subject, researcher, and sponsor are ignorant as to the treatment received. To evaluate their response to any such treatment, a third party is involved who is unaware of the treatment each subject is receiving.

Regarding Sample Storage of Pharmacogenetic Studies

In relation to the analysis of samples by third parties, in cases where genetic determinations are made by entities other than those authorised to obtain and store study samples, such third party analysis must adhere to the objectives of the study, and the conditions upon which the informed consent of research subjects was obtained. The study sponsor must ensure that all patient confidentiality protection requirements are assumed and accepted by third parties to whom the samples are transferred.

In cases of transfers of samples to third parties, if such a transfer is made under the terms established in the objectives of the study the patient must be informed.

In case where samples are transferred and used by third parties, it can only be done with the express authorisation of the research subject, either from the initial moment of the study or when most convenient during the course of the study. The research subjects must be provided with information related to any such transfer (including the identification of third parties, objectives of the transfer, possible transactions, etc). In any event, donor confidentiality must be guaranteed. In such cases, the anonymisation of information is most appropriate.

3. Pharmacovigilance

Authorised pharmaceuticals manufacturing companies are the entities obliged to provide to government authorities all the information regarding the benefits and risks associated with any of their medications. Therefore, every authorised pharmaceuticals manufacturing company is obliged to hire a permanent post-holder responsible for pharmacovigilance.

The post-holder responsible for pharmacovigilance at pharmaceutical manufacturing companies is responsible for:

• creating and maintaining a system to collect, treat, and evaluate information on all suspected adverse reactions reported to company personnel and medical visitors;
• preparing and submitting under the Program the safety reports of all suspected adverse reactions, which must include a scientific assessment of the benefits and risks associated with the medication;
• ensuring that they respond quickly and completely to any request for additional information about the Program, necessary to assess the benefits and risks of medication; and
• providing the coordinating center with any other information of interest for the evaluation of benefits and risks associated with a medication, including information on post-authorisation safety studies.

There is no specific regulation regarding the pseudonymisation/anonymisation of data or data retention; there is only the obligation to notify the respective authorities via the post-holder responsible for pharmacovigilance.

4. Biobanking

Ministerial Accord No. 299-2019 does contemplate the existence of authorised biobanks. However, Guatemalan law does not contemplate any specific regulation of their creation and operation.

Biobanks are subject to all privacy and data protection related provisions of Ministerial Accord No. 299-2019 in so far as clinical research and trials involving human subjects.

5. Data Management

As noted earlier (see section on Governing Texts above), Guatemala does not have a data protection law, meaning that there is no general regulation regarding data management, data controller obligations, permitted uses of data, data security requirements, anonymisation or pseudonymisation, record keeping, and other related matters.

With regard to healthcare practitioners, in accordance with Decree No. 17-73 on the Criminal Code (only available in Spanish here) and the Deontological Code Honour Court College of Physicians and Surgeons of Guatemala (only available in Spanish here), healthcare practitioners are obliged to keep confidential all information related to the patient, information that falls within their professional confidentiality, this obligation is extended to any third person, including family, with exception to minors. Only in specific regulated cases, such as further to a judicial order, or for crime prevention, may confidentiality be lifted.

6. Outsourcing

Not applicable.

7. Data Transfers

There is no general regulation regarding data transfers. There are only some requirements for data transfers in the norms for the regulation of clinical trials in humans, which are described in the section on Clinical Research and Clinical Trials above.

8. Breach Notification

Not applicable.

9. Data Subject Rights

Not applicable.

10. Penalties

Not applicable.

11. Other Areas of Interest

Not applicable.

Gabriela Gandara Director
[email protected]
Dentons Muñoz, Guatemala City