The president of the Polish Personal Data Protection Authority (UODO) has requested the cooperation of the Chief Pharmaceutical Inspector (GIF) regarding a possible unlawful transfer of patient data from pharmacy IT systems.

This intervention follows a procedure by the Office of Competition and Consumer Protection (UOKiK) which revealed an information exchange system between pharmacies and wholesalers such as Neuca, Farmacol, and PGF. The system relied on partnership programs and software modules which, integrated into pharmacy IT systems, automatically transmitted data on product sales. Since pharmacy systems process personal data of patients, including health information and the PESEL identification number, a risk of unauthorized transfer of this data to wholesalers was identified.

Given the scale of the phenomenon, with the wholesalers involved representing more than 70% of the market and the programs involving over 4,000 pharmacies, nearly 40% of the market, the case could constitute a systemic violation of the privacy of millions of patients. The president of the UODO has asked the Chief Pharmaceutical Inspector to clarify whether investigations have been conducted on the scope of the data collected, whether transfers of personal data have been observed, or whether controls are planned, emphasizing the urgent nature of the situation.