Merck Serono: patient support website emails used for market research survey invitation (no breach)

📊

Key facts

⌄

Case	AUTH/2522/7/12
Complainant	Member of the public
Company	Merck Serono
Issue	Alleged disclosure of patient data (email address) to a market research agency for a survey invitation
Context	Post-prescription patient support website for Rebif (interferon beta-1a); survey about a walking aid/device for MS patients
Data shared	Email addresses only (760 registered users)
Key controls described	Agency instructed to use emails only for the survey invite and destroy data after completion; agency confirmed deletion/destruction
Applicable Code year	2012
Clauses considered	Clause 1.8, Clause 9.1, Clause 2
Decision	No breach
Complaint received	4 July 2012
Case completed	4 August 2012
Appeal	No appeal

Download the full case report (PDF)

Reviewed by Dr Anzal Qurbain (FFPM) — ABPI Final Signatory

🤖

Got a question about this case?

Ask one of our 13 specialist ABPI advisors — instant answers, 24/7.

Ask AskAnzal AI

🎬 Expert Video Walkthrough

🎬

Video walkthrough — coming for members

Subscribe now and get expert video analysis for every case as we publish them.

Subscribe — from £299/yr

📋

What happened

⌄

A member of the public received an unexpected email from a market research agency inviting her to complete an online survey for Merck Serono about a new walking aid for people with multiple sclerosis (MS).
She believed the agency obtained her details from confidential information she had provided when registering (two years earlier) on a post-prescription patient support website for Rebif (interferon beta-1a).
She said the website included a privacy promise that Merck Serono would not pass patient details to a third party unless required by law, and argued express permission would be needed because it was personal medical data.
Merck Serono said users consented via the website registration process (ticking a box confirming they had read/understood the privacy policy and terms of use and consenting to processing in accordance with the privacy policy).
The survey was commissioned to evaluate a device to help MS patients with mobility issues associated with foot drop.
Merck Serono provided the market research agency with email addresses of registered users (760 addresses). No other user details were provided.
The agency was instructed to use the emails only to send the approved invitation, not to pass data to third parties, and to destroy the data after the survey; the agency confirmed deletion/destruction after dispatch.
Merck Serono updated its privacy policy and stated that in future it would make the first contact and obtain consent before passing details to an independent service provider.

⚖️

Outcome

⌄

No breach of the Code was found.
No breach of Clause 1.8 was ruled (Panel noted Data Protection Act 1998 was potentially relevant, but no evidence was provided that a judicial forum had found a breach of the Act).
No breach of Clause 9.1 was ruled (high standards).
No breach of Clause 2 was ruled.

🔒

Unlock the full case analysis

Members get the complete breakdown — Clauses, Sanction, Signatory Lens, Audit checklist, and 3 Key Questions.

Best value

£249/year

Annual — save £99

£29/mo

Monthly

Join Now — Instant Access

Key facts

What happened

Outcome

Clauses

Unlock the full case analysis

AQP Flagship Path — the complete UK ABPI signatory programme

📰 Weekly PMCPA Case Breakdown