Social Media Monitoring Privacy Notice

Scope

Alnylam Switzerland GmbH , together with its Affiliates (‘Alnylam’, ‘we’, ‘our’, or ‘us’) wants to understand how social media users discuss about diseases and medicinal products and services relevant to the Alnylam brand, so that we can take into account the needs of the general public in our communications and business plans. From time to time, we analyse social media activity related to our brand and monitor the use of our own social media channels. The conclusions drawn from the analysis will help shape Alnylam’s business plans and communication strategy. Alnylam is strongly committed to protecting your privacy, and will make all reasonable efforts to protect your personal data (“Personal Data”) in accordance with applicable data protection laws and regulations and this Privacy Notice (the “Notice”).

Data Controller and Data Protection Officer (“DPO”)

Alnylam is the Data Controller for the processing of Your Personal Data for the purposes of this Notice. You can find more information on Alnylam affiliates in Europe and worldwide as well as their establishment and contact details here: http://www.alnylam.com/contact-us/

Our Alnylam EU Privacy Office and the designated Data Protection Officer (DPO) can be contacted by email at: eudataprivacy@alnylam.com

Personal Data Alnylam Collects and Source

We monitor publicly available media including social media data, using commercially available media monitoring tools. The data we obtain from monitoring efforts is used to better understand public discussions and needs regarding diseases and medicinal products and services relevant to Alnylam brand.

We use an external service provider to process and analyse public social media data (social media monitoring activities) on our behalf and according to our documented instructions, in compliance with applicable laws and regulations.

To carry out the processing, Alnylam may use for example, commercially available social media monitoring tools such as the one provided by Sprinklr, Inc. a US-based company with offices at 29 West 35th Street, New York, NY 10001, USA; please review Sprinklr’s privacy policy to understand how Sprinklr collects and processes your personal data: https://www.sprinklr.com/privacy

Processed data may include the following categories of personal information:

  • Identification data (name, username, user identification and geographical area);
  • personal characteristics (age, gender and family status);
  • consumer habits;
  • hobbies and interests;
  • professional and educational background;
  • pictures and videos;
  • any other information published on a website that is analysed or on a third-party platform.

The external provider collects, analyses and monitors through media monitoring tools data from public posts (conversation streams and publicly available opinions, statements or other interactions and content) by social media users on different social media channels (such as Instagram and Facebook), and tracks different online sources including forums, blogs and online news websites.

The data gathered through the media monitoring tools may include social media handles and content from posts which are exclusively made publicly available by the social media users themselves.

The data collected by the service provider via the media monitoring tools is used to create insight reports, which are then shared with Alnylam. These reports aim to gain insights in conversation trends over a specified period of time and not to identify specific individuals.

Insight reports will be anonymized and will not include any personal data gathered from media monitoring. However, individual quotes with personal information may be captured as examples and used to describe the general attitude towards Alnylam in social media and/or for monitoring/audit purposes. These quotes will be limited to those of individuals who publish posts about the Alnylam in their professional capacity (e.g. HCPs or representatives of patients’ associations) or those of patients’ ambassadors.

We do not actively collect sensitive personal data, but we may process such data in monitoring social media, where such data is included in social media posts solely for purposes linked to safety and quality surveillance and reporting as required by applicable laws and regulations.

We have set up strict limitations on the topics we monitor and have ensured that our personnel, when accessing and using the external’s provider’s database, is bound by clearly documented instructions and confidentiality obligations.

Lawfulness of Processing

The lawful basis for processing your Personal Data is Alnylam’s legitimate interests to protect its assets and its brand on social media, by gaining insights in conversation trends over a specified period, to the extent these interests are not outweighed by the rights and freedoms of the data subjects concerned.

To the extent that we will need to collect regular or sensitive data for safety surveillance and reporting purposes, as mentioned above, the lawful basis for that processing is that:

  • the processing is necessary for compliance with a legal obligation to which the data controller (Alnylam) is subject;
  • the processing relates to personal data which are manifestly made public by the data subject; and
  • the processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
Purpose(s) of Processing

Alnylam processes Personal Data for the following purposes:

 
  • To identify and assess what is being said about Alnylam and its products and services on publicly accessible social media content to understand sentiment, intent, mood and market trends and the public’s needs and thereby improve our services and take into account the needs of the general public in our communications; and
  • To measure the effectiveness of Alnylam’s communications strategy.

Alnylam shall use the Personal Data only for the purposes specified in this section.

Recipients of Your Personal Data

Any Personal Data retrieved from media monitoring tools will be retained and stored on the external service provider’s IT systems and applications and will not be downloaded into Alnylam IT systems.

Insight reports and/or Personal Data may be shared internally with other Alnylam affiliates worldwide. Insight reports will be anonymized and will not capture any personal data gathered from media monitoring. Anonymized reports will be stored on a secure collaborative platform which is owned and managed by our external service provider.

Where insight reports and/or personal data may be shared with recipients located in third countries, Alnylam will ensure that all appropriate safeguards are in place and that all applicable laws and regulations are complied with in connection with such cross-border data transfers; in the absence of any adequacy decision, Alnylam relies, in particular, on the execution of the appropriate EU standard contractual clauses for data controllers and processors, as adopted by the European Commission, to ensure an adequate or substantially equivalent level of data protection when transferring personal data to other member companies of the Alnylam Group (including in the United States and the United Kingdom), as well as with respect to data transfers made to service providers, acting on behalf of and for Alnylam and other Alnylam partners located in third countries. In adopting the appropriate safeguards, Alnylam will also implement any supplementary measures that may be required by legislative or regulatory authorities, or that may be deemed necessary, to ensure an adequate or substantially equivalent level of data protection with respect to the transferred data, taking into account the factual circumstances of the transfer in question.

Retention

Personal data will only be stored as long as necessary to fulfil the purposes and respective obligations related to such data, for which it was collected, subject to local laws and regulations and legitimate business needs in accordance with Alnylam internal policies.

The external service provider will retain identifiable personal information that is downloaded from search monitoring tools in order to compile the insight reports.

Data gathered by our external service provider will be stored according to the service provider’s retention policies and also to Alnylam’s policies and documented instructions.

All downloaded identifiable data will be reviewed on an annual basis and deleted if no longer serves the original purpose of collection and processing. Τhe external provider will delete the results of the searches, as well as automatic backups after the end of the respective contract with Alnylam.

Produced insight reports will not include any personal data. Insight reports will be stored for a maximum of five years and will then be destroyed/deleted.

Automated decision-making

Data may have been subject to automated decision-making by the media monitoring tools to identify it as falling within a particular search description.

How Alnylam protects your Personal Data

Alnylam will take reasonable and appropriate physical, administrative and technical safeguards to protect the processing of the Personal Data from loss, misuse, unauthorized access, disclosure, alteration or destruction. In this perspective, the data may be used only by Alnylam’s personnel who need it because of their job or hierarchical position, with confidentiality obligations, which have been assigned a specific role and which have been given appropriate operating instructions.

Your Rights and how to exercise them

Individuals in the EU have certain data subject rights which may be subject to limitations and/or restrictions:

  • You have the right to object to the processing of your personal data.
  • You have the right to request information about how your personal data is processed, and to request a copy of that personal data.
  • You have the right to request that any inaccuracies in your personal data are rectified without delay.
  • You have the right to request that any incomplete personal data is completed, including by means of a supplementary statement.
  • You have the right to request that your personal data is erased if there is no longer a justification for them to be processed.
  • You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
  • You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

If you wish to exercise one of the above-mentioned rights, please refer to the “How to Reach Us” section below.

If you do not receive a (timely) response from Alnylam or if you are not satisfied with our response to you, you also have the right to lodge a complaint about the processing of your Personal Data with the appropriate national data protection supervisory authority; a list of the national data protection supervisory authorities in Europe can be found here: https://edpb.europa.eu/about-edpb/board/members_en

Further information and Contact details

For additional information on how Alnylam collects and processes your Personal Data please visit our Privacy website available here: https://alnylampolicies.com/

The contact details of the data controller are:
Alnylam Switzerland GmbH:
Grafenauweg 4, 6300 Zug, Switzerland
info@alnylam.com
+41 41 561 3500

To exercise your rights or to request additional information, you may contact our EU Privacy Office and Data Protection Officer by email at eudataprivacy@alnylam.com or in writing at the address below:

EU Privacy Office: 
ALNYLAM Switzerland GmbH
  Attention: Legal department 
Address: Grafenauweg 4,6300 Zug, Switzerland
Tel: +41 41 561 3500

Please note that you can also fill out this data subject request form.

Complaints

If you consider that your personal data has been misused or mishandled, you may also submit a complaint to the Federal Data Protection and Information Commissioner (FDPIC); the FDPIC can be contacted at:

Federal Data Protection and Information Commissioner:
Feldeggweg 1, CH – 3003, Berne
+41 (0)58 462 43 95
info@edoeb.admin.ch

Any complaint to the Federal Data Protection and Information Commissioner is without prejudice to your right to seek redress through the courts.

You may also contact, if you are an EU/EEA resident, the competent data protection authority of your country of residence or place of work; Information and contact details of the competent authorities is available on the EDPB’s website at Members | European Data Protection Board (europa.eu).