Privacy & Information Security Law Blog

On January 23, 2019, the European Data Protection Board (“EDPB”) released an opinion on the interplay between the European Clinical Trials Regulation (“CTR”) and the EU General Data Protection Regulation (“GDPR”) (the “Opinion”). The Opinion was requested by the European Commission Directorate-General for Health and Food Safety (“DG SANTE”).

The CTR intends to harmonize the assessment and supervision of clinical trials throughout the EU and introduces a Clinical Trials Information System, along with rules on the protection of individuals and increased transparency requirements. The CTR is estimated to enter into force in 2020.

In the Opinion, the EDPB provides guidance on (1) the legal bases for processing personal data in the course of a clinical trial protocol and (2) secondary uses of clinical trial data outside the clinical trial protocol for scientific purposes.

Key takeaways from the Opinion include:

Processing Personal Data in the Course of a Clinical Trial Protocol

• All processing operations related to a specific clinical trial protocol, from the commencement of the trial to the deletion of data at the end of the archiving period, are considered to be primary uses of clinical trial data.
• For primary uses of clinical trial data, the EDPB considers processing activities as falling into one of two main categories — (1) processing operations related to the protection of health and setting standards of quality and safety for medicinal products by generating reliable and robust data (“Safety and Reliability Purposes”) and (2) processing operations related to research activities only (“Pure Research Activity Purposes”).
• Regarding processing activities provided by the CTR and relevant national legislation related to Safety and Reliability Purposes, the EDPB concludes the appropriate legal basis for such processing is Article 6(1)(c) of the GDPR (processing necessary for compliance with a legal obligation to which the controller is subject) and, with respect to processing special categories of data, Article 9(2)(i) of the GDPR (processing necessary for reasons of public interest in the area of public health).
• The EDPB notes that processing operations related to Pure Research Activity Purposes may fall under Article 6(1)(a) in conjunction with Article (9)(2)(a) of the GDPR (explicit consent), Article 6(1)(e) (performance of a task carried out in the public interest) or Article 6(1)(f) in conjunction with Article 9(2)(i) or (j) (legitimate interests of the controller in conjunction with the processing being necessary for reasons of public interest in the area of public health or necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes).
• With respect to consent for Pure Research Activity Purposes, the Opinion makes clear that informed consent under the CTR must not be confused with consent to process data under the GDPR and controllers who wish to use this basis must ensure that they meet all GDPR requirements for consent, with particular attention to the “freely given” aspect of the requirements.
• Withdrawal of consent applies in clinical trials as it would in the context of any other processing operation relying on consent. Withdrawal of consent in clinical trials will not, however, affect processing operations authorized on other grounds, including, in particular, processing for Safety and Reliability Purposes which are based on Article 6(1)(c) of the GDPR.

Secondary Uses of Clinical Trial Data Outside the Clinical Trial Protocol for Scientific Purposes

• Regarding secondary uses of clinical trial data for scientific purposes, Article 28(2) of the CTR notes that at the time a clinical trial subject gives informed consent to participate in a clinical trial, the sponsor may ask for consent to the use of the subject’s data outside the protocol of the clinical trial, exclusively for scientific purposes. Such consent is not considered the same as consent for processing personal data under the GDPR. If a sponsor or investigator would like to make further use of personal data for any scientific purpose other than those defined in the clinical trial protocol, doing so requires another specific legal basis for the secondary purpose. The chosen legal ground may be the same or different from the legal basis of the primary use.
• The EDPB further comments that the presumption of compatibility provided under Article 5(1)(b) of the GDPR should not be excluded from the secondary use of clinical trial data for scientific purposes. In other words, where the secondary use of the clinical trial data for scientific purposes is compatible with the original purpose, the controller may be able to further process such data without recourse to a new legal basis.