April 1, 2019

Personal Data: new interpretative recommendations in Clinical Trials

On January 23, 2019, the European Data Protection Board (EDPB) published an opinion on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection Regulation (GDPR) regarding the processing of clinical trial data.

The legislations provided by the CTR and the GDPR apply simultaneously in the context of clinical trials. The European Commission has therefore consulted the EDPB in order to clarify the interaction and coordination between the two legislations (Opinion 3/2019). In this context, the EDPB’s indications are useful for those interested in conducting a clinical trial in order to fully comply with the regulatory provisions, in light of the effective implementation of the CTR, expected starting 2020, following the preparation of the portal and the database of clinical trials in the EU.

In the Opinion 3/2019, the EDPB focused on identifying the appropriate legal basis for all processing operations of patient data during clinical trials (primary use) and for any processing of the clinical trial data for other scientific purposes (secondary use), also identifying cases where the participant’s consent may not be necessary.

It is, however, necessary to specify that the indications issued by the EDPB must be integrated into the national legislation on the processing of health data (adopted pursuant to Article 9, paragraph 4 of the GDPR), and in particular with the provisions of Article 2-septies of the amended Data Protection Code, based on which the Italian Data Protection Authority (Garante) adopts further warranty measures. In this regard, the Garante’s draft resolution issued on December 13, 2018 (subject to public consultation), identified the provisions of the Garante’s previous general authorizations that seem to be compatible with the GDPR. Moreover, it is advisable to consider Article 110-bis of the amended Data Protection Code, which requires the Garante’s authorization in the event that further processing for scientific purposes is carried out by third parties, other than the data controller who processed the data for primary use.

Primary use of personal data: processing in the course of the clinical trial protocol

In the context of primary use, the EDPB considered it appropriate to distinguish two main types of processing: operations related to reliability and safety purposes and those carried out specifically for research activities in relation to clinical trials.

In the first case, the EDPB identified Article 6(1)(c) of the GDPR as the legal basis for the processing of data related to reliability and safety purposes. It consists of the requirement for the data controller to comply with legal requirements, such as drafting safety reports, filing data in the clinical trial files, communication data to the competent authorities, among other things. The corresponding legal basis for the processing of special categories of data, including those relating to health, is Article 9(2)(i) of the GDPR, which refers to the need for processing, “for reasons of public interest in the area of public health, such as […] ensuring high standards of quality and safety of health care and of medicinal products or medicinal devices.”

As mentioned above, the legal basis for the processing of data carried out specifically for research activities in the field of clinical trials varies. In this case, according to the specific circumstances of the clinical trial, data processing can be based on the explicit consent given by the subject concerned or can relate to a different legal basis as explained below.

The critical points of consent as the legal basis for data processing

The requirement for participants’ informed consent is provided for by the CTR and the GDPR, but with varying logic and purposes. The informed consent required by the CTR aims to safeguard human dignity and the integrity of the person, while explicit consent from the perspective of the GDPR is necessary as a prerequisite for the processing of data, including health data. According to the GDPR, consent shall be explicit, freely given, specific, informed and unambiguous. In particular, since consent shall be given freely, the person concerned shall be guaranteed a real and true choice.

However, in the context of clinical trials, it would be contradictory if a subject gave consent to attend the trial for the purposes of the CTR and, at the same time, denied consent for the processing of personal data, thus making it impossible to attend the clinical trial (which undoubtedly involves the processing of the patient’s personal data). In this respect, it is unlikely that the participant’s consent would meet the requirements of the GDPR, in particular regarding the requirement that the consent is “freely given”.

Moreover, the EDPB also has doubts as to whether consent can be a valid legal basis in situations where there is an imbalance of power between the data subject and the controller: for instance, where the participant is not in good health or the participant belongs to economically or socially disadvantaged groups, or where there is a situation of institutional or hierarchical dependency.

Therefore, according to the EDPB’s opinion, consent may not be an appropriate legal basis for the processing of participants’ personal data in clinical trials.

Data processing with an alternative legal basis to consent

In light of the concerns surrounding free consent in the context of clinical trials, it seems preferable for the controller to adopt an alternative legal basis.

In particular, the EDPB suggests the following legal bases:

(i) Article 6(1)(e) of the GDPR, when the “processing is necessary for the performance of a task carried out in the public interest” (for example, where the conduct of a clinical trial falls directly within the mandate, missions and tasks ascribed to a public or private body under national law); or

(ii) Article 6(1)(f) of GDPR, which provides that the processing of data “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”.

However, for processing special categories of data, such as genetic data and health data, the existence of only one of the legal bases provided for in Article 6 is not sufficient, and it is necessary to combine it with one of the legal bases provided for in Article 9 of the GDPR. In particular, the EDPB suggests that, depending on the specific case, either letter (i) which requires the existence of a public interest in the area of public health, or letter (j) which refers to scientific purposes as the objective of the processing, provided that the safeguarding measures set out in Article 89 of the GDPR (such as the pseudonymization of data) are respected.

Therefore, the EDPB confirms that there are legal bases, alternative to consent, for the processing of patient data in the context of clinical trials. Consequently, for the cases in which such legal bases are applicable, consent under the GDPR is not necessary, while informed consent under the CTR remains essential.

Secondary use of clinical trial data for scientific purposes outside the clinical trial protocol

It is possible that data controllers have an interest in processing data outside the clinical trial protocol for which the data was collected. In this case, the CTR requires that the Controller obtains specific consent for the additional purposes.

Under the GDPR, it is necessary to identify a specific legal basis for this additional processing, which may or may not correspond to the legal basis used for the processing of data in the course of clinical trials, that is for primary use. Therefore, where other legal bases cannot be considered applicable to such secondary use, the participant’s consent becomes once again necessary, provided that such consent complies with the requirements of the GDPR (free, specific and informed). In relation to the secondary use of health data used in clinical trials for further scientific research purposes, the EDPB has clarified that it is not possible to exclude, a priori, the presumption of its compatibility with the initial purposes as provided for in Article 5(1)(b) of the GDPR.

In conclusion, it cannot be excluded that the controller may process the data for a different purpose without identifying a new legal basis. Given the complexity of the topic, the EDPB will have to give its opinion on this issue in the future. In the meantime, the Committee does not rule out the application of the presumption of compatibility in the area of clinical trials.

< Back to blog
Welcome to the Portolano Cavallo Life Sciences blog focusing on legal development and key legal issues affecting the life sciences and healthcare industry.
...
Read more
Our highly-ranked team of professionals will provide newsinsights and multidisciplinary commentary on the hottest and most recent regulatory, transactional and contentious aspects of the pharmaceutical, bio-tech, med-tech, food supplement and healthcare world with an eye on its digital transformation and technological developments.

This blog will be a place for focusing on digital health, telemedicine and artificial intelligence, as well as more traditional topics: from the protection of intellectual properties to performance of clinical trials, from the market access to advertising and competition issues, from internal and criminal investigations to M&A and venture capital transactions.

Close
June 6, 2022
The National Coordination Centre for Ethics Committees published new draft agreements for conducting clinical trials on drugs and medical devices
April 27, 2022
EU Medical Device Coordination Group (MDCG) approves “Guidance” on the borderline between medical devices and medicinal products in order to support the uniform application of Regulation...
April 5, 2022
Electronic prescriptions: the current modalities of transmission from doctors to patients and from patients to pharmacies are extended until 31st December 2022
March 24, 2022
EU Medical Device Coordination Group (MDCG) approves “Guidance” on appropriate surveillance of devices covered by certificates according to the MD Directives, under the transitional prov...
March 21, 2022
Published Decree of Health Ministry identifying the ethics committees of national significance for clinical trials of medicinal products and medical devices
Search by...
Search
Follow us on
Follow us on