Feb 72019

EDPB Adopts Opinion on Interplay Between the EU Clinical Trials Regulation and the GDPR

William RM Long, Francesca Blythe and Jasmine Agyekum
, , , ,

On 23 January 2019, the European Data Protection Board (EDPB) adopted an opinion on the interplay between the EU Clinical Trials Regulation (CTR) and the EU General Data Protection Regulation (GDPR). The Opinion addresses the appropriate legal basis for the processing of personal data in the context of clinical trials (primary use), and the secondary use of clinical trial data.

Legal basis for the processing of personal data in a clinical trial (primary use)

The Opinion states that for processing related to reliability and safety purposes (e.g., safety reporting, archiving of the clinical trial master file, and disclosure of clinical trial data to national competent authorities) the relevant legal ground under Article 6 of the GDPR to process such data is compliance with a legal obligation. In addition, a derogation under Article 9 of the GDPR to permit the processing of health data is required, which would be where the processing is necessary for reasons of substantial public interest in the area of public health.

However, the legal obligation ground is not available for operations purely related to clinical research activities. For such activities the EDPB suggests one of the three following legal grounds under Article 6 of the GDPR.

  • Explicit consent of the data subject – The EDPB states that informed consent under the CTR should not be confused with the idea of consent as a legal ground under the GDPR.  Rather, for a controller (e.g., a clinical trial sponsor) to rely on consent under the GDPR, it must ensure that all conditions in the Working Party 29 Guidelines on Consent are met. In particular, sponsors should ensure the consent is freely given (i.e., the study subject has a genuine choice and there is no clear imbalance between the study subject and the controller). Notably, the EDPB considers there to be a clear imbalance of power where the study subject is not in good health. In addition, the EDPB reiterates the position under the Guidelines that where a study subject withdraws their consent to processing, all research activities carried out with the clinical trial data on the basis of consent should cease. For these reasons, the EDPB does not consider that consent under the GDPR will be an appropriate legal ground in most cases and where relied upon a careful assessment should first be carried out.
  • Task carried out in the public interest – An alternative legal ground is performance of a task carried out in the public interests when the clinical trial falls within the tasks vested in a public or private body by national law (e.g., public authorities and universities). However, this legal ground is unlikely to be relevant for a commercial company and/or charitable research organisations.
  • Legitimate interests – The EDPB states that where not in the public interest an alternative legal ground for processing clinical trial data is where it is in the legitimate interests of sponsor – although, a legitimate interest assessment should still be undertaken and documented. Depending on the specific circumstances, the most relevant derogation under Article 9 of the GDPR to permit processing of health data would be either where the processing is necessary for reasons of substantial public interest in the area of public health, or where the processing is necessary for scientific research purposes in accordance with Article 89(1) of the GDPR.

Secondary uses of clinical trial data for scientific purposes

The EDPB states that where personal data are further processed for scientific research purposes, other than those purposes defined in the clinical trial protocol, then these secondary uses shall not be considered incompatible provided that the processing is subject to appropriate safeguards which ensure technical and organisational measures are in place—and in particular to comply with the principle of data minimisation. In such a case, further processing will be permitted without the need for a new legal basis.

Conclusion

The Opinion is helpful in that it provides some much needed clarity in what has been a very uncertain area since implementation of the GDPR. What does remain to be seen is how ethics committees will respond to the Opinion and, in particular, the view that consent is in most cases not an appropriate legal ground for the purposes of the GDPR in the context of clinical trial activities.

In terms of what sponsors should do next, we recommend the legal grounds relied on in the context of their clinical trial activities be carefully reviewed. Where necessary, this may involve reviewing clinical trial protocols, reviewing and updating informed consent forms and undertaking legitimate interest assessments as well as other GDPR actions.

William RM Long

London

wlong@sidley.com

Francesca Blythe

London

fblythe@sidley.com

Jasmine Agyekum

jagyekum@sidley.com

You might also like
UK Sets Out It’s “Pro-Innovation” Approach To AI Regulation

On 29 March 2023, the UK’s Department for Science Innovation and Technology (“DSIT”) published its long awaited White Paper on its “pro-innovation approach to AI regulation” (the “White Paper”), along with a corresponding impact assessment. The White Paper builds on the “proportionate, light touch and forward-looking” approach to AI regulation set out in the policy paper published in July 2022. Importantly, the UK has decided to take a different approach to regulating AI compared to the EU, opting for a decentralised sector-specific approach, with no new legislation expected at this time. Instead, the UK will regulate AI primarily through sector-specific, principles based guidance and existing laws, with an emphasis on an agile and innovation-friendly approach. This is in significant contrast to the EU’s proposed AI Act which is a standalone piece of horizontal legislation regulating all AI systems, irrespective of industry.

How the China Personal Information Protection Law Applies to Foreign Asset Managers

Since China’s Personal Information Protection Law (PIPL) came into effect in November 2021, there has been widespread uncertainty amongst offshore fund managers and investors with entities outside Mainland China as to how and whether the regime applies to them. Given the potential for foreign asset managers to overlook or misinterpret PIPL, this brief update outlines some guidance as to how PIPL can apply, and to whom, in a practical context.

EU Moving Closer to an AI Act – Key Areas of Impact for Life Sciences/MedTech Companies

The European Union is moving closer to adopting the first major legislation to horizontally regulate artificial intelligence. Today, the European Parliament (Parliament) reached a provisional agreement on its internal position on the draft Artificial Intelligence Regulation (AI Act). The text will be adopted by Parliament committees in the coming weeks and by the Parliament plenary in June. The plenary adoption will trigger the next legislative step of trilogue negotiations with the European Council to agree on a final text. Once adopted, according to the text, the AI Act will become applicable 24 months after its entry into force (or 36 months according to the Council’s position), which is currently expected in the second half of 2025, at the earliest.