Feb 182021

European Medicines Agency Issues Updated Good Clinical Practice Q&A

William RM Long, Francesca Blythe, Olivier Goarnisson and Josefine Sommer
, , ,

On February 17, 2021 the European Medicines Agency (EMA) published an updated version of its good clinical practice questions and answers (GCP Q&A).  The updated section relates to access to patient medical records by GCP inspectors from European Economic Area (EEA) Member States.  It stresses the importance of sponsors conducting studies in countries outside the EEA obtaining the prior explicit consent of a clinical trial participant for the review of their medical records by EEA GCP inspectors.

GCP requires, inter alia, that sponsors of clinical trials carefully collect and report data in an ethical, accurate and complete manner.  When collecting and reporting such data, the sponsor should take into account ethical considerations and all applicable laws and regulations, including data protection legislation. The sponsor is furthermore required to verify and control the accuracy and completeness of the data collected by itself or its third-party vendors. GCP inspectors may wish to check that the sponsor has fulfilled this oversight role as well as confirm the accuracy of the information recorded in the clinical trial participants’ medical files. For outsourced activities, the sponsor must therefore ensure agreement from relevant third parties to ensure that regulatory authorities have direct access to all trial related sites, source data/documents, and reports for the purpose of an inspection.

According to the GCP Q&A:

    • Sites in the EEA – it is not strictly necessary to obtain the explicit consent of the clinical trial participant as GCP inspectors have legal authority to access the medical records and other personal data. From a data protection perspective, the sharing of this personal data with the GCP inspectors would therefore be made in reliance on a legal obligation to which the sponsor is subject (i.e., Article 6(1)(c) of the GDPR). Likewise, the GCP Q&A confirms that the inspectors would rely on the public interest legal ground under the GDPR (i.e., Article 6(1)(e)). However, sponsors would still be required to inform the clinical trial participant of this access, i.e., in the informed consent form (ICF), to meet their transparency obligations under the GDPR; and
    • Sites outside the EEA – sponsors must obtain the explicit consent of the clinical trial participant in the ICF. The consent obtained must grant GCP inspectors access to the medical records and other personal data of the clinical trial participant. Further, should sponsors choose to include more generic wording in the ICF such as, “regulatory authorities from foreign countries”, then they must confirm in advance with the principal investigator for the clinical trial that such wording would not prevent GCP inspectors from accessing the data – including, from a data protection perspective.

Sponsors who cannot provide full access to patients’ medical records during GCP inspections could be found in non-compliance with GCP requirements. Sponsors are therefore advised to consider necessary amendments to their ICF template to include prior notification to clinical trial participants about GCP inspectors’ potential access to their medical files.

William RM Long

London

wlong@sidley.com

Francesca Blythe

London

fblythe@sidley.com

Olivier Goarnisson

Geneva

ogoarnisson@sidley.com

Josefine Sommer

Brussels

jsommer@sidley.com

You might also like
UK Sets Out It’s “Pro-Innovation” Approach To AI Regulation

On 29 March 2023, the UK’s Department for Science Innovation and Technology (“DSIT”) published its long awaited White Paper on its “pro-innovation approach to AI regulation” (the “White Paper”), along with a corresponding impact assessment. The White Paper builds on the “proportionate, light touch and forward-looking” approach to AI regulation set out in the policy paper published in July 2022. Importantly, the UK has decided to take a different approach to regulating AI compared to the EU, opting for a decentralised sector-specific approach, with no new legislation expected at this time. Instead, the UK will regulate AI primarily through sector-specific, principles based guidance and existing laws, with an emphasis on an agile and innovation-friendly approach. This is in significant contrast to the EU’s proposed AI Act which is a standalone piece of horizontal legislation regulating all AI systems, irrespective of industry.

How the China Personal Information Protection Law Applies to Foreign Asset Managers

Since China’s Personal Information Protection Law (PIPL) came into effect in November 2021, there has been widespread uncertainty amongst offshore fund managers and investors with entities outside Mainland China as to how and whether the regime applies to them. Given the potential for foreign asset managers to overlook or misinterpret PIPL, this brief update outlines some guidance as to how PIPL can apply, and to whom, in a practical context.

EU Moving Closer to an AI Act – Key Areas of Impact for Life Sciences/MedTech Companies

The European Union is moving closer to adopting the first major legislation to horizontally regulate artificial intelligence. Today, the European Parliament (Parliament) reached a provisional agreement on its internal position on the draft Artificial Intelligence Regulation (AI Act). The text will be adopted by Parliament committees in the coming weeks and by the Parliament plenary in June. The plenary adoption will trigger the next legislative step of trilogue negotiations with the European Council to agree on a final text. Once adopted, according to the text, the AI Act will become applicable 24 months after its entry into force (or 36 months according to the Council’s position), which is currently expected in the second half of 2025, at the earliest.