In its opinion of 23 January 2019 (the "Opinion"), the European Data Protection Board ("EDPB") clarifies the interplay between Clinical Trial Regulation 536/2014 (the "CTR") and the General Data Protection Regulation ("GDPR"). In particular, the EDPB provides guidance on the legal basis for (i) the use of personal data in the context of the clinical trial protocol and (ii) the secondary use of clinical data outside the clinical trial protocol for scientific purposes. The Opinion was requested by the European Commission for its Q & A on the interplay between the CTR and the GDPR.
The entry into force of the CTR depends on the development of the EU clinical trial portal and database. When it starts to apply, the CTR will replace current Directive 2001/20/EC. The simultaneous application of the CTR and the GDPR causes practical difficulties for companies and researchers, including the questions of when and for what purposes consent is required. The EDPB explains that 'informed consent' under the CTR is different and distinct from the consent that may be required under the GDPR.
Under the GDPR, consent is one of various options ('legal bases') permitting the processing of personal data. By contrast, to determine the appropriate legal basis for clinical trial data, the Opinion distinguishes between the processing of personal data in the course of the clinical trial protocol (primary use) and various secondary uses of clinical trial data outside the clinical trial protocol for scientific purposes.
The EDPB explains that within the primary use of clinical trial data, not all processing operations fall under the same legal basis. As regards the data that are used for reliability and safety purposes, the Opinion explains that such processing must be based on the requirement to comply with legal obligations to which the controller is subject (Article 6(1)(c) of the GDPR), or the regime governing categories of sensitive data (Article 9(2)(a) of the GDPR).
On the other hand, the EDPB suggests that the processing that is purely related to research activities can either be based on the explicit consent of the data subjects, or as an alternative option, the necessity to perform a task carried out in the public interest or the legitimate interest of the controller. In the case of sensitive data, the processing should be based on the necessity for the processing in view of the public interest in the area of public health (Article 9(2)(i) of the GDPR) or scientific purposes based on Union or Member State law (Article 9(2)(j) of the GDPR). The controllers therefore have a choice, depending on the facts at hand, which they have to consider when setting up their clinical trial and organise their processing activities accordingly.
Clinical trial data is increasingly used for secondary purposes that fall outside the clinical trial protocol. For such uses, Article 28(2) of the CTR requires consent. The EDPB explains that the consent that is required under the CTR offers a safeguard under that specific regulatory framework, and is not the same as consent referred to in the GDPR as one of the legal bases. The EDPB does not offer a conclusive solution as regards the legal basis for secondary uses, but indicates that controllers may be able to rely on the presumption of compatibility under Article 5(1)(b) of the GDPR. This means that if the secondary use is deemed compatible with the primary (clinical trial) purpose, the data can be further processed without the need for a new legal basis.
The EDPB thus recommends that the European Commission should update its guidance in line with the above principles.
Determining the applicable legal basis is an important preliminary step when setting up a clinical trial and it is strongly recommended that controllers in clinical trials should document this assessment on the basis of the EDPB guidance. The content of the trial documentation, including the protocol and the informed consent form, will depend on this assessment.
A copy of the Opinion can be found here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.