From a data protection point of view, the use and limits of personal data processing in clinical trials is a major issue. For this reason, the European Commission’s Directorate-General for Health and Food Safety has published a Q&A document on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection Regulation (GDPR).
Don’t miss our content
SubscribeFrom a data protection point of view, the use and limits of personal data processing in clinical trials is a major issue. For this reason, the European Commission’s Directorate-General for Health and Food Safety has published a Q&A document on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection Regulation (GDPR). These are our main conclusions:
Legal basis for processing health data: The Commission distinguishes between two processing purposes in the context of clinical trials, each with a different legal base: (i) processing for patient safety purposes (such as safety reporting, archiving and inspections), which is required by the CTR and can thus be covered by a legal obligation; and (ii) processing for scientific research purposes, for which the Commission does not provide a specific legal basis—leaving the decision to the promoters and researchers according to the characteristics of the clinical trial.
Consent: The Commission distinguishes consent for participation in a clinical trial
from consent for the processing of personal data within the context of that clinical trial. If participants withdraw their consent to the processing, the controller must stop the processing and delete the data if there is no other lawful basis such as security purposes.
Further use of research data: The Commission acknowledges that the requirements for further processing (basically, consent to use the data outside the scope of the trial protocol) do not apply when an alternative lawful basis can be invoked. In fact, the Commission stresses that the secondary use of clinical trial data is by default compatible with its original use—in line with the seventeenth additional provision of the Spanish Data Protection and Digital Rights Guarantee Act (Act 3/2018 of December 5, “new LOPD”).
The Commission addresses other relevant issues in the context of clinical trials, such as the specific processing requirements in emergency situations or the fact that GDPR’s restrictions also apply to international transfers of clinical trial data.
Autores: Sergi Gálvez y Jorge Monclús
Don’t miss our content
Subscribe