The European Data Protection Board (EDPB) recently published opinion 3/2019 on the interplay of the Clinical Trials Regulation (CTR) and the General Data Protection Regulation (GDPR). The EDPB advises the European Commission on issues related to the protection of personal data and is composed of all heads of the national EU data protection authorities.
The EDPB opinion on the interplay of CTR and GDPR is mainly concerned with the legal basis of processing 'personal data' in clinical trials, which in the given context will often include the processing of 'special categories of data' (data concerning health, genetic, biometric data, etc.). These data categories are subject to a stricter data protection regime.
Highlights of the ECPB opinion
- The first important point the EDPB makes is that the 'informed consent' under the CTR will have a different qualification compared to the legal processing ground of 'explicit) consent' under the GDPR. The GDPR consent will be more restrictive in most of the cases. Concrete examples are provided in the opinion paper.
- Second, the EDPB brings up is that '(explicit) consent'; is not the only legal basis to process clinical trail data under the GDPR. The paper describes situations where processing can be based on 'public interest', or 'legitimate interest' of the data controller (e.g. research institute).
- Third, the EDPB is of the opinion that ';secondary use' of clinical trial data ("outside the scope of the [clinical trial] protocol") should be possible under certain circumstances. This reaches into the realm of 'compatibility' of further use under the GDPR. The Baker McKenzie Amsterdam data privacy team researched this topic recently in more detail. These research findings on compatibility can also be leveraged in the clinical trial context.
