European regulators are expected to align their processes and guidance to accommodate the EDPB’s recommended approach to processing special categories of personal data.
In January, the European Data Protection Board (EDPB) issued an opinion (Opinion) on the interplay between the General Data Protection Regulation (GDPR) and the Clinical Trials Regulation (CTR), which: (1) confirms that consent under the GDPR and CTR are different concepts; and (2) sets out the EDPB’s recommendations on the appropriate legal basis required for processing personal data in connection with clinical trials conducted in the EEA (which is unlikely to be consent).
While the Opinion brings some much-needed certainty to the area of consent and other legal grounds for clinical trials, challenges remain. Outlined below are the key challenges and the steps that sponsors of clinical trials in the EEA (Sponsors) should take when designing their research activities:
- National laws are not entirely uniform in their implementation of the GDPR. National laws may pose additional hurdles before a particular ground can apply or may not even permit the use of some of the grounds endorsed by the EDPB. Sponsors must consult national law when relying on the scientific research condition, in particular to confirm whether the trial subjects’ right to object can be disapplied if it would prejudice the trial’s research findings. National law may also limit the scope of processing, as permitted by the GDPR. Sponsors should therefore carefully consider local laws when planning clinical trial activities. The discrepancies among national laws present a particular challenge for trials that include a number of European jurisdictions simultaneously. In such cases, Sponsors should consider the regime in each candidate country at the earliest opportunity and plan their trial accordingly.
- It may take a while for all regulators to fall in line. European regulators are expected to follow the Opinion and align their processes and guidance to accommodate the EDPB’s approach. However, it remains to be seen how quickly this will happen and whether there will be a further period of uncertainty as national regulators and ethics committees reconsider and potentially revise their guidance. National laws may need to be passed or amended, which can take a considerable amount of time. In addition, a Sponsor’s processing activities in the context of a clinical trial are subject to the scrutiny of the national health research bodies in each European country, such as the UK HRA. There may therefore be a further delay while national health research bodies reconsider and potentially revise their GDPR-compliance guidance. Before national regulators produce updated guidance, Sponsors must form a view as to whether they will follow the Opinion or national guidance that may not yet be in line with the Opinion.
- Distinguishing between legal obligations and research purposes may be challenging. In practice, it may be difficult to distinguish between processing tasks that are undertaken in order to comply with legal safety and quality requirements and processing tasks that are undertaken for research purposes. For example, testing samples collected from trial subjects may fall under both categories. Sponsors should carefully consider their processing activities and take advantage of the legal obligations basis wherever possible.
- Informed-consent forms may need to be updated. Sponsors should consider updating their informed-consent forms and other data subject-facing documentation, such as supplementary fair processing notices, to refer to one or more legal grounds in place of consent. Different language may be required in different jurisdictions to comply with national guidance and practice. For example, the HRA has published standard GDPR-compliant language to be used in informed-consent forms and patient information leaflets, which would not necessarily be appropriate in other jurisdictions.