On the short list of “hot topics” that has drawn the EDPB’s attention is the question whether consent should be used to justify the processing of personal data when conducting clinical trials in the EU.
One of the key requirements under EU data protection law is that the sponsor of a clinical trial must have a valid legal basis for processing a trial participant’s personal data. In the pre-GDPR era, most sponsors relied on (explicit) consent to cover the processing of trial participants’ data, often in combination with consent to participate in the trial. An opinion adopted by the EDPB last January suggests that sponsors may need to reconsider this consent-based approach.
According to the EDPB, in many trials a consent-based approach to processing personal data may no longer work, considering the strict conditions for valid consent and trial participants’ enhanced rights under the GDPR. Notably, the EDPB considers that the condition under the GDPR that consent be “freely given” will not be met if, for example, trial participants are not in good health condition or they belong to an economically or socially disadvantaged group. In those cases, the EDPB recommends using other legal bases in the GDPR.
As an alternative to consent, some sponsors may be able to justify the processing on a public interest ground if conducting clinical trials directly falls within the mandate, missions and tasks vested in them by national law. In other cases, the processing of personal data may be justified based on the sponsor’s “legitimate interests”. In addition, the EDPB takes the view that sponsors could rely on scientific research or public health derogations under the GDPR to justify the processing of “sensitive” personal data, such as health data. Processing of personal data relating to trial participants that is needed to comply with reliability and safety requirements (e.g., safety reporting by the investigator to the sponsor) is arguably covered by a “legal obligation” justification.
The EDPB also addressed the question how sponsors/investigators can justify “secondary” use of personal data collected in the context of a clinical trial, for purposes other than those identified in the initial protocol. Here the EDPB favors a pragmatic approach, based on the GDPR’s presumption of “compatibility”. This enables sponsors/investigators to further process data, under certain conditions, without the need for a new legal justification.
In a recent Q&A on the interplay between the GDPR and Clinical Trial Regulation 536/2014, the European Commission follows the views of the EDPB while emphasizing the need for a harmonized approach across the EU on how to justify the use of personal data in clinical trials. However, it remains to be seen if health and data protection regulators in all EU member states will apply these views in practice.
Wim Nauwelaerts is a partner with Sidley Austin LLP in Brussels.
Sidley Austin LLP provides this information as a service to clients and other friends for educational purposes only. It should not be construed or relied on as legal advice or to create a lawyer-client relationship. Readers should not act upon this information without seeking advice from professional advisers. In addition, this information was not intended or written to be used, and cannot be used, by any person for the purpose of avoiding any U.S. federal, state or local tax penalties that may be imposed on such person.
Attorney Advertising—Sidley Austin LLP, One South Dearborn, Chicago, IL 60603. +1 312 853 7000. Sidley and Sidley Austin refer to Sidley Austin LLP and affiliated partnerships, as explained at www.sidley.com/disclaimer.