The protection of personal data under the General Data Protection Regulation (“GDPR”) in the field of clinical trials is an extensively-discussed topic, even more so in the absence of a specific statutory provision, or at least a relevant methodology in this respect. The Czech State Institute for Drug Control (“SUKL”) has recently issued a GDPR-related notice to sponsors of clinical trials, advising them not to submit documents concerning the processing and protection of personal data together with the application for authorisation / notification of clinical trials. Despite that notice, however, there still remain multiple unanswered questions in this respect, concerning in particular the legal basis for, and a more detailed legal definition of, transfers of personal data of the clinical trial subjects between the investigators and the sponsor
SUKL notice to clinical trial sponsors
SUKL published a notice1 on its website on 30 July 2018, advising sponsors not to submit documents concerning the processing and protection of personal data together with the application for authorisation / notification of clinical trial. SUKL will not review and assess such documents.
Documents pertaining to the processing and protection of personal data should be submitted to the ethics committees and data subjects as separate documents. In addition, it is also necessary to separately submit to the ethics committees a declaration stating that in data transfers, personal data protection required by the GDPR will be ensured. However, the ethics committees will not give any opinion regarding those documents.
The notice in the context of the opinion statement of the Office for Personal Data Protection
The Czech Office for Personal Data Protection (“UOOU”) published its opinion on this matter in May 2018 to the effect that “it is not permissible to mix a consent with the conduct of a clinical study in patients or healthy volunteers and a consent with personal data processing”, and that the processing of personal data under applicable legislation is a responsibility of the controller.
As far as the possibility, within a clinical trial, of processing personal data without the data subject’s consent for scientific purposes (cf. Art. 9(2)(j) GDPR) is concerned, UOOU merely states on its website that this question has not been fully answered yet, and refers to the upcoming adaptive legislation (i.e. the proposed Bill on data processing currently being discussed by the Czech Parliament) which should offer clear answers.
Legal basis for processing
SUKL states on its website that the content of the trial subject’s consent to personal data processing is irrelevant for good clinical practice (GCP); what is relevant, however, is the fact that information about the legal basis for processing has been provided to the trial subject. Nevertheless, SUKL also states on its website that the lawfulness of processing is likely to be based particularly on Art. 6(1)(c), (e) or (f) GDPR (compliance with a legal obligation, performance of a task carried out in the public interest, or for the purposes of legitimate interests, where general processing of personal data is concerned), in conjunction with Art. 9(2)(i) or (j) GDPR (processing of personal data is necessary for reasons of public interest in the area of public health, or for scientific purposes, where processing of special categories of personal data is concerned).
Hence, personal data in clinical trials may be processed on the basis of the data subject’s consent, and also on the basis, with regard to the specific form of processing, of all the legal bases mentioned above. The choice of the legal basis for the processing is the responsibility of the data controller. The legal basis must be unambiguously defined.
Ambiguous interpretation of personal data transfers
Notwithstanding the clarifying notice by SUKL, the question of transfers of personal data between the investigators and the sponsor still remains unanswered. Indeed, neither SUKL nor UOOU offers any detailed explanation of which of the legal bases mentioned above, and under which circumstances or subject to which conditions, would be acceptable to the Czech supervisory authorities.
The European Medicines Agency (“EMA”) has previously published its opinion in this regard2 , noting that while personal data are transferred between an investigator and the sponsor, privacy of trial subjects should be protected and respected. However, EMA does not stipulate, or indicate by way of example, on what basis such transfers should be effected; instead, EMA merely makes a reference to national regulations in the respective Member States. However, Czech legislation does not offer any specific answer in this respect.
Clinical trials in EU Member States
The issue of the processing of personal data in clinical trials has been widely discussed across the European Union. It has become apparent that opinions differ from Member State to Member State, which naturally has an adverse impact on multicentric clinical trials performed simultaneously in several Member States.
Take the United Kingdom, the Netherlands, and Germany as an example. The Netherlands and Germany currently tend to favour the approach that the consent to the processing of personal data must always be obtained from data subjects in clinical trials.
On the other hand, the prevailing viewpoint in the United Kingdom in this case is that the consent is not the best option, and that the processing of special categories of personal data should be perceived as processing necessary for reasons of public interest in the area of public health or for scientific purposes.
Conclusion
The notice published by SUKL does constitute a long-awaited statement by Czech governmental authorities, even though it does not, despite the list of statutory provisions potentially applicable to clinical trials, provide any specific guidance on how to make the choice. Neither SUKL nor UOOU expressly favours any of the options suggested.
Although SUKL refers to Art. 9(2)(i) and (j) GDPR (the UK alternative), it is probable that obtaining the consent from patients will continue to be the prevailing practice, for reasons of legal certainty on the part of clinical trial sponsors and investigators, although this may have adverse consequences or result in deadlock situations when the patient withdraws his/her consent without simultaneously requesting termination of his/her participation in the clinical trial. The good news thus could be that SUKL will not assess compliance of the documents with the requirements set out in the GDPR, which could make the work easier for SUKL and speed up the process.
To view all formatting for this article (eg, tables, footnotes), please access the original here.
Author: Richard Otevřel
Source: Lexology
