Ruling 3/2019 of the European Data Protection Board (EDPB), which responds to the consultation by the European Commission regarding the relationship between the Clinical Trial Regulation (CTR) and the General Data Protection Regulation (GDPR), covers aspects such as the lawfulness of personal data and possible processing of special categories of personal data. The EDPB opts to distinguish between the operations relative to processing that it qualifies as “main use” and those referring to processing for a “secondary use.”
While the GDPR intends to ensure the protection of the affected parties from processing of their personal data and the conciliated regulations on free circulation, the CTR’s objective is to guarantee a higher level of conciliation between the regulations for carrying out clinical trials throughout the EU. In this respect, it introduces an authorisation process based on one sole remittance through one EU website; it is an evaluation process that leads to just one decision, regulations on the protection of the subjects and the informed consent and transparency requirements. It is estimated that this procedure will be applied to all clinical trials carried out in the EU in 2020.
The CTR refers to the need to comply with the data protection regulations and, at the same time, the GDPR notes that the processing of personal data for scientific purposes must comply with the relevant regulations, such as that on clinical trials (considering 156) and, furthermore, it highlights that, in order to provide consent for participation in scientific research activities in clinical trials the relevant provisions of the CTR must be applied. This interrelation generates numerous questions, especially with regard to consent. The Ruling deals with matters regarding the lawfulness of personal data and the potential processing of data from special categories. For this purpose, the EDPB distinguishes between the operations relative to “main use” processing and “secondary use” processing:
- Lawfulness of processing personal data during the course of a clinical trial (main use)
Main use processing may consist of, simultaneously, processing with various purposes and, as such, with different bases for lawfulness. Specifically, the EDPB distinguishes two main categories: i) processing operations related to generating reliable and solid data with the purpose of protecting health and ii) processing operations exclusively related to research activities.
1. Processing operations related to reliability and security purposes
When these types of operations are foreseen by the CTR and by the applicable national regulations, the lawfulness of the processing shall be the need to comply with a legal obligation of the data controller, in accordance with Article 6.1.c GDPR. Furthermore, processing of special categories of personal data could be covered under Article 9.2.i of the GDPR, that is, on the need to process said categories of data for public interest reasons in the context of public health, for the purpose of guaranteeing increased levels of quality and security of healthcare and of medications or health products.
2. Processing operations exclusively related to research activities
In these cases, as an alternative to explicit consent, which on occasion is not considered the most appropriate form, the lawfulness may consist of the performance of a task carried out in the public interest by virtue of Article 6.1.e GDPR, or to fulfil a legitimate interest pursed by the data controller (Article 6.1.f GDPR) in relation to the need for public interest reasons in the context of public health (Art. 9.2.i GDPR) or the need for scientific research purposes (Art. 9.2.j GDPR).
Processing operations related exclusively to research activities whose processing purpose has been determined under the applicable EU or national law may be lawful when they are necessary for the performance of a task entrusted to the controller carried out in the public interest (Art. 6.1.e GDPR), where it is not necessary for each processing event to be governed by a specific regulation. However, if said processing includes personal data belonging to special categories, it should be specified on which case of those enumerated in Article 9 of the GDPR it is based.
Another important aspect of the Ruling is the matrix created by EDPB in relation to the distinction between the consent that is governed by the GDPR, relative to the processing of data, and the informed consent governed by the CTR, relative to participation in a clinical trial. The Committee indicates that informed consent in relation to the will of the patient to participate in the trial does not imply consent for the processing of personal data. Furthermore, the EDPB recommends that the capacity of the affected party to provide valid consent be studied in each case.
The EDPB also makes reference to the right of the interested party to withdraw its consent at any time and that, as a consequence, any processing based on the consent of the interest party must be stopped, unless the processing is lawful for another reason.
- Secondary uses of the clinical trial data apart from the clinical trial
Article 28.2 of the CTR foresees the use of data processing with exclusively scientific purposes apart from the clinical trial protocol and establishes the conditions applicable to the need for informed consent for said use.
Article 28.2 of the CTR foresees that the sponsor shall request from the trial subject or, where applicable, from his/her legally appointed representative, at the time at which he/she, or his/her legally appointed representative, gives his/her informed consent to participate in the clinical trial, that he/she provide his/her consent for his/her data be used for exclusively scientific purposes apart from the clinical trial protocol. The trial subject, or his/her legally appointed representative, may withdraw said consent at any time. Nevertheless, the consent mentioned in Article 28.2 of the CTR is not the same consent as the GDPR as lawful for the processing of personal data, independently of whether it consists of the lawfulness used for the main process.
Consequently, if the sponsor or the investigator wishes to use the clinical trial data for scientific purposes apart from the clinical trial, it shall require lawfulness additional to that of the main use. Said lawfulness chosen does not have to be different than the lawfulness of main use.
Nevertheless, according to the EDPB this focus excludes the principle of presumption of compatibility in Article 5.1.b of the GDPR, according to which further processing for scientific purposes must be considered as processing compatible with the initial purposes. Recital 50 of the GDPR enumerates a series of conditions that help to determine said compatibility. However, the EDPB does not analyse said conditions due to their complexity, undertaking to do so in the future and establishing that, at this time, the compatibility principle may not be excluded with respect to the conditions of Article 89 for secondary uses of the clinical trial data for scientific purposes apart from the clinical trial. Of course, this does not free the data controller from fulfilling its obligations pursuant to the GDPR, as set forth in Article 28.2 of the GDPR.