EDPB advises on lawful grounds for processing personal data in clinical trials

As the EDPB puts it, the information provided in the Q&A document will constitute a good basis for a GDPR compliant clinical trial. So, with that in mind, the EDPB has issued an influential opinion on the lawful grounds for the processing of personal data in the context of clinical trials. The opinion covers the justification for both the primary use of data for the clinical trial protocol itself and the secondary use of such data for other scientific purposes.

An added complexity of personal data processing for clinical trials is that this will necessarily involve the use of ‘data concerning health,’ which is regarded as a special category of personal data. In practice, this means that for the purposes of complying with the GDPR, it will be necessary to meet one of the grounds of Article 6 as well as one of the conditions of Article 9.

Primary Use and Processing Operations

In the context of primary use of data, the EDPB differentiates between (a) processing for the purpose of guaranteeing the reliability and safety of medicinal products, and (b) processing for clinical research purposes.

In the context of data processing for reliability and safety purposes, according to the EDPB, compliance with a legal obligation (e.g., obligations imposed by the Clinical Trials Regulation (CTR)) is the relevant Article 6 ground, and public interest in the area of public health is the Article 9 condition to rely on.

However, the opinion states that compliance with a legal obligation should not be relied on as the lawful ground for processing personal data in relation to research activities in clinical trials. Rather, the appropriate lawful grounds under Article 6 of the GDPR for research related processing, depending on the circumstances of the clinical trial, will be:

• The data subject’s consent;
• A task carried out in the public interest; or
• The controller’s legitimate interests.

The corresponding conditions for lawful processing of special categories of data under Article 9 of the GDPR will be:

• The data subject’s explicit consent;
• The public interest; or
• Scientific research purposes.

It is important to note that the EDPB highlights the difference between informed consent required under the CTR (consent required to meet ethics and confidentiality standards under the Charter of Human Rights) and consent required under the GDPR. Specifically, the EDPB notes that GDPR consent may not be relied on as it will not be freely given where individuals are in poor health, are economically or socially disadvantaged or in case of institutional hierarchy. In those cases, whilst CTR informed consent will still be necessary, the EDPB recommends relying on other lawful grounds for processing personal data. This is in line with the approach taken in the UK, but not in most other European countries where explicit consent is the preferred lawful ground for processing personal data in the context of clinical trials for research purposes. Specifically, in the UK the position is that where clinical research has been authorised by the Ethics Committee the lawful ground under Article 6 and the relevant condition under Article 9 to rely on for processing are legitimate interests and scientific research purposes respectively, rather than explicit consent.

Where valid GDPR explicit consent cannot be relied on, companies will have to prepare documentation that meets the requirement of informed consent still necessary under the CTR and contains wording explaining the lawful bases for processing as legitimate interests, public interest, or scientific research purposes in line with the GDPR requirements. The possibility for differing legal grounds to be relied on for research related processing throughout the EU will inevitably result in divergent forms of documentation throughout relevant EU jurisdictions.

Secondary Uses Open to Further Analysis

The  EDPB’s opinion does not analyse in detail the secondary use of clinical trial data but the EDPB noted that the presumption of compatibility, whereby processing activities for the purpose of scientific research do not require an additional legal basis for processing, should not be excluded in relation to secondary use of clinical trial data. However, it remains to be seen whether the explicit consent of a clinical trial subject at the onset of a clinical trial can be considered ‘informed’ consent and an appropriate legal basis for secondary use of clinical trial data. This is particularly the case where secondary use of such data may occur many years after the clinical trial subject has given their consent and for a totally different research purpose.

As a result, as stated in the opinion, the secondary use of clinical trial data ‘will require specific attention and guidance from the EDPB in the future’.

Authored by Lilly Taranto and Genna Hancock (Trainee Solicitor)