Context

By an Arrêté published on April 9, 2022, the new French template agreement for clinical trials (Convention Unique) was published. This new version was much awaited since the initial version, dated back to 2016, was missing some key provisions regarding data protection compliance.

In particular, the initial draft Convention Unique did not take into account the parties’ qualifications from a data protection standpoint. In France, investigators and sites are processors and they act on behalf of the sponsor, who is the controller. It means that, in accordance with Article 28 of the GDPR, a written data processing agreement is required. However, the initial version of the Convention Unique, published a few months before the GDPR, totally lacked corresponding provisions, including provisions of Article 28 of the GDPR, which created some difficulties in terms of compliance.

This was in addition contradictory with the Convention Unique’s goal, which is to simplify and accelerate the process for launching clinical trials for sponsors and French healthcare organizations by providing a simple template. The use of this template is mandatory for all research involving therapeutic acts on human beings for drugs and clinical investigation for medical devices.

The update

The new version now includes data protection-related provisions. It clearly refers to the controller-to-processor relationship between sites and sponsor (Article 11 bis) and includes an Annex 3 incorporating the mandatory provisions from Article 28 of the GDPR and a list of security measures that should be implemented by the processor.

This Annex 3 is, however, disappointing because the provisions of the data processing agreement it contains are very basic, mainly spelling back GDPR provisions without taking into account a number of the much-needed specificities of data processing operational requirements  in the context of clinical trials.

For example, it briefly broaches pseudonymization as a possible security measure, but it does not include the provision of key-coded data to the sponsor that is an essential element in this field. Also, it does not foresee the quite common case where the sponsor is located outside of the EU, which calls for additional provisions regarding the protection of the data transfers.

From a regulatory standpoint, the Convention Unique does not bring much novelty, hence it does not address the rigid framework within which clinical trial agreements are entered into in France. French regulations prohibit entering into any fee-for services agreement with trial sites or investigators in addition to the Convention Unique, and the Convention Unique is not supposed to be modified. The starting position with trial sites has therefore been to use an unmodified Convention Unique and to refrain from providing any valuable consideration other than what is envisaged under the Convention Unique.

However, experience shows that contracting practices do not always strictly follow this approach and some changes are from time to time implemented, for various reasons connected to the increased complexity of some clinical trials. These include (i) ensuring specific safety data exchange or quality agreements are agreed for particularly sensitive trial products, (ii) taking into account specific terms deriving from the use of digital tools in trials, (iii) implementing additional contracts required by specific procedures not taken into account by the Convention Unique (e.g. associated testing or diagnostic services, or apheresis procedures for gene therapies, that are required in practice but not envisaged by the Convention Unique and its fee schedules), or (iv) articulation with development involving companion products whereby medical devices and drugs are being developed in parallel.

Next steps

This new version is immediately applicable to clinical trial agreements entered into from April 10, 2022, and there is no transition period. It is also clearly stated, under article 12 of the Convention Unique, that electronic signatures processes can be used, which helps speed up the signature process.

In practice, pharmaceutical companies and medical devices manufacturer clinical teams need now to understand and be trained on this new version to make sure it is appropriately used.

In terms of contractual negotiations between investigators and/or sites with sponsors, we however expect that some discussions will still be needed to enter into additional contractual commitments, without valuable consideration as this will be prohibited. Such additional commitments will still be needed to (i) improve the data processing activities framing, notably execution of EU standard contractual clauses to permit data transfers outside of the EU will be required in many cases, and (ii) address other requirements deriving from the increased sophistication of trials.

Authored by Patrice Navarro, Mikael Salmela, and Julie Schwartz