European Commission Directorate-General For Health And Food Safety: Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation
What are the general obligations of the Clinical Trials Regulation with regard to personal data?
The purpose of a clinical trial is to gather reliable and robust data on an investigational medicinal product. This fundamental principle is confirmed by Article 3(b) of the Clinical trials Regulation (CTR).
From this basic principle stems the obligation on the sponsor/investigator to follow the approved protocol and the good clinical practice principles (Article 47 of CTR).
Additionally the CTR strengthens certain measures requiring the sponsor/investigator to record, process, store and handle data in such a way that it can be accurately reported, interpreted and verified, while preserving the confidentiality of the records and requiring appropriate technical and organisational measures to protect information and personal data (Article 56 of CTR).
In addition to that, the sponsor is legally obliged by the CTR to carry out a range of activities (including those detailed in chapter VIII of the CTR) for instance:
- report the results of that trial (Article 37(4) and (8) of CTR);
- perform the safety reporting (Articles 41-43 of CTR); and
- archive the clinical trials master file for 25 years and the medical files of subjects for the time period as prescribed by national law (Article 58 of the CTR)(8)
The sponsor is subject to Member States inspections (Article 78 of CTR) in the context of which Member States’ GCP(9) inspectors are entitled to have access to clinical trial data (Article 24 of Directive 2005/28/EC and Article 10(2) of Commission Implementing Regulation (EU) 2017/556) and in the latter Regulation, also the individual patient records.
The clinical trial protocol, authorised under the CTR, defines the purposes and conditions for which the data of clinical trial subjects will be processed. Subjects should be properly informed on the processing of his/her personal data (see Q5).
In addition to this, it must be noticed that Article 93 of the CTR provides that “Member States shall apply Directive 95/46/EC [now repealed by the GDPR] to the processing of personal data carried out in the Member States pursuant to this Regulation” and that “Regulation (EC) No 45/2001 [repealed by Regulation 2018/1725] shall apply to the processing of personal data carried out by the Commission and the Agency pursuant to this Regulation”. The GDPR as well makes express references to the relevant legislation applicable to clinical trials (10). It follows that both legislations apply simultaneously.
Download all questions and answers in the Florence Beginner’s Guide to GDPR for Clinical Trials.
The information presented in our library is for informational purposes only, they are not for implementation in operations. Please consult official GDPR guidance documents for operational use.
This information was sourced from the European Commission Directorate-General For Health And Food Safety: Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation.
