European Commission Directorate-General For Health And Food Safety: Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation
How should a sponsor proceed in the case of clinical trials authorised under the Clinical Trials Directive?
For new clinical trial applications that will be submitted for authorisation under the clinical trial Directive until the Clinical Trial Regulation enters into application, the sponsor should continue to follow the rules in light of the respective national laws transposing the clinical trials Directive.
In case of clinical trials authorised under the CTD that are already ongoing the sponsor should consider the following aspects:
The legal basis: The legal basis for processing of personal data in an ongoing clinical trial, authorised on the basis of Directive 2001/20/EC, will not be affected by the entry into application of GDPR e.g. if subjects of a clinical trial were asked for consent for data processing for the purpose of that clinical trial, this cannot be changed into another legal basis. The consent will remain the legal basis for processing of those personal data under the GDPR. If the legal basis was the public interest, this legal basis remains the same.
In light of Articles 13 and 14 of the GDPR, sponsors may need to provide, where necessary, additional information to the data subject participating in the ongoing clinical trials: Depending on the information initially provided to the clinical trials participants, some additional information may be required. The requirements on the information to be provided to the data subject are clarified in Articles 13 and 14 of the GDPR. The update of the information that is to be given to the data subject may be necessary, independent of the legal basis for processing of data. The information required by the GDPR should be provided as soon as possible (19).
Re-consent: GDPR clarifies the requirement on consent in Articles 4(11) and 7, as well as in recitals 32, 33, 42 and 43. In case consent was chosen as an initial legal basis for personal data processing in the context of the clinical trial, the data controller needs to assess whether the initial consent fulfills the requirements of GDPR. If not, then re-consent may be required.
The data controller needs to consider whether these actions are necessary with regard to the personal data subjects whose data are still being processed in the context of that trial (it is irrelevant whether the person still receives the investigational medicinal product or whether he/she is in follow up phase of a trial).
Download all questions and answers in the Florence Beginner’s Guide to GDPR for Clinical Trials.
The information presented in our library is for informational purposes only, they are not for implementation in operations. Please consult official GDPR guidance documents for operational use.
This information was sourced from the European Commission Directorate-General For Health And Food Safety: Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation.
