European Commission Directorate-General For Health And Food Safety: Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation
What are the legal consequences of withdrawal of the consent for participation in the clinical trial under the Clinical Trial Regulation?
Article 28(3) of the CTR states that withdrawal of the informed consent to participate in a clinical trial shall not affect any activities already carried out and the use of data obtained on the basis of the informed consent before that withdrawal.
Consent for participation in clinical trial must be distinguished from the consent for processing personal data in the context of that clinical trial (see Q&A 4).
The withdrawal of consent to participate in a clinical trial under CTR may not necessarily affect the processing of personal data gathered in the context of that trial. The personal data may continue to be processed where there is an appropriate legal basis for such processing under GDPR. In such cases, the personal data of that person gathered before the withdrawal shall be kept for the purposes and in the conditions defined by the protocol and the legislation.
For example, if serious adverse reaction occurs to the patient, the sponsor has the rights to process the data by reporting the data to the national competent authorities (based on the legal obligation of the controller Article 6(1) c of the GDPR in conjunction with Article 9(2)i.
Under the GDPR, if consent is used as the lawful basis for processing (Article 6(1) a), there must be a possibility for individuals to withdraw that consent at any time Article 7(3)), and there is no exception to this requirement for scientific research provided for under Article 7. As a general rule, if consent for data processing under GDPR is withdrawn, all data processing operations that were based on consent remain lawful in accordance with the GDPR (Article 7(3)); however, the controller shall stop the processing actions concerned and if there is no other lawful basis justifying the retention for further processing, the data should be deleted by the controller (see Article 17(1) (b) and (3) GDPR).
In cases where personal data are processed on the basis of consent under GDPR, it is appropriate for the investigator to determine with the trial subject whether their withdrawal of consent under CTR relates solely to participation in trial activities or whether they also withdraw consent to the processing of their data.
However, the withdrawal of consent under the CTR does not affect the processing operations that are based on other lawful grounds, in particular legal obligations to which the sponsor/investigator are subject such as the ones related to safety purposes.
Download all questions and answers in the Florence Beginner’s Guide to GDPR for Clinical Trials.
The information presented in our library is for informational purposes only, they are not for implementation in operations. Please consult official GDPR guidance documents for operational use.
This information was sourced from the European Commission Directorate-General For Health And Food Safety: Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation.
