The European Data Protection Board (EDPB) recently published opinion 3/2019 on the interplay of the Clinical Trials Regulation (CTR) and the General Data Protection Regulation (GDPR). The EDPB advises the European Commission on issues related to the protection of personal data and is composed of all heads of the national EU data protection authorities.
The EDPB opinion on the interplay of CTR and GDPR is mainly concerned with the legal basis of processing personal data in clinical trials, which in the given context will often include the processing of special categories of data (data concerning health, genetic, biometric data). These data categories are subject to a stricter data protection regime.
Highlights of the EDPB opinion
- The first important point the EDPB makes is that the 'informed consent' under the CTR will have a different qualification compared to the legal processing ground of 'explicit consent' under the GDPR. The GDPR consent will be more restrictive in most of the cases. Concrete examples are provided in the opinion paper.
- Second, the EDPB mentions that 'explicit consent' is not the only legal basis to process clinical trial data under the GDPR. The paper describes situations where processing can be based on 'public interest', or 'legitimate interest' of the data controller (e.g. research institute).
- Third, the EDPB is of the opinion that secondary use of clinical trial data (outside the scope of the clinical trial protocol) should be possible under certain circumstances. This reaches into the realm of 'compatibility' of further use under the GDPR. The Baker McKenzie Amsterdam Data Privacy Team researched this topic recently in more detail. These research findings on compatibility can also be leveraged in the clinical trial context.
Please feel free to contact us for additional details on the interplay of CTR and GDPR. The EDPB opinion 3/2019 can be downloaded here. In a future post we will further elaborate on the conditions of processing clinical trial data based on the public interest ground, when the conduct of such clinical trials directly fall within the mandate, missions and tasks vested in a public or private body by Dutch law.