Because clinical trials involve the use of “data concerning health,” controllers must cumulatively respect both the provisions of Article 6 GDPR governing the basis on which data may lawfully be processed and the conditions provided in Article 9 GDPR governing the processing of special categories of personal data, including data concerning health. A basic legal requirement that pharmaceutical and medical device companies conducting clinical trials must always respect when conducting a clinical trial is the obligation to obtain patients’ consent to their participation for clinical trials.
Article 3.2 of the Clinical Trials Directive² clearly imposes this obligation, which has been further introduced by the related national implementing legislation of the individual EU Member States. Under Article 29 of the Clinical Trials Regulation³ (CTR), the informed consent of patients is the fundamental condition under which a person can be included in a clinical trial. Although adopted in 2014, the Clinical Trials Regulation is not yet in application and unlikely to be so before mid-2020 at earliest. Regulators of clinical trials are already using the CTR as their frame of reference, much like data protection authorities referred to GDPR before May 25, 2018. The CTR puts “informed consent” at the center of all aspects of clinical trials, including the use of data. The conditions for informed consent are defined with great specificity in the CTR, including how informed consent should be collected from minors or from incapacitated subjects. The CTR addresses the conditions for consent to secondary data processing for research (Article 28(2) CTR). The safeguards surrounding consent in the CTR are more stringent than in the GDPR. As regards the processing of data once collected, the CTR makes extensive reference to the safeguards contained in Directive 95/46/EC (this should now be read as referring to the GDPR).
Consistent with the CTR, trial sponsors commonly adopt the informed consent approach in relation to the collection of patients’ data concerning health. This approach is based on the belief that a patient’s informed consent to their participation in a trial under the strict conditions imposed by national rules on clinical trials should also be valid consent for data processing as long as the two consents are adequately separated. The Informed Consent Form (ICF) approved by the relevant Ethics Committee and signed by the patient prior to participation in a clinical trial includes details concerning the trial, potential related risks, and, in a separate section, information concerning the use and protection of patients’ health data. The obligation to provide this comprehensive information as part of the ICF is imposed by Articles 13 and 14 of the GDPR.
Yet the competent authorities of some EU Member States have adopted the position that patient consent is not a valid ground on which personal health data may be collected and processed for health research. The most prominent of these authorities is the UK Health Research Authority (HRA) which affirmed that: “For the purposes of the GDPR, the legal basis for processing data for health and social care research should NOT be consent. This means that requirements in the GDPR relating to consent do NOT apply to health and care research.” According to the HRA:
- The processing of personal data for research by commercial companies and charitable research organisations should be based on the legal basis of “legitimate interests” that is provided in the GDPR;
- In light of the fact that the GDPR includes the expectation that consent would not be an appropriate legal basis for collection and processing of personal data where there is an imbalance of power in the relationship between the controller and the data subject, (e.g. where the controller is a public authority and the data subject depends on their services, or fears adverse consequences, consent should not be used with regard to patients).
By contrast, the competent authorities of most other EU Member States require the explicit consent of the patient for the processing of their personal health data within the context of clinical trials, a position that is more consistent with the CTR. Our Belgian and UK teams (Elisabethann Wright, Lilly Taranto and Alexander Wenzel) have conducted a survey of the approach adopted in 31 European countries. They concluded from this investigation that 25 out of 31 countries require either explicit consent4 or explicit acceptance5 by patients to the collection and processing of their personal health data as part of a clinical trial.
Recognizing these discrepancies and possible conflicts between the GDPR and the CTR, on 8 October 2018 the European Commission (DG SANTE) submitted a request to the EDPB for consultation concerning a document on “Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR).” On January 23, 2019, the EDPB published its opinion concerning the lawful grounds for the processing of personal data within the context of clinical trials (the Opinion). The Opinion addresses the justification for both the primary use of data for the clinical trial protocol itself and the secondary use of such data for other scientific purposes. For a full review of this Opinion, see our previous post here.
Aligning with the UK HRA, the Opinion concludes that, within the context of a clinical trial, the consent provided in GDPR may not be relied on as a basis for collection and processing of patients’ personal data in many clinical trial scenarios. This conclusion is based on the belief that patients are unable to freely give their consent in several clinical trial situations. According to the EDPB, there could be a clear situation of imbalance of powers between the patient and the sponsor of the trial or the investigator which would imply that the consent is not “freely given” as that term is understood within the GDPR. This would, especially, be the case where a patient is not in good health, where patients belong to an economically or socially disadvantaged group, or in any situation of institutional or hierarchical dependency.
While consistent with the UK HRA’s position, the Opinion contradicts the position adopted by the competent authorities of most other EU Member States where explicit consent is the preferred lawful ground for processing patient personal data within the context of clinical trials for research purposes.
On April 10, 2019, the European Commission Directorate-General for Health and Food Safety, following the EDPB consultation, published a revised Q&A concerning the interaction between the Clinical Trials Regulation and the GDPR. This Q&A reflects the position of the EDPB and does not question this.
As a result of the EDPB’s Opinion, we understand that some ethics committees may have begun to question patient ICFs that include patient consent as a legal basis for collection and processing of health data, ignoring the fact that the competent authorities of two thirds of EU Member States require this patient consent.
Legislation on clinical trials go to great length to address the issue of freely given consent. For example, the ICF is explained to patients participating in a clinical trial in person by the investigator. Discussion and signature of an ICF by the patient involves prior and detailed information, with the possibility of having an explanation and clarification from the investigator, who can relay questions to the sponsor. The investigator explains the voluntary nature of the patient consent, and that refusal to provide the consent means that the patient cannot participate in the study but that such consent will not affect the patient’s level of treatment. The clinical trials regulations in the EU oblige investigators, sites and sponsors to demonstrate that the patient was provided with the ICF and that the patient understood, accepted, and agreed to participate in the trial. The consent must be in writing.
The Opinion leads to a disconcerting situation where an informed consent satisfying all the requirements of the CTR designed to address risks of imbalance and vulnerability, does not constitute “freely given” consent under the GDPR. While understandable from a pure GDPR perspective, the Opinion suggests that the informed consent collected under European clinical trials legislation is fundamentally fragile and not freely given, even for the trial itself. If consent cannot be freely given for data, how can it be freely given for experimental treatment, which involves risks for the patient that are potentially much higher than the risks associated with the processing of his or her data? The Opinion seems antagonistic to the entire architecture of the CTR and the way clinical trials have been conducted for decades.
The Opinion also does not take into account the important differences between the various types of clinical trials that may be conducted. These could include Phase I trials involving healthy participants, Phase II or Phase III trials with patients, or post marketing Phase IV trials. The Opinion rather focuses on what seems to be an artificial distinction between the processing of data for the purpose of guaranteeing the reliability and safety purposes of medicinal products, and processing data for clinical research purposes. The purpose of clinical research in relation to medicinal products and medical devices is to demonstrate the reliability and safety of the product. The Opinion focuses on the limited cases (i) where participants are paid to accept enrolment (Phase I healthy participants. Patients in Phase II-IV, who are the main subjects of the personal health data debate cannot receive payment in relation to their participation in the trial ) and (ii) where the trial is on a new treatment able to cure or improve the health of participants who are already sick and have no alternative. There are many other contexts in which studies take place. The Opinion also omits to point out that the acceptance to have the personal data collected is not compulsory in these studies and that participants can revoke their consent and stop the processing of their personal data at any time without having to exit the trial. The consent for data processing is not “bundled” with other aspects of the trial protocol.
A more satisfying approach would have been to seek an interpretation of the GDPR in the context of clinical trials that does not undermine the freely given nature of consent granted under the CTR and related legislation. When interpreting EU legislation, the CJEU generally tries to find approaches that permit harmonious coexistence of different EU texts6. One such approach would be to recognize that patient consent for processing of personal data is freely given provided all the precautions for informed consent under clinical trials legislation are applied, so as to mitigate the effects of imbalance and vulnerability. Consent would form a permitted legal basis under Article 6 GDPR. As regards Article 9 GDPR on special categories of data, the EDPB could have insisted on the “public interest” exception, which would ensure that the consent in the context of clinical trials must always be accompanied by safeguards contained in legislation on clinical trials. This “consent plus public interest” approach would ensure that a high level of protection exists while still not undermining the informed consent model for clinical trials.
________________________________________________________________________________________________
[1] Regulation EU 2016/679
[2] Directive 2001/20/EC
[3] Regulation EU No 536/2014
[4] Austria; Belgium; Cyprus; Denmark; Estonia; Germany; Hungary; Iceland; Ireland; Italy; Latvia; Lithuania; Malta; the Netherlands; Norway; Poland; Romania; Slovenia and Spain
[5] Croatia; Czech Republic; Finland; France; Greece and Slovakia
[6] Article 7 of the TFEU requires consistency in EU policies and activities; the theory of coherence requires that wherever possible, EU instruments be treated as a coherent legal whole. See S. Bertea, ‘The Arguments from Coherence: Analysis and Evaluation’ [2005] Oxford Journal of Legal Studies.
Authored by Patrice Navarro and Elisabethann Wright
