Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR)

1 Opinion 3/ 2 019 c oncerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art. 70. 1. b)) Adopted on 23 January 2019 2 3 The European Data Protection Board Having regard to Article 70.1.b of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repe aling Directive 95/46/EC (hereinafter “GDPR”), Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018, Having regard to Article 12 and Art icle 22 of its Rules of Procedure of 25 May 2018, HAS ADOPTED THE FOLLOWING OPINION : 1 INTRODUCTION 1. On 8 October 2018, the European Commission (DG SANTE) has submitted to the EDPB a request for consultation under article 70 of the General Data Protection Re gulation concerning a document on “Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) 1 and the General Data Protection regulation (GDPR) 2 ” (hereafter the “Q&A). 2. While the GDPR ensures the protection of individuals with rega rd to the processing of personal data and harmonised rules on the free movement of such data; t he CTR aims at ensuring a greater level of harmonisation of the rules for conducting clinical trials throughout the EU. Notably, it introduces an authorisation p rocedure based on a single submission via a single EU portal, an assessment procedure leading to a single decision, rules on the protection of individuals, and informed consent and transparency requirements. 3. It must be recalled that the CTR entered into f orce on 16 June 2014, however, the timing of its application has been put off as it depends on the development of a fully functional EU clinical trials portal and database. After an independent audit, and a period of 6 - months starting from a confirmation n otice published by the European Commission, the CTR shall finally become applicable. Consequently, the entry into application of this regulation is currently estimated to occur in 2020. 4. In addition to this, it must be noticed that Article 93 of the CTR pro vides that “Member States shall apply Directive 95/46/EC [now repealed by the GDPR] to the processing of personal data carried out in the Member States pursuant to this Regulation” and that “Regulation (EC) No 45/2001 [repealed by Regulation 2018/1725] sha ll apply to the processing of personal data carried out by the Commission and the Agency pursuant to this Regulation”. The GDPR as well makes express references to the relevant legislation applicable to clinical trials 3 . It follows that both legislations a pply simultaneously and that the CTR constitutes a sectoral law containing specific provisions relevant from a data protection viewpoint but no derogations to the GDPR. 1 Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC, OJEU L 158 27/05/2014. 2 Regulation (EU) 2016/679 of the European Parlia ment and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJEU L 119 04/05/2016 . 3 Recital 156 and recital 161 of the GDPR. 4 5. In order to provide guidance for a consistent data protection approach to clinical trials in the EU, the Q&A of the European Commission addresses a number of topics that - with the exception of Question 11 which explains the current situation under the Clinical Trial Directive – will become more relevant when the CTR becomes applicable. Such topics include: the adequate legal basis, informed consent and its withdrawal, information of data subjects, transfers and secondary uses. While the CTR is not yet applicable, the information provided in those FAQ constitutes a good basis for a GDPR c ompliant clinical trial. 6. The EDPB understands that there is an urgent need for clarification, in particular after the entrance into force of GDPR, and has decided to concentrate its comments of the drafted Q&A on the issue of the appropriate legal basis fo r the processing of personal data in the context of clinical trials (primary use) and secondary use of clinical trial data for other scientific purposes. 2 LEGAL BASIS FOR THE PROCESSING OF PERSON AL DATA IN THE COURSE OF A CLINICAL TRIAL PROTOCOL (PRI MARY US E) 7. In the context of this Opinion, the EDPB considers that all processing operations related to a specific clinical trial protocol during its whole lifecycle, from the starting of the trial to deletion at the end of the archiving period, shall be understood as primary use of clinical trial data 4 . However, the EDPB considers that not all processing operations relating to such “primary use” of clinical trial data pursue the same purposes and fall within the same legal basis. 8. The overall objective of the CTR is to achieve a harmonised internal market as regards clinical trials and medicinal products for human use, taking as a starting point a high level of protection of health, while setting high standards of quality and safety for medicinal products b y ensuring that data generated in clinical trials are reliable and robust 5 . 9. When discussing the issue of the legal basis for the processing of personal data during the whole lifecycle of a clinical trial, the EDPB considers relevant to distinguish, two mai n categories of processing activities. In particular, processing operations purely related to research activities must be distinguished from processing operations related to the purposes of protection of health, while setting standards of quality and safet y for medicinal products by generating reliable and robust data (reliability and safety related purposes); these two main categories of processing activities fall under different legal bases. 2.1 Processing operations related to reliability and safety purpose s 10. The EDPB is of the opinion that the processing operations expressly provided by the CTR and by relevant national provisions, and which are related to reliability and safety purposes, can be considered as falling within “legal obligation(s) to which the c ontroller is subject” under Article 6(1)(c) of the GDPR. 4 It has to be noted that this broad interpretation of the primary use of data is different from the concept of primary use in Article 29 Working Party Opinion 03/2013 on purpose limitation of 3 April 2013, WP20 3, p. 21, which states that the very first processing operation, i.e. the collection of data, is primary use and any processing following collection must be considered “further processing”. 5 Recital 82 CTR and Article 3(b) CTR. 5 11. The Working Party 29 6 has discussed the conditions under which this legal basis may be applicable: the obligation must be imposed by law; the law must fulfil all relevant conditions to make the oblig ation valid and binding; the law must comply with data protection law, including the requirement of necessity, proportionality and purpose limitation; the legal obligation itself must be sufficiently clear as to the processing of personal data it requires; the controller should not have an undue degree of discretion on how to comply with the legal obligation The EDPB considers that this is notably the case for obligations relating to the performance of safety reporting under Articles 41 to 43 of the CTR, an d obligations concerning the archiving of the clinical trial master file (25 years according to Article 58 CTR) and the medical files of subjects (which is to be determined by national law according to the same provision). The same applies to any disclosur e of clinical trial data to the national competent authorities in the course of an inspection in accordance with relevant national rules (see Articles 77 - 79 CTR). 12. Therefore, the processing of personal data in the context of safety reporting or in the conte xt of an inspection by national competent authority, or the retention of clinical trial data in accordance with archiving obligations set up by the CTR or, as may be the case, relevant national laws, have to be considered as necessary to comply with legal obligations to which the sponsor and/or the investigator are subject to. 13. The corresponding appropriate condition for lawful processing of special categories of data in the context of these obligations shall be Article 9(2)(i): “ processing is n ecessary for reasons of public interest in the area of public health, such as [...] ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or member State law, which provides for suitable and spe cific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy ”. 2.2 Processing operations purely related to research activities 7 14. Processing operations purely related to research activities in the context of a cli nical trial cannot, however, be derived from a legal obligation. Depending on the whole circumstances of the trial and the concrete data processing activity, research related activities may either fall under the data subject’s explicit consent (Article 6(1 )(a) in conjunction with Article 9(2)(a)), or a task carried out in the public interest (Article 6(1)(e)), or the legitimate interests of the controller (Article 6(1)(f)) in conjunction with Article 9(2)(i) or (j) of the GDPR. C onsent - explicit consent 15. As rightly pointed out in Q&A 4, the informed consent foreseen under the CTR must not be confused with the notion of consent as a legal ground for the processing of personal data under the GDPR. 16. Provisions of Chapter V CTR on informed consent , in particula r Article 28, respond primarily to core ethical requirements of research projects involving humans deriving from the Helsinki Declaration. The obligation to obtain the informed consent of participants in a clinical trial is primarily a measure to 6 Opinion 06/2014 on the n otion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC adopted on 9 April 2014, WP 217, p. 19. 7 Article 29 Working Party Guidelines on consent under Regulation 2016/679 of 10 April 2018, p. 27 states that the notion of scientific research may not be stretched beyond its common meaning and understand that ‘scientific research’ in this context means a research project set up in accordance with relevant sector - related methodological and ethical standards, in conformity with good practice. 6 ensure th e protection of the right to human dignity and the right to integrity of individuals under Article 1 and 3 of the Charter of Fundamental Rights of the EU; it is not conceived as an instrument for data protection compliance. 17. Under the GDPR, consent must be freely given, specif ic, informed, unambiguous, and explicit consent is required when the processing of special categories of data, such as health data, are involved (Article 9(2)(a) GDPR) . In order to assess whether the individual’s explicit consent can be a valid legal basis for the processing of sensitive data in the course of a clinical trial, data controllers should duly take into account the Working Party 29 Guidelines on consent, and check if all the conditions for a valid consent can be met in the sp ecific circumstances of that trial 8 . 18. The EDPB considers that data controllers should pay particular attention to the condition of a “freely given” consent. As stated in the Working Party 29 Guidelines on consent, this element implies real choice and contro l for data subjects . Besides, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller 9 . 19. Depending on the circumstances of the clinic al trial, situations of imbalance of power between the sponsor/investigator and participants may occur. The CTR expressly addresses these risks and requires the investigator to take into account all relevant circumstances, in particular whether the potenti al subject belongs to an economically or socially disadvantaged group, or is in a situation of institutional or hierarchical dependency that could inappropriately influence her or his decision to participate 10 . 20. However, it must be kept in mind that even tho ugh conditions for an informed consent under the CTR are gathered, a clear situation of imbalance of powers between the participant and the sponsor/investigator will imply that the consent is not “ freely given ” in the meaning of the GDPR. As a matter of e xample, the EDPB considers that this will be the case when a participant is not in good health conditions, when participants belong to an economically or socially disadvantaged group or in any situation of institutional or hierarchical dependency. Therefor e, and as explained in the Guidelines on consent of the Working Party 29, consent will not be the appropriate legal basis in most cases, and other legal bases than consent must be relied upon (see below alternative legal bases). 21. Consequently, the EDPB cons iders that data controllers should conduct a particularly thorough assessment of the circumstances of the clinical trial before relying on individuals’ consent as a legal basis for the processing of personal data for the purposes of the research activities of that trial. Withdrawal of consent 22. Along the conditions for consent under both texts, the EDPB considers that the withdrawal of the informed consent , under Article 28(3) of the CTR shall not be confused with the withdrawal of consent under the GDPR. Und er the former, it is expressly provided that the withdrawal of the informed consent, which shall not affect the activities already carried out and the use of the data obtained based on informed consent before its withdrawal is “[w]ithout prejudice to the D irective 95/46/EC ” (now the GDPR). 23. Under the GDPR, if consent is used as the lawful basis for processing, there must be a possibility for individuals to withdraw that consent at any time (Article 7 (3)), and there is no exception to this 8 Article 29 Working Party Guidelines on consent under Regulation 2016/679 of 10 April 2018, as endorsed by the EDPB on 25 May 2018. 9 Idem, p.6. See also Recital 43 GDPR. 10 Recital 31 CTR. 7 requirement for sci entific research 11 . As a general rule, if consent is withdrawn, all data processing operations that were based on consent remain lawful in accordance with the GDPR (Article 7(3)); however, the controller shall stop the processing actions concerned and if th ere is no other lawful basis justifying the retention for further processing, the data should be deleted by the controller (see Article 17(1)(b) and (3) GDPR). 24. Consequently, the withdrawal of consent, in accordance with Article 7 GDPR, to the processing of personal data for research purposes must be applied taking into account other purposes of processing based on other lawful grounds. In the context of clinical trials, the data subject’s consent is limited to the processing operations purely related to res earch activities. This implies that in case of withdrawal of consent by an individual, all research activities carried out with the clinical trial data relating to that individual shall cease. However, the withdrawal of consent does not affect the processi ng operations that are based on other lawful grounds, in particular legal obligations to which the sponsor/investigator are subject such as the ones related to safety purposes (see point 1.1 above). Task carried out in the public interest or legitimate interest of the controller 25. The EDPB considers that as an alternative to data subject’s consent, the lawful grounds of processing provided under Article 6(1)(e) or 6(1)(f) are more appropriate. 26. The processing of personal data by data controller s could be considered as “ necessary for the performance of a task carried out in the public interest ” pursuant to Article 6(1)(e) GDPR. Article 6(3) GDPR further provides that this basis shall be laid down by Union or Member State law and that the purpose of the processing shall be laid down in that legal basis. The processing of personal data in the context of clinical trials can thus be considered as necessary for the performance of a task carried out in the public interest when the conduct of clinical t rials directly falls within the mandate, missions and tasks vested in a public or private body by national law 12 . 27. For all other situations where the conduct of clinical trials cannot be considered as necessary for the performance of the public interest task s vested in the controller by law, the EDPB will consider that the processing of personal data could be “ necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject ” following Article 6(1)(f) GDPR. 28. For the processing of special categories of data, the legal basis identified under Article 6 shall be applied only if Article 9 GDPR provides for a specific derogation from the general prohibition to process special categories of data. The EDPB considers that depending on the specific circumstances of a clinical trial, the appropriate Article 9 condition for all processing operations of sensitive data for pure ly research purposes could either be “ reasons of public interest in the area of public health [ ... ] on the basis of Member State law ” (Article 9(2)(i)), or “ scientific ... purposes in accordance with Article 89(1) based on Union or Member State law ”(Articl e 9(2)(j)). 11 WP29, Guidelines on consent under Regulation 2016/679, 28 November 2017, WP259. 12 Recital 45 GDPR states that it does not require a specific law for each individual processing (i.e. for each clinical trial). A law as a basis for several processing operati ons based on the performance of a task carried out in the public interest may be sufficient. See also Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC adopted on 9 April 2014, WP 217, p. 21 - 22. 8 3 SECONDARY USES OF CL INICAL TRIAL DATA OU TSIDE THE CLINICAL TRIAL PROTOCOL FOR S CIENTIFIC PURPOSES 29. The CTR addresses specifically the issue of secondary use in its Article 28(2) with a specific focus on consent. It refers solely to situations wh ere the sponsor may want to process the data of the clinical trial subject “outside the scope of the protocol”, but only - and “exclusively” - for scientific purposes. The CTR considers consent for this specific processing purpose should be sought from the data subject or his/her legally designated representative at the time of the request for informed consent for participation in the clinical trial. However, as discussed above with regard to provisions of Chapter V CTR on informed consent , consent foreseen in article 28(2) CTR is not the same consent referred to in the GDPR as one of the legal basis for the processing of personal data, regardless of whether it is or not the legal ground used for the primary processing. 30. Therefore, as the European Commission points out in its Q&A, namely in question 7, if a sponsor or an investigator would like to further use the personal data gathered for any other scientific purposes, other than the ones defined by the clinical trial protocol, it would require another specif ic legal ground than the one used for the primary purpose. The chosen legal basis may or may not differ from the legal basis of the primary use. 31. However, the EDPB considers that this approach excludes, in all circumstances, the applicability of the so - call ed presumption of compatibility provided under Article 5(1)(b) GDPR. This Article provides that where data is further processed for archiving purposes in the public interest, scientific, historical research or statistical purposes, these shall a priori not be considered as incompatible with the initial purpose, provided that it occurs in accordance with the provisions of Article 89, which foresees specific adequate safeguards and derogations in these cases. Where that is the case, the controller could be ab le, under certain conditions, to further process the data without the need for a new legal basis 13 . These conditions, due to their horizontal and complex nature, will require specific attention and guidance from the EDPB in the future. For the time being, t he presumption of compatibility, subject to the conditions set forth in Article 89, should not be excluded, in all circumstances, for the secondary use of clinical trial data outside the clinical trial protocol for other scientific purposes. 32. In any event, even when the presumption of compatibility will find to apply, the scientific research making use of the data outside the protocol of the clinical trial must be conducted in compliance with all other relevant applicable provisions of data protection as sta ted under Article 28(2) CTR. Therefore, the controller shall not be deemed exempt from the other obligations under data protection law, for example with regard to fairness, lawfulness (i.e. in accordance with applicable EU and national law), necessity and proportionality, as well as data quality. 4 C ONCLUSION 33. To conclude, the EDPB recommends modifying the Q&A when discussing the lawful grounds for processing to distinguish the processing activities related to reliability and safety that can be directly derive d from legal obligations of the controller and which fall within the legal basis of Article 6(1)(c) in conjunction with Article 9(1)(i) of GDPR. 13 Recital 50 GDPR. 9 34. For all other processing activities, identified in this Opinion as processing operations purely related to rese arch activities, the Q&A should be modified to reflect three alternative legal bases, depending on the whole circumstances attached to a specific clinical trial: - a task carried out in the public interest under Article 6(1)(e) in conjunction with Article 9 (2), (i) or (j) of the GDPR; or - the legitimate interests of the controller under Article 6(1)(f) in conjunction with Article 9(2) (j) of the GDPR; or - under specific circumstances, when all conditions are met, data subject’s explicit consent under Article 6 (1)(a) and 9(2)(a) of the GDPR. For the European Data Protection Board The Chair Andrea Jelinek