Data protection in multi-center clinical trials

At the end of January 2019, the European Data Protection Board (EDPB) released guidance on the interplay between the EU General Data Protection Regulation No 2016/679 (GDPR, effective as of 25 May 2018) and the EU Regulation No 2014/536 on clinical trials on medicinal products for human use (CTR, enters into force in spring 2020). Data protection is one of the ethical principles for medical research involving humans (cf. Helsinki Declaration, 2013 version, margin no. 32).

Particularly relevant is the question of which permission elements under GDPR (e.g. consent) data processing by sponsors and researchers falls. Both the GDPR and CTR are applicable. Regarding permission elements, it is clarified that “informed” consent to take part in a clinical study in accordance with CTR is an ethical and procedural duty and must not be confused with consent to process data under GDPR. Due to the lack of voluntary agreement, consent to process data in accordance with GDPR may even prove invalid for clinical trials.

Swiss companies that sponsor clinical trials within the EU either solely or as part of a multi-centre setup must also consider these principles. According to Swissethics, the Swiss ethics committee for human research, it can generally be assumed that the principle of adequacy applies between Swiss and EU law; patients in Switzerland do not need to be informed additionally and newly about EU data protection rights.

Stakeholders should also keep an eye on the ongoing revisions to the Swiss Human Research Act (HRA) and the Swiss Federal Act on Data Protection (FADP).