Q&A document on the interplay between the Clinical Trials Regulation and the GDPR

The document contains guidelines on the interaction between the two Regulations which will become relevant when the CTR becomes applicable, except for question 11 which refers to the current regime under the Clinical Trial Directive.

The note contains general obligations under the CTR as regards personal data and addresses the following issues: 

• The data controller (sponsor/clinic-institution if the investigator) is responsible to implement the appropriate technical and organizational measures to ensure and to demonstrate that the personal data is processed in accordance with the GDPR.
• Distinction should be made between processing operations purely related to research activities and processing operations to the purpose of protection of health, as the activities fall under different legal basis.
• Distinction should be made between the requirement for consent for a subject to participate in a clinical trial and the requirements for a lawful processing of personal data under the GDPR.
• The Withdrawal of consent under the CTR does not affect the processing operations that are based on other lawful grounds, especially the legal obligations which the sponsor/investigator are subject to.
• The implications for the use of personal data outside the protocol of the clinical trial.
• Processing of personal data in the context of emergency clinical trials.

This Q&A document reflects the state of play of the opinion adopted on 23 January 2019 by the European Data Protection Board (EDPB), an independent European body, which contributes to the consistent application of data protection rules in the European Union and promotes cooperation between supervisory boards. It provides useful guidelines on the interplay between the CTR and the GDPR in relation to the processing of personal data of people taking part to clinical trials. Also, it tries to clarify some reasonable doubts on the application of the appropriate provisions, considering the overlapping and interactions between the CTR and the GDPR.

The Clinical Trials Regulation is set to replace the Clinical Trials Directive. Although the Regulation entered into force on 16 June 2014, it will become applicable depending on the development of a fully functional EU clinical trials portal and database, which will be confirmed by an independent audit. The Regulation will come into application six months after the European Commission publishes a notice of this confirmation. The entry into application of the Regulation is currently estimated to occur in 2020.