CTR - Clinical Trial Directive and Regulation

The WMO is the Dutch implementation of the Directive on Clinical Trials. This directive will in due time be replaced by the Regulation on Clinical Trials (CTR). The Directive will remain in force until three years after the enforcement of the Regulation. The Regulation still refers to Directive 95/46/EC (the Data Protection Directive) instead of to the present GDPR. When entering into force, it has to be amended in order to enable legitimate enforcement. In this chapter, we will replace reference to 95/46/EC to reference to the GDPR where necessary, presuming this adjustment in the CTR will be pursued in due time.

Recital 29 of the CTR refers to universities and other research institutes. It argues that these institutes should be able to collect data from clinical trials for future research purposes, under conditions of ethical review where appropriate. The CTR states that “in order to collect data for such purposes it is necessary that the subject gives consent to use his or her data outside the protocol of the clinical trial and has the right to withdraw that consent at any time.” The consent to which the CTR refers should be understood as consent such as requested by the DPD and the GDPR (and not the consent for participating to the clinical trial). Recital 51 of the CTR imposes security measures in order to ensure subjects rights and safety, without imposing specific measures to be taken. Recital 76 directly refers to the Data Protection Directive as framework determining the processing of personal data within a clinical trial. The recital indicates that “it is appropriate to provide that, without prejudice to Directive 95/46/EC, the withdrawal of informed consent should not affect the results of activities already carried out, such as the storage and the use of data obtained on the basis of the consent before withdrawal”. This is in line with the generic interpretation of the validity of consent and especially with respect to the validity of the data processing before consent was withdrawn.

The CTR defines informed consent as a “free and voluntary expression of his or her willingness to participate in a particular clinical trial, after having been informed of all aspects of the clinical trial that are relevant to the subject’s decision to participate”. As seen before, this consent relates to consenting to participate to the – in this situation – trial. Consenting to share data for – other – research purposes is not covered by this definition.

In a recent Opinion the European Data Protection Board (EDPB) covers the specific requirements for processing personal data within a clinical trial. The EDPB makes a distinction between primary processing and secondary processing of data. Primary processing refers to processing of data within the CT protocol. This can be for safety reporting, inspection or retention of data. Safety reporting is one of the primary conditions under which a clinical trial can be executed. It relates to the safeness of the treatment that is offered to participants. Processing data that enable this safety reporting and inspection can be based upon ground 6(1)(c) of the GDPR, i.e. the legal obligation – stemming from the CTR – to safeguard the safety of participants, in combination with GDPR art. 9(2)(i), i.e. the public interest that is served by processing these data. Concerning the use of explicit consent of the participant as exemption for processing special categories of data, the EDPB is rather cautious. In Opinion 3/2019, the EDPB states that “… it must be kept in mind that even though conditions for an informed consent under the CTR are gathered, a clear situation of imbalance of powers between the participant and the sponsor/investigator will imply that the consent is not “freely given” in the meaning of the GDPR”. The situation of imbalance of powers is further explained as referring to a situation “… when a participant is not in good health conditions, when participants belong to an economically or socially disadvantaged group or in any situation of institutional or hierarchical dependency”.

When data is processed – still as primary processing – for scientific reasons, Opinion 3/2019 indicates that a number of grounds for lawful processing can be invoked, such as explicit informed consent by the data subject , on the basis of public interest , or on the basis of the legitimate interest of the controller (the scientific research institute) in combination with invoking an exemption on the basis of public interest concerning public health or reasons of scientific interest. When data are processed for secondary use, this refers to processing outside the agreed CT protocol. This is further processing of personal data such as indicated in the GDPR. In case of further processing, the purpose of processing should be in line with the original purpose. If this is the case, further processing is permitted on the same legitimate ground as the original processing. This legitimate ground could be the – explicit – informed consent of the data subject. If further processing is different from the original purpose, a new legitimate ground for the processing needs to be presented. When, however, processing is done for reasons of scientific research the purpose is considered to be not incompatible with the original purpose. For these situations, an originally provided consent may be used as the legitimate ground for this further processing. The EDPB signals that the CTR itself arrives at a different conclusion, namely that consent should be sought from the participants when data are processed outside the original purpose. The EDPB argues differently, and stipulates that the matter will require further deliberation by the EDPB in due time.