The European Data protection Board (“EDPB”), which is composed of representatives of the national data protection authorities and the European Data Protection Supervisor, recently adopted an Advisory Opinion (“Opinion”) on the interplay between the European Union’s Clinical Trials Regulation (“CTR”) and the General Data Protection Regulation (“GDPR”). In an upcoming blog post, we will discuss the Opinion in detail, including its significance beyond clinical trials. However, the Opinion raises one major issue that deserves highlighting here.

The EDPB’s Opinion advocates a restrictive approach to the use of consent as a legal basis for processing personal data for research activities in the context of a clinical trial protocol. This may require a change of the existing approach for many actors in the area of clinical trials and make it very difficult for commercial pharma organizations to conduct clinical trials for research purposes in the EU. A “legitimate interests” justification has inherent limits, and other justifications for the processing of sensitive data, as foreseen in the GDPR, do not in most cases fit the trial data processing conducted by private organizations for research purposes. 

• The Opinion’s view on consent. The CTR requires organizations to obtain individuals’ consent for participating in clinical trials, but the EDPB practically negates the possibility to rely on consent as the legal basis for processing personal data associated with the trial. Under the GDPR, consent must be freely given, specific, informed, and unambiguous. The EDPB insists that “free” consent means that individuals should have a real choice and control, and that there could not be free consent where there is a “clear imbalance” between the individual concerned and the organization processing his or her personal data. According to the EDPB, there will be such an imbalance of powers when participants are not in good health conditions, when they belong to an economically or socially disadvantaged group, or in any situation of institutional or hierarchical dependency. For these reasons, in the view of the EDPB, consent will not be the appropriate legal basis in most cases. 

• Legitimate interests. The EDPB considers it possible that organizations can invoke their legitimate interests to justify the processing of personal data. This requires a demonstration that organizations’ legitimate interests are not overridden by the interests or fundamental rights and freedoms of the individual concerned. Unfortunately, there are risks of a restrictive interpretation of “necessary”, and unanswered questions as to a balancing of risks to participants’ health with an organization’s research interests. Crucially, this justification alone will not be sufficient, as the data which is processed will almost always qualify as “sensitive data” in the meaning of Article 9 GDPR.
• Tasks carried out in the public interest. The EDPB considers the “performance of a task carried out in the public interest” as potential justification. These must be based on EU law or an EU country law. Yet, this legal basis (Article 6(1)(e) GDPR) would only work for commercial pharma research carried out under an EU/EU country public mandate. Relying on national law creates additional complexities and uncertainties, especially in the context of pan-European clinical studies.

Conclusion 

Organizations conducting clinical trials should carefully review their GDPR compliance approach for processing operations that are purely related to research activities. The EDPB appears to have overlooked that, its restrictive approach towards consent may make it very difficult, if not practically impossible, for commercial pharma organizations to conduct clinical trials for research purposes in the EU. This approach, which apparently seeks to “maximize” protection of data subjects’ rights, can imperil public health. It is now incumbent on the EU legislator and, in the interim, on EU countries to safeguard commercial pharma research by specifying that all clinical trials conducted in conformity with the CTR are in the public interest.