On February 2nd, the European Data Protection Board published a series of responses related to inquiries prepared by the European Commission (justice and consumer section). These consultations are aimed at the EDPB solving questions about the protection of personal data used in clinical research.
European Data Protection Board
The document is divided into six different sections that are developed in various paragraphs and contain answers to questions ranging from ethical issues, informed consent to anonymization processes, and the collection and processing of personal data obtained in medical research.
Regarding informed consent and data processing, special focus is placed on its legal basis and on the distinction between informed consent and the legal basis of consent required under the standards of the General Data Protection Regulation, both terms being, complementary to such protection; and the need to have a special consent from the patient when there is no other way out than to resort to the treatment that the research is developing, to improve the quality of life of the subject.
The same happens when data controllers conduct clinical trials in different State Members of the EU, and it is necessary to homogenize the legal basis of all of them -when conducting the project- to comply with the GDPR standards and their own localisms.
An interesting topic that the document tries to elucidate, although it will be left to a later consultation, is the possibility of extending the consent of the owner of the data – the subject of the trial – extracted in one trial, for other trials of the same nature.
Related questions about the Data Protection document
Regarding obtaining broad consent in terms of clinical trials, the EDPB refers in a certain way to recital 33 of the GDPR, in order to minimize the requirements of specific consent when the purpose of the data processing cannot be determined at an initial stage of harvest.
Finally, the document refers to relative issues such as:
1) The use of the information obtained directly from the owner of the data for other purposes than those originally reported and if necessary and in which cases -and how-, must comply with the requirement of transparency.
2) The application of processes of pseudonymization and anonymization of personal data in clinical trials.
3) The processing of specific categories of data and their treatment on a large scale during clinical trials.
For further information or professional advice regarding clinical trials, legal requirements, compliance, and data protection, you can contact our Moeller’s Legal Department Members in charge of this area through our Relationship Managers Vivien Racy and/or Vivianne Cardoso, following this link.
As announced by the Argentine authorities, the country has been chosen by some international laboratories, in order to test the effectiveness of vaccines against the coronavirus, which causes the disease known as COVID-19, by carrying out a series of tests on a sample of people, taking as parameters issues such as age, sex, previous disease conditions, among other factors.
In Argentina, there is a specific regulatory framework for conducting tests on the human body, which includes not only common law – civil law – but also specific rules and even provisions of public bodies that regulate issues related to said tests.
The main rules applicable to the development of this type of activities – going from the most general to the most specific – will be succinctly developed, in which are immersed questions about the disposition of the body itself, informed consent, transfer of personal data, sensitive data processing
a) Law 26,994. Civil and Commercial Code.
The civil and commercial code is applicable to the case of informed consent, regulating the acts of disposition that a person can carry out on the body itself, including investigations in human beings.
Article 58 establishes the requirements that need to be carried out when a person is a study subject or participant in medical research in humans through interventions, such as treatments, prevention methods, diagnostic or predictive tests, whose efficacy or safety are not scientifically proven.
Article 59 for its part, regulates informed consent regarding medical acts and health research.
b) Law 25326. Protection of Personal Data.
The conduct of clinical trials also involves sensitive personal data, by relating such trials to very personal and fundamental issues related to the dignity of the person, which have the status of human rights.
In Argentina, the law that regulates the protection of personal data in general, and sensitive data in particular is Law 25326.
This law establishes that sensitive data is “… Personal data that reveals the racial and ethnic origin, political opinions, religious, philosophical or moral convictions, affiliation, and information regarding health or sexual life.”
Likewise, in its article 7, when dealing with the category of data, and when referring to sensitive data, the law prescribes the following: “ARTICLE 7 – (Category of data). 1. No person can be forced to provide sensitive data. 2. Sensitive data can only be collected and processed when there are reasons of general interest authorized by law. They may also be treated for statistical or scientific purposes when their holders cannot be identified. ”
In section 2, the law refers to the process of data anonymization that consists of dissociating the data itself in relation to the determined or determinable person, holder of that data, through a certain process.
Article 8 of the law also mandates that, regarding health-related data, “Public or private healthcare establishments and professionals linked to the health sciences may collect and process personal data related to the physical or mental health of patients who come to them or who are or have been under treatment by them, respecting the principles of professional secrecy. “
Regarding the consent of the owner of personal data, Article 5 of the Data Protection Law prescribes that “(…) the free, express and informed consent will be required, which must be in writing, or by any other means that allows match it, according to the circumstances. The aforementioned consent given with other declarations must appear expressly and prominently, prior notification to the requested data, of the information described in article 6 of this law. “
Specifically speaking of international personal data transfer –sensitive data in particular-, article 12 exceptionally authorizes the transfer of said type of data only in an epidemiological investigation, as long as it is carried out under the terms of subsection e) of Article 6 –only when an anonymization procedure is applicable to the data collected-.
c) Resolution 1480/2011 and Disposition 6677/2010 from the Health Regulatory Authority –ANMAT-
c.1) Res. 1480/2011, Point A3. provides a definition of what informed consent has to be considered when a clinical trial is being carried out. The rule establishes that “As a general principle, consent must be obtained for all research involving human beings or carried out with biological samples or personal data.” In connection with this, the test subject will have to be informed the measures that will be taken to protect the confidentiality of personal data.
Regarding the confidentiality of the information obtained from the test subjects, point A6 prescribes that personally identifiable data should not be used when a study can be done without it. When it is necessary to record personal identification data, researchers must justify that need. For this purpose the consent has to be obtained. Furthermore, point A8. Regarding the management of the data and the results, prescribes the obligation for the researches to secure the personal data.
c.2) Disposition 6677/2010 from the Argentinean Health Regulatory Authority. Regime of Good Clinical Practices for Clinical Pharmacology Studies.
This provision states:
- a) That researchers must ensure the confidentiality of the information in the stages of preparation, execution and completion of the study, as well as the identity of the people incorporated into it;
- b) That the protocols contain confidentiality considerations;
- c) That it is an indispensable requirement for the approval of a clinical trial, the presentation of an informed consent form in which the person is informed: objectives, methods, advantages, therapeutic alternatives and possible risks inherent in the study and that it is free to withdraw their consent to participate, at any time, without explaining the causes.
As a corollary of this report, in order to carry out clinical trials in Argentina on people, the following aspects must be taken into account:
a) Minimum consent requirements.
- The confidential nature of the information related to the study, and the personal data of the patient.
- The objectives, methods, and potential benefits provided in the study.
- Therapeutic alternatives.
- The possible risks inherent in the trial, and the damages that may be caused to the patient.
- The freedom of the participant to withdraw their consent at any time, without explaining the causes or resulting in harm to them.
- That the researcher will provide the medication free of charge in the study.
- That if the patient / healthy volunteer cannot provide consent on their own, it must be obtained from their legal representative.
- That the researcher will bear the costs arising from the clinical investigation, both the expenses of the procedures used for the study and the damages caused to the patient as a consequence of their participation.
- That the signing of the informed consent does not imply the resignation of the patient to any of the rights provided in the current legal regulations.
b) Data Protection Principles that have to be complied with during Clinical Trials:
- The obtention of the informed consent;
- The rights that the subject has regarding his personal and sensitive data;
- The informed consent has to include the right of professional secrecy;
- Indicate the pseudonymization and anonymization procedures;
- The right of the person to access, control, rectify and erase their personal data from the database;
- Respect the principle of data quality and the purpose of its collection