GDPR and Clinical Trials Amid COVID-19

5/26/2020

coronavirus-5064371_1920.jpg

The World Health Organization (WHO) is recommending using telehealth during the COVID-19 pandemic. To keep subjects and site personnel safe, many sites have transitioned to using telehealth for study visits. What about safeguarding data and privacy? The General Data Protection Regulation (GDPR) has some stringent rules for collecting or processing data which includes during the conduct of a clinical trial. The data subject needs to know about any risks, safeguards, and rights they have regarding their data.

GDPR is applicable for all businesses in the European Union (EU), but also any business who is collecting or processing data of an EU subject. This then applies to any study conducted in the EU. GDPR allows telehealth under certain conditions (example). The information must still be lawfully collected, which would be covered by the subject signing the consent to participate in the study and complete study visits, with permission for collection and processing of certain data. Additionally, the data is needed for compliance with regulatory authorities’ requirements to monitor subjects’ safety, for inspections, and for data retention.

Telehealth solutions need to meet the principles of GDPR:

  • Lawful, fair, and transparent processing

  • Purpose limitation

  • Data minimization

  • Accurate and up-to-date processing

  • Limitation of storage in a form that permits identification

  • Confidentiality and security

  • Accountability and liability

Telehealth also needs to be compliant with any regional requirements under the ePrivacy Directive. Even during the pandemic, those involved in clinical trials need to ensure the protection of the subjects’ data. According to the statement by the European Data Protection Board (EDPB), only data that is necessary to complete the objectives should be obtained.

Given the requirements for the rights of data subjects in the European Union, telehealth for subject visits is more challenging and complex than in the United States, where the Office for Civil Rights (OCR) released an Enforcement Discretion for good faith use of telehealth during the crisis. To learn more about this, read our blog here. Telehealth may be employed more frequently even after the crisis and more guidance on how to proceed is likely to follow.

For the latest on EMA’s guidance on remote monitoring amid COVID-19 restrictions, visit our blog here.

- The Clinical Pathways Team

Enjoy this blog? Please like, comment, and share with your contacts.