“Where the sponsor processes personal data of data subjects in the EU, including in the context of managing the clinical trial, GDPR is fully applicable, including the obligation to designate a representative in the EU.”
The European Commission has updated FAQs on the interplay between the forthcoming Clinical Trials Regulation (CTR) and GDPR.
Key Takeaways:
- Each trial subject should receive information related to the clinical trial as required by the CTR as well as GDPR. Sponsors may need to provide, where necessary, additional information to the data subject participating in the ongoing clinical trials.
- The processing of personal data in the context of clinical trials can be considered as necessary for the performance of a task carried out in the public interest when the conduct of clinical trials directly falls within the mandate, missions and tasks vested in a public or private body by Union or national law.
- In other cases, the legal basis may be the legitimate interest of the sponsor or the subject’s consent.
- The GDPR rules on cross border transfer apply when EU entities transfer personal data to non-EU entities in the context of a trial.