The contact details of the sponsor’s DPO do not have to appear on the ICFs !

The contact details of the sponsor’s DPO do not have to appear on the ICFs !

Thomas Roche

Thomas Roche

March 5, 2020 03:21 AM

The GDPR is often used in an inappropriate way and unfortunately in a less than pragmatic fashion. The legal system is not a binary system, it is far more complex than that. What should be done where two legal frameworks apply to a single situation and these legal frameworks seem to contradict each other ? For instance, how should we react if another legal provision conflicts with those provided for in the GDPR ? Long before us, some wise old men reached a decision in this regard and decreed : “specialia generalibus derogant”. If two laws can apply to a certain situation, the specific law has priority over the general law. Within the context we are referring to, the GDPR is the general legal framework as its very title testifies incontrovertibly to this : “GENERAL data protection regulation”, whereas the specific legal framework will thus be the regulations applicable to clinical trials. According to Article 13 of the GDPR, “where personal data relating to a data subject are collected from the data subject, the controller shall […) provide the data subject with […] the contact details of the data protection officer…”. The same principle also applies according to Article 14 of the GDPR “where the personal data have not been obtained from the data subject”.At this juncture, a subtle distinction regarding clinical trials should be noted, which does not allow the strict compliance with the provisions of the GDPR, namely the fact that this information is not provided to the data subjects directly by the data controller, “at the time the data concerned are obtained”. It is in fact the investigator who is in direct contact with the data subject, who will inform the latter verbally and provide an information form, prepared by the sponsor often in conjunction with the coordinating investigator. For its part, the sponsor does not have, at any time, direct contact with data subjects included in the trial, nor does he have access to their identity. The information regarding the trial and the data subjects necessarily passes through an intermediary, i.e. the investigator who is managing and overseeing the implementation of the trial. Since 25 May 2018, we have fortunately not found any changes to information forms providing that this information must be imperatively provided by the sponsor. However, since this date, many people consider that the information forms must state the identity and contact details of the sponsor’s DPO. Such information would therefore enable people taking part in trials, in application of item 4 of article 38 of the GDPR, to contact the sponsor’s DPO with regard to any question about the processing of their personal data and above all about the exercise of the rights they have under the GDPR. For those who have been working in the field of clinical trials for some years, doesn’t this situation seem rather shocking ? Indeed, under these circumstances, the sponsor’s DPO could be in direct contact with volunteers and patients taking part in clinical trials, although trials are conducted by an investigator who is, as a basic principle, a doctor. Even though the DPO is bound by professional secrecy and must perform his duties completely independently, is there any justification for a DPO to be the recipient of information relating to the health of people taking part in a clinical trial ? What would the DPO do with this information ? He would have no other option than to invite the data subject to contact the investigator and his team as only they have access to the volunteer’s data and in particular the raw data and observation logs. They alone are able to enforce the data subjects’ exercise their right to access, correct, oppose or even, within certain limits, restrict the use of their data. Given these conditions, is it useful to increase the number of intermediaries and to disclose to the sponsor’s DPO, whether in-house or not, the identity of a person taking part in a clinical trial who is for example testing a new chemotherapy ? This solution eventually results in an increase in the risk of data breach and thus a reduction in the protection of data about people taking part in a clinical trial. Furthermore, we should bear in mind that specific rules exist to limit these risks and the adverse effects of the GDPR, namely the provisions regarding the processing of data concerning health, and those regarding medical confidentiality which are fully applicable to the field of clinical trials. An investigator in this situation remains first and foremost a doctor bound by medical confidentiality. In this respect it should be borne in mind that the provisions of the French Public Health Code, namely its article R4127-4, provide that : “The professional confidentiality instituted in the interests of patients is incumbent on every doctor at the conditions established by law.The confidentiality covers everything which the doctor comes to know in the exercise of his profession, i.e. not only what he is told, but also what he sees, hears and understands”. Moreover, article L. 1110-4 of the same code provides that “Except in the event of exemptions expressly provided by law, this confidentiality covers all personal information coming to the knowledge of the professional, and any member of the personnel of these establishments, services or organisations and any other person in contact, by his activities, with these establishments or organisations. It is required of all professionals working in the healthcare system”. However, there is no specific provision allowing this confidential information to be shared with the sponsor’s DPO. It is thus surprising that investigators agree to the contact details of the sponsor’s DPO being provided on information forms considering the risks of breach of medical confidentiality, by which they are legally bound. National and international texts governing clinical trials and in particular the guideline for good clinical practice (GCP) are clear on this matter : “1.16 - Confidentiality“Prevention of disclosure, to other than authorized individuals, of a sponsor’s proprietary information or of a subject’s identity”. (GCP ICH E6) GCP also provide that only the investigator may hold, during and at the end of the trial, a complete list of the volunteer identification codes (8.3.21, 8.3.22 and 8.4.3). This list (concordance table) allows all the subjects taking part in the trial to be identified in case a follow-up should be necessary and this list must remain confidential. Only the supervisory authorities and Clinical Research Associates (CRA) or auditors can, subject to certain conditions, access the identity of people taking part in a clinical trial. “5.15 – Record Access5.15.1 The sponsor should ensure that it is specified in the protocol or other written agreement that the investigator(s)/institution(s) provide direct access to source data/documents for trial-related monitoring, audits, IRB/IEC review, and regulatory inspection.5.15.2 The sponsor should verify that each subject has consented, in writing, to direct access to his/her original medical records for trial-related monitoring, audit, IRB/IEC review, and regulatory inspection” (GCP ICH E6) Direct access consists of permission to examine, analyse, verify and reproduce all the files and reports needed for the assessment of a clinical trial. Anyone with direct access to these documents must take all reasonable precautions, within the limits of applicable regulatory requirements, to ensure the confidentiality of the identity of the subjects. No national, European or international text gives the sponsor’s DPO permission to access the identity of people taking part in clinical trials. However, by requiring the provision of the identity and the contact details of the sponsor’s DPO on the information form, the DPO is potentially given access (if contacted by a volunteer) to information which he should not know, namely the volunteer’s identity, which could be analysed as a form of incitement to breach medical confidentiality. Furthermore, the indication of the DPO’s contact details on the information form does not appear useful as the volunteer/patient can easily contact the DPO without this information being provided on the ICF. This identification remains possible since the sponsor must, in application of item 7 of article 37 of the GDPR, publish the contact details of the DPO and notify them to the supervisory authority. Therefore, by knowing the identity of the sponsor, it is thus normally possible to identify the sponsor’s DPO, either through basic research or by contacting the sponsor directly. Thus, if a volunteer/patient feels that he has suffered a prejudice relating to his participation in a trial or that his rights have not been respected by the investigator, he may still be able to contact the sponsor’s DPO to enforce his rights.

Finally, in conclusion and to further prove the relevance of the adage “specialia generalibus derogant”, let us just review a few facts :

  • The investigator is responsible for the information about people who may be taking part in a trial and, following a cooling-off period, for obtaining their consent.
  • The investigator, in his capacity as doctor or qualified person, remains at all times bound by the requirement of confidentiality regarding the state of health of the person taking part in the trial and can only agree to share this information with people who are expressly authorised by law.
  • As such, the investigator is the sole and exclusive contact for people taking part in clinical trials and the volunteer can only exercise the rights granted by the GDPR through the investigator

Therefore, to ensure the protection of data about people taking part in clinical trials and to comply with the GDPR, the contact details of the sponsor’s DPO must not be stated on the information forms !

Related Articles

Privacy Practice

by Casey Waughn

Data protection is all the rage among tech companies and state, national (and even transnational) governments alike. Is it a passing fad or here to stay? And how should businesses and groups of all sizes handle compliance with a blizzard of new laws?

Data Protection Prompt New Privacy Laws

New England States With Incoming Legislation

by Gregory Sirico

Best Lawyers takes an in depth look at newly proposed bills, litigation and cases coming out of four New England states.

New England Laws Taking Effect in 2022

An Interview With Bastian Finkel of BLD Bach Langheid Dallmayr, Germany's 2019 "Law Firm of the Year" Winner in Insurance Law

by Best Lawyers

A look at the new European policies changing the insurance landscape in Germany.

BLD Bach Langheid Dallmayr Interview

Recent Developments on Privacy and Data Protection in Brazil

by Ricardo Barretto Ferreira da Silva and Camila Taliberti Ribeiro da Silva

A change of paradigm is urgent and requires a robust legislation on personal data protection.

Privacy and Data Protection Brazil

My Data My Rules: An Overview of Data Protection in Brazil

by Fábio Pereira

My Data My Rules

Trending Articles

Announcing the 2023 The Best Lawyers in America Honorees

by Best Lawyers

Only the top 5.3% of all practicing lawyers in the U.S. were selected by their peers for inclusion in the 29th edition of The Best Lawyers in America®.

Gold strings and dots connecting to form US map

Best Lawyers: Ones to Watch in America for 2023

by Best Lawyers

The third edition of Best Lawyers: Ones to Watch in America™ highlights the legal talent of lawyers who have been in practice less than 10 years.

Three arrows made of lines and dots on blue background

Announcing the 2023 The Best Lawyers in Canada Honorees

by Best Lawyers

The Best Lawyers in Canada™ is entering its 17th edition for 2023. We highlight the elite lawyers awarded this year.

Red map of Canada with white lines and dots

Announcing the 2022 Best Lawyers® in the United States

by Best Lawyers

The results include an elite field of top lawyers listed in the 28th Edition of The Best Lawyers in America® and in the 2nd Edition of Best Lawyers: Ones to Watch in America for 2022.

2022 Best Lawyers Listings for United States

Famous Songs Unprotected by Copyright Could Mean Royalties for Some

by Michael B. Fein

A guide to navigating copyright claims on famous songs.

Can I Sing "Happy Birthday" in Public?

Announcing the 2022 Best Lawyers in Canada™

by Best Lawyers

The results include an elite field of top lawyers listed in the 16th Edition of The Best Lawyers in Canada™ and 1st Edition of Best Lawyers: Ones to Watch in Canada.

Announcing the 2022 Best Lawyers in Canada™

Choosing a Title Company: What a Seller Should Expect

by Roy D. Oppenheim

When it comes to choosing a title company, how much power exactly does a seller have?

Choosing the Title Company As Seller

What the Courts Say About Recording in the Classroom

by Christina Henagen Peer and Peter Zawadski

Students and parents are increasingly asking to use audio devices to record what's being said in the classroom. But is it legal? A recent ruling offer gives the answer to a question confusing parents and administrators alike.

Is It Legal for Students to Record Teachers?

All Eyes to the Ones on the Rise

by Rebecca Blackwell

Our 2023 honorees recognized in Best Lawyers: Ones to Watch™ in America tell us more about how their path to law formed, what lead them to their practice areas and how they keep steadfast in their passion to serve others.

Person walking between glass walls towards window

The Real Camille: An Interview with Johnny Depp’s Lawyer Camille Vasquez

by Rebecca Blackwell

Camille Vasquez, a young lawyer at Brown Rudnick, sat down with Best Lawyers CEO Phillip Greer to talk about her distinguished career, recently being named partner and what comes next for her.

Camille Vasquez in office

Caffeine Overload and DUI Tests

by Daniel Taylor

While it might come as a surprise, the over-consumption of caffeine could trigger a false positive on a breathalyzer test.

Can Caffeine Cause You to Fail DUI Test?

Announcing the 2022 "Best Law Firms" Rankings

by Best Lawyers

The 2022 “Best Law Firms” publication includes all “Law Firm of the Year” recipients, national and metro Tier 1 ranked firms and editorial from thought leaders in the legal industry.

The 2022 Best Law Firms Awards

Wage and Overtime Laws for Truck Drivers

by Greg Mansell

For truck drivers nationwide, underpayment and overtime violations are just the beginning of a long list of problems. Below we explore the wages you are entitled to but may not be receiving.

Truck Driver Wage and Overtime Laws in the US

Best Lawyers: Ones to Watch in Canada 2023

by Best Lawyers

The year 2023 marks the second edition of Best Lawyers: Ones to Watch in Canada, highlighting professionals earlier in their legal careers all across Canada.

Blue background with white stairs formed out of lines

Announcing The Best Lawyers in Australia™ 2023

by Best Lawyers

The results include an elite field of top lawyers and firms from Australia.

The Best Lawyers in Australia™ 2023

Press and Publicity: How Television and Social Media Impact Legal Careers

by Justin Smulison

In recent years, with social media giving minute by minute reporting, many lawyers are finding themselves thrust into a spotlight they never planned for. How are lawyers grappling with unexpected stardom, media coverage and merciless influencers?

Close up of camera at news station