Article
Are the UK Clinical Trial Agreements compliant with the EU & UK GDPR after Brexit?
July 28, 2021
At the beginning of this year the UK authorities have released a new version of the standard Clinical Trial Agreements for industry-sponsored clinical trials. This article advises how to use these templates and evaluate their compliance with the EU and UK GDPR.
1. What templates have been updated?
Even though the attention of GDPR professionals (and not only) is focused on the assessment of the so long-awaited new Standard Contractual Clauses (SCCs) and the recent adequacy decision EU to UK adopted by the European Commission on 28th of June 2021, the organisations operating in the clinical trial sector should be aware of an additional update coming from the land of Albion occurred in the present year.
A new version of the standard Clinical Trial Agreements (“mCTAs”) for industry-sponsored clinical trials has been developed by the National Health Authority in cooperation with the National Health System (“NHS”) of the United Kingdom, as well as industry stakeholders, and released in January 2021.
These templates have replaced the previous version released in March 2020 for industry-sponsored clinical trials and can be used for trials involving NHS patients under the duty of care of hospitals located throughout the UK Health Services.
Although the previous version is still accepted for the Integrated Research Application System (“IRAS”) submissions, MyData-TRUST strongly recommends Sponsor(s) and Clinical Research Organisation(s) (“CRO”) to adopt the latest 2021 version at their earliest opportunity.
The updated templates taken into consideration in this blog are the following:
- Model Clinical Trial Agreement, a bipartite standard contract used by industry Sponsors and NHS organisations running contract clinical trials;
- Clinical Research Organisation model Clinical Trial Agreement, a tripartite standard contract, used by industry Sponsors, clinical research organisations separately contracted by them to undertake site management responsibilities, and NHS organisations running the clinical trials.
The British health authorities have also released very useful Guidance Notes (“Guidance”) providing an overview of the provisions included within the templates and of how the mCTAs should be used. The Guidance is a precious tool that Sponsors undertaking a clinical trial in the UK should consider, to assess whether the mCTAs are applicable to the specific study, as these templates cannot be used in all cases. Indeed, for instance, the mCTAs are not for use in non-commercial studies funded or sponsored by charities, government departments or research councils, whether or not such studies involve NHS patients, and whether or not they are carried out by NHS organisations.
2. Are the mCTAs mandatory or subject to modifications?
As underlined by the Guidance, the use of the mCTAs is not mandatory, but it is strongly recommended by all UK Health Departments. Hence, Sponsor(s) and Participating Organisation(s) are allowed to use an agreement not based on a model template.
However, any commercial Sponsor should be aware of the potential complications that are often encountered in the practise when using a non-standard template to govern industry-sponsored clinical trials. The issues may have a different nature ranging from long and frustrating negotiations to the risk that the clinical trial may not start as planned by the investors if an agreement is not concluded with the Participating Organisation(s). Also, in the worst cases, the trial may not start at all if certain terms and conditions are not approved by the competent ethics Committees.
There are some sections of the mCTAs where the parties can select specific options and templates can be appended. However, commercial Sponsors should be aware that, in principle, any request to modify the mCTAs and/or use any non-standard agreement is likely to result in significant delay. Indeed, any request for a modification is accepted only in exceptional circumstances, and upon approval of the competent authorities. Moreover, NHS organisations are not obliged to agree with the modified agreement. Thus, all the UK Health Departments recommend that the mCTAs should not be subject to any modification.
The Guidance states that any request by a Sponsor or CRO to modify the mCTAs and/or to use any agreement to contract with a clinical site (other than the appropriate mCTA) should be disclosed in the IRAS submission providing a version of the template proposed for use, with tracked changes and details justification. An unmodified use of the mCTAs is therefore strongly recommended.
3. Are the templates compliant with the EU and UK GDPR?
It is now apparent that governing the implications of data protection aspects is a crucial matter when planning and negotiating the deployment of a new clinical trial, namely if its performance falls under the scope of the European or the UK General Data Protection Regulations (for instance, because the Sponsor is established respectively in the EU or in the UK or conducts a clinical trial in these territories).
Since the previous version of the mCTAs, the NHS took into consideration the introduction of the EU GDPR and the revised data protection framework of the United Kingdom (i.e. the Data Protection Act 2018). The current version of the mCTAs includes general provisions related to the compliance with both EU and UK data protection laws, and take into account the impact of the Brexit on the domestic data protection framework. In fact, in drafting the mCTAs, the British authorities have taken into explicit consideration the EU and UK GDPR and have foreseen the adoption of an adequacy decision of the UK by the European Commission (which has been officialized on 28th of June 2021). Under a data protection standpoint, the mCTAs are thus not only perfectly aligned to the current legislative scenario but also GDPR compliant. The mCTAs, taken together with the relevant protocol, constitutes indeed a data processing agreement compliant with Article 28 GDPR.
Conclusion
It is also important to note that the mCTAs frame exclusively the processing activities of the personal data collected from the individuals enrolled for the clinical trials. Whereas the personal data of the staff involved in the trial is not foreseen by the mCTAs and it may need to be framed otherwise.
The mCTAs also establish additional responsibilities on Sponsor(s) to enhance the protection of the data processed during clinical trials, such as regarding the confidentiality of the data, and the adoption of security measures to prevent and mitigate data breaches and identify and resist cyber-attacks.
It is anticipated that the mCTAs will be kept under ongoing review and MyData-TRUST will continue to monitor the evolution and developments in the UK clinical sector.
If you are an organisation operating in the clinical trial sector looking for advice or additional information on this subject or on the measures that you should consider to be EU or UK GDPR compliant, contact MyData-TRUST.
We will be pleased to assist you.
