Article
The Impact of Thailand’s PDPA on Clinical Trials: Challenges and Opportunities
March 1st, 2024
Clinical research in Thailand is growing significantly. Thailand’s diverse population and a high prevalence of certain diseases make it an ideal location for patient recruitment in clinical trials. The hospitals, research centers, and medical institutions are fully equipped with cutting-edge facilities to carry out clinical trials; they cover a diverse range of therapeutic areas, such as infectious diseases, oncology, cardiovascular diseases, and many others.
The regulatory procedures and prerequisites for carrying out clinical trials in Thailand have brought significant attention from numerous life sciences companies. Prior to commencing any clinical research, researchers and sponsors are required to obtain approval from the Thai Food and Drug Administration (FDA) to ensure the safety and well-being of participants, as well as to ensure compliance with ethical standards. Ethical approval from an Institutional Review Board (IRB) or Ethics Committee is mandatory to ensure that the study design, procedures, and informed consent process adhere to ethical standards.
The Thai government has demonstrated its support for clinical research, acknowledging its role in promoting scientific progress and enhancing healthcare. This encompasses efforts to simplify regulatory procedures and foster international investment in Thailand’s clinical research industry.
We already covered the main principles and general requirements in the previously published article, “Expand Business in Asia?”. In this Article, we will delve into the obligations that the life science sector must be mindful of and adhere to. It is important to note that non-compliance not only incurs administrative and civil penalties, but also criminal liability.
The collection, use, and disclosure of personal data in the realm of clinical trials is highly extensive and poses significant risks. It encompasses regular and sensitive data such as medical records, race and ethnicity, samples, genetic, and occasionally biometric data. The quantity of data required for a single study is substantial, regardless of the number of participants or the geographical location. The data collected can have numerous touchpoints (number of vendors involved), it may also be data related to children in the pediatric study. In this context, this large-scale processing of sensitive data requires attention. Similar to the requirements outlined in the EU GDPR, in order to comply with the PDPA, two key elements must be addressed: appointment of a Data Protection Officer (DPO) and conducting a risk assessment known as a Data Protection Impact Assessment (DPIA).
The legal basis used remains ambiguous. Articles 24 and 26 of the PDPA appear to permit the processing of personal data for scientific research, statistics, or other public interest purposes without the consent of the data subject, provided that appropriate measures are implemented. The Thai Personal Data Protection Committee (PDPC) recently issued an official Notification, which is also regarded as a supplementary law to the PDPA, specifying the necessary measures and the applicable context.
The Notification provides a definition of the “study research” and outlines the level of risk that is considered “minimum”. According to Article 24, personal data can be processed for study research and statistical purposes without the consent of the subject. On the other hand, Article 26 focuses on the processing of sensitive data without the subject’s consent when it is necessary to fulfill legal obligations and achieve objectives related to scientific research, historical, statistics, or other public interest purposes.
Nevertheless, both require implementing essential security measures which involve technical and organizational measures. These measures encompass “physical measures” and appropriate security measures to protect the rights and freedoms of data subjects as outlined in article 37(1). Additionally, it must adhere to ethical standards and legal requirements.
Article 26 of the PDPA outlines the need for additional requirements when handling sensitive data, in accordance with ethical standards such as, Belmont International Standard, Good Clinical Practice by ICH and International Ethical Guideline for Health Research involving Humans by CMOs in collaboration with the WHO.
These two articles require additional safeguards such as Pseudonymization and Encryption or other comparable security measures.
The Notification explicitly states that the Informed Consent Form (ICF) must be provided to the data subject in order to participate in the research.
Upon careful analysis of this Notification, the purpose of the processing activity under this exemption remains ambiguous. Although the scientific research indirectly serves the general public interest by advancing new knowledge, it raises the question of whether consent is still necessary if the study is intended for marketing authorization. Despite engaging in a discussion with PDPC, a conclusive response is yet to be obtained. If the subject’s consent is no longer required and it falls under the exemption, it could facilitate a sponsor’s conduct of a clinical trial in Thailand.
In addition, there are numerous other factors to consider, such as the new regulations on cross-border data transfers and other requirements that will gradually come into effect by 2024 including the obligation to appoint a Data Protection Representative and the responsibility to ensure that data subjects can exercise their rights. Researchers and sponsors must adeptly navigate these challenges to ensure the successful conduct of clinical trials without regulatory concerns.
Ultimately, when considering clinical trials in Thailand, a sponsor should establish a close collaboration with the local regulatory authorities, actively involve experienced investigators and research centers, and ensure compliance with ethical standards. Collaborating with local experts can help navigate the unique aspects of the Thai clinical research landscape as well as ensure adherence to all relevant regulatory requirements in the country.
Conclusion
MyData-TRUST, in collaboration with its partner, maintains a close working relationship and diligently monitors the latest national regulatory updates. This ensures that our clients can conduct their clinical trials in compliance with PDPA, alleviating concerns they may have. Do not hesitate to contact us at [email protected]
