Are GDPR and further scientific research compatible?

Innovation is of utmost importance part in clinical trials, as highlighted by the pandemic context we experienced the last months, it allows to develop new medicines and treatments by testing products on participants and collecting data from them -as described in the study protocol (“Primary Use of data”)- to perform scientific analysis.

However, interventional clinical trials are on the top of the iceberg of the evidence that pave modern healthcare. Indeed, knowledge can also be gathered from already collected data without exposing patients to risky interventions.

Frequently, once collected for a specific trial, participants’ data are reused in research projects outside the scope of initial protocol (“Secondary Use of data”). For example, medical data collected to conduct a clinical trial on breast cancer could then be used to run a research project aiming to identify new biomarkers which was not foreseen in the initial clinical trial protocol.

Research being cyclic by nature, it cannot be optimally done without frequent re-use of data. However, if scientific progress is crucial, study participant’s right to privacy and data protection is not less important. In that respect, the GDPR (“General Data Protection Regulation”) imposes strong rules on Sponsors located in the EU or conducting clinical trials in EU countries.

If the impact of the GDPR on the primary use of trial data is increasingly known, the impacts for the reuse of data, for further scientific research purposes, by a Sponsor or another researcher outside the study protocol are less understood.

In particular, a specific assessment relying on a compatibility presumption must be carried out by the Sponsor to determine if a new legal basis is necessary. With regards to this assessment and data subject’s right to information about further use, the role of the information provided initially is underestimated.