Page 1

LEGAL PROCESSING OF PERSONAL DATA
IN CLINICAL TRIAL
On 23 January 2019, EDPB 1 adopted Opinion 2 on the relationship of the Clinical Regulation
testing 3 and the General Data Protection Regulation 4 .
Although the application of the Clinical Trials Regulation has been postponed and is expected
the beginning of application only in 2020, 5 in the Slovak legal system is a clinical trial
regulated by several laws 6 , the Office identifies with the legal bases of personal processing
data for the purposes of the clinical trial, which, according to the opinion, are to be applied regardless of
whether the Clinical Trials Regulation applies.
Processing of personal data for the purposes of the clinical trial protocol 7
According to the opinion, this is the primary use of clinical trial data. In this case,
distinguishes between two types of processing activities that have different legalities
basics:
1. Processing operations to ensure reliability and safety 8
The appropriate legal basis for the processing of personal data for this purpose is Art. 6 par. 1 letter c)
General Data Protection Regulation - processing necessary to comply with the law
obligations of the operator .
As regards the fulfillment of the condition for the lawful processing of a specific category of personal data,
the condition in Art. 9 par. 2 letter (i) the General Regulation on the protection of personal data
data processing - is necessary for reasons of public interest in the public domain
health, such as protection against serious cross - border threats to health or
ensuring a high level of quality and safety of healthcare and medicines; or
medical devices, under Union law or the law of a Member State
lay down appropriate and specific measures to protect the rights and freedoms of the person concerned,
in particular professional secrecy.

European Data Protection Board, more information at https://edpb.europa.eu/edpb_en
2 Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation
1

(CTR) and the GDPR, currently available in English only at https://edpb.europa.eu/our-worktools / our-documents / opinion-art-70 / opinion-32019-concerning-questions-and-answers-interplay_en
3 Regulation (EU) No 182/2011 of the European Parliament and of the Council 536/2014 of 16 April 2014 on clinical trials of medicinal products on
human use repealing Directive 2001/20 / EC
4 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to
processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC
(General Data Protection Regulation)
5 Point 3 of the opinion
6 Eg. Act no. 362/2011 Coll. on Medicines and Medical Devices and on Amendments to Certain Acts
7 More detailed information is provided in section 2 of the opinion
8

For more details, see section 2.1 of the opinion

Page 2

2. Processing operations relating to purely research activities 9
Possible legal bases for processing:
a) Art. 6 par. 1 letter a) general regulation on personal data protection - consent ,
in conjunction with Art. 9 par. 2 letter (a) of the General Data Protection Regulation
for the processing of a special category of personal data - explicit consent .
Informed consent under the Clinical Trials Regulation is not to be confused with (explicit)
consent under the General Data Protection Regulation. There are two types of consents.
The legal basis for consent within the meaning of the General Data Protection Regulation, which is
decisive for the processing of personal data does not, in the opinion, appear to be the most appropriate,
as it is disputed whether the sponsor or the investigator and the participant in the clinical trial are not
in the same position, and it may therefore appear that the consent was not given freely.

b) Art. 6 par. 1 letter (e) or (f) of the General Data Protection Regulation fulfillment of a task carried out in the public interest or legitimate interests
operator .
These legal bases appear to be more appropriate compared to the above
option. However, processing is only possible if one of the conditions is met
for the processing of a specific category of personal data
i. Art. 9 par. 2 letter (i) of the General Data Protection Regulation processing is necessary for reasons of public interest in the public domain
health, under Union or Member State law, or
ii. Art. 9 par. 2 letter (j) of the General Data Protection Regulation processing is necessary for the purposes of scientific research pursuant to Article 89 (2).
1 on the basis of Union law or the law of a Member State.

Processing for purposes not specified in the clinical trial protocol, for scientific purposes only
purposes 10
The Regulation on Clinical Trials in Art. 28 par. 2 requires the consent of the person concerned for these purposes.
We emphasize again that informed consent under the Clinical Trials Regulation is not the same
as (explicit) consent under the General Data Protection Regulation.

9

For more details, see section 2. 2 of the opinion

10

More detailed information is provided in section 3 of the opinion

