As mentioned in my previous post on the MEDDEV 2.7/1 revision 4, the second quarter of 2016 is characterized by several big steps from clinical evidence perspective: Besides the publication of the new version of the MEDDEV 2.7/1, consensus was reached on the new Medical Device Regulation (MDR), and in May the General Data Protection Regulation (GDPR) entered into force.
Since data protection and the informed consent for clinical studies are inseparable, in this post I want to share my thoughts on some key elements from clinical study perspective:
Health Care Data
Clinical studies concern any systematic collection of health data, and the definition of health data under the new GDPR is very broad, including
“all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject”.
Under the new GDPR such health data are subject to strict requirements: It prohibits processing of data concerning health, unless subject has given explicit consent to the processing of those personal data for one or more specified purposes.
This is particularly of note since this implies that informed consent is also applicable for registries or other non-interventional studies, whether these are prospective or retrospective. Therefore a substantial impact on epidemiologic studies can be expected where collection of informed consent can be very challenging due to scale for example.
In principle data collected within the context of clinical studies are anonymized before they are being processed. As addressed in another blog on transparency, however, the challenge with current technologies, especially when medical devices are involved, is that personal identifiers are often embedded within the diagnostic tools or the investigational devices (think images, ECG strips, …) to facilitate processing. Also the GDPR definition of what should be considered identifiable is very broad, and not just looking at a name or date of birth:
“an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”
So besides we are collecting health data, this makes an informed consent an in-disputable part of any clinical studies, interventional or not, and even more so when medical devices are involved.
When in addition the study will be monitored and/ or there is a likelihood that non health care professionals will be reviewing the study patient hospital files, this needs to be mentioned in the patient information and the data-subject will need to consent to this.
The informed consent process is not an easy part of clinical studies, and the GDPR indicates consent needs be specific and unambiguous, i.e. the
“Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them”,
meaning for example that when blood or tissue samples are collected and stored for possible future use, subject’s consent is required for this, and research such as with Henrietta Lacks’ cervical cancer cells is a no-go.
The typical cut-off age for giving consent in clinical studies is 18 years, and I find it interesting to see that the GDPR indicates a child can give consent to the processing of his or her personal data at the age of 16, and below that
“such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.”,
implying that – at least for observational studies – the age for giving consent could be lowered.
Also of note is that the GDPR refers to the Clinical Trial Regulation for medicinal products for the consenting to participation in research activities. Where does that leave us with medical device studies? Should we follow the Clinical Trial Regulation, or is it OK if we follow ISO 14155 – GCP? Since provisions with respect to the informed consent process are very much alike, I do not expect any issues, but still…
Any study participant has the right to withdraw consent at any time without any explanation or any consequences, and the GDPR once more emphasizes this. Of note in this respect I find, that in the clause on the right to be forgotten (article 7), it says that erasure of data does not apply when processing of data is necessary for
“ … scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; …”
In other words, in case a study participant withdraws consent, processing of anonymous data collected until that point in time is still possible if such is needed for the objective of the clinical study.
Data-processing outside of the EU
With the globalization of clinical studies in mind, it is of note that the GDPR is very comprehensive on transfer of personal data outside of the EU, since third countries are likely to have less strict regulations around data-protection. Aspects to consider in this respect are the location of the study sponsor and the database, but also of possible core-labs. When, for example, clinical study images of EU subjects are sent to a core-lab outside of the EU for screening purposes, the subject should be informed and consent to this specific aspect of the study before such is done.
In conclusion, generally speaking I do not expect many changes for clinical studies under the new GDPR. Most of the elements addressed above typically are already taken into account in the clinical study informed consent. The main challenge will be for retrospective and epidemiological studies: to obtain subject’s consent or ensure fully anonymous data processing.