With regard to the General Data Protection Regulation (hereinafter referred to as the “GDPR”), sponsors submitting applications for clinical trial authorisation/notification are kindly requested not to submit to SÚKL documents pertaining to personal data processing and protection. Furthermore, SÚKL requests that the respective documents pertaining to personal data processing and protection be separate documents provided to trial subjects and submitted to the ethics committee (for multicentric clinical trials to the multicentric ethics committee only; for monocentric clinical trials to the concerned ethics committee approving the clinical trial in question).
The sponsor should submit to the ethics committee separate documents regarding personal data processing and protection in compliance with the GDPR together with a declaration stating that in data transfers, personal data protection required by the GDPR shall be observed. It is the responsibility of the sponsor (personal data controller) to ensure that documents pertaining to personal data processing and protection, including consents or information provided to trial subjects, meet the requirements of GDPR and of relevant legal regulations governing personal data processing in the Czech Republic. The ethics committee shall not give its opinion on these documents and shall not modify the text. Compliance with the GDPR and effective legislation of the Czech Republic are hence the obligation and responsibility of the sponsor.
The opinion of the Office for Personal Data Protection (ÚOOÚ) of 31 May 2018:
“It is not permissible to mix a consent with the conduct of a clinical study in patients or healthy volunteers and a consent with personal data processing, as this concerns two separate consents. A trial subject has the right for information from the data controller pursuant to Articles 13 to 15 of part 2 of the General Data Protection Regulation (GDPR) even where the processing is based upon a legitimate reason.”
In respect of the matter of regulatory authority or ethics committee powers in the area of personal data protection, the ÚOOÚ has stated: “The processing of personal data in a clinical trial has to be compliant with the effective legislation of the Czech Republic and with the GDPR. Responsibility for correct personal data processing and compliance with effective legislation lies with the controllers and processors of personal data used in the clinical trial.”
As per recommendations from the GCP Inspectors Working Group, GCP inspectors will inspect whether the trial subject has been informed about the legal basis for personal data processing; the legality of processing is likely to be based particularly upon GDPR Art. 6, paragraph 1(c), (e) or (f), where general personal data processing is concerned, in conjunction with GDPR Art. 9, paragraph 2(i) or (j), where the legal basis for processing of special categories of personal data is concerned. The selection of the legal basis for processing is the responsibility of the personal data controller, nevertheless, it must be clearly defined.
The aforementioned implies that personal data in clinical trials may be processed in particular on the basis of the aforementioned legal bases, rather than exclusively on the basis of the data subject's consent.
The form of documents regarding personal data processing and protection is the decision of the sponsor. Both the form of a consent and that of a trial subject information are acceptable.
For more information, please refer to the link to Article 29 Working Party revised text of the “Guidelines on Consent under Regulation 2016/679” of 10 April 2018:
http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051
With a view to the fact that the only competent authority which may check personal data protection arrangements is the Office for Personal Data Protection (ÚOOÚ) and the responsibility lies with the sponsors (personal data controllers), such control is not within the powers of SÚKL or the ethics committee, the ethics committee shall not assess, nor comment, the document. It shall only confirm “document receipt” upon request of the sponsor in case of ongoing clinical trials. In case of a new application for clinical trial approval, the ethics committee shall mention the document on the list of submitted documents with a remark reading “not subjected to assessment”.
30 July 2018
Department of Clinical Trials
cz