What You Need to Know About New Data Laws Surrounding Clinical Trials in Spain

Data Rights Conflicts in Clinical Trials

A notable aspect of the Code is that it addresses the existing issue of the conflict between data rights and study reliability in the industry which arises in circumstances where a participant seeks to withdraw from a clinical trial part way through a study. In such circumstances, the particular concern is that to withdraw the participant’s data from the trial may negatively impact the reliability of the study. The code directly addresses this existing conflict stating that it will be permissible for the data that would have been obtained from the participant prior to such withdrawal to continue to be processed after this withdrawal. The reasoning lies in the legal basis for processing data under the Code. 

In the context of clinical trials, the code determines that the legal basis for the processing of trial subjects’ data in terms of GDPR is under Article 6(1)(c) – that processing is necessary for compliance with a legal obligation to which the controller is subject – in association with Article 9(2)(i) and (j) which establishes exemptions from prohibitions against processing particular categories of sensitive personal data, including health data, on the basis of the interests of public health and public interest. The data subjects’ consent is, therefore, not required to process their data once they have provided consent to participate in the trial. Further, the right to withdraw data under GDPR does not apply. 

Full GDPR Regulations

It should be noted that this is to be read in light of the full body of duties and regulations established in the GDPR. There may be circumstances which would demand a different approach. For example, the absence of a need for explicit consent only applies to the data processed for purposes related to the clinical trial. Consent may otherwise be required. The duties to provide information to the participant under Article 13 and 14 of GDPR also continue to apply.

In terms of pharmacovigilance, the Code distinguishes the processing of personal identification and coded data, establishing protocols for collecting information on possible adverse reactions depending on who makes the notification and the different notification channels, including social networks.

The Code also establishes a mediation procedure, which is to be voluntary and free of charge, to be used in the case of claims raised against the parties electing to adhere to the Code.

The AEPD has stated that, although the scope of the Code’s application is national, it aspires to be a benchmark at European level as it is the first Code in this field that has been approved in Europe.