Insight

The contact details of the sponsor’s DPO do not have to appear on the ICFs !

The contact details of the sponsor’s DPO do not have to appear on the ICFs !

Thomas Roche

Thomas Roche

March 5, 2020 03:21 AM

The GDPR is often used in an inappropriate way and unfortunately in a less than pragmatic fashion. The legal system is not a binary system, it is far more complex than that. What should be done where two legal frameworks apply to a single situation and these legal frameworks seem to contradict each other ? For instance, how should we react if another legal provision conflicts with those provided for in the GDPR ? Long before us, some wise old men reached a decision in this regard and decreed : “specialia generalibus derogant”. If two laws can apply to a certain situation, the specific law has priority over the general law. Within the context we are referring to, the GDPR is the general legal framework as its very title testifies incontrovertibly to this : “GENERAL data protection regulation”, whereas the specific legal framework will thus be the regulations applicable to clinical trials. According to Article 13 of the GDPR, “where personal data relating to a data subject are collected from the data subject, the controller shall […) provide the data subject with […] the contact details of the data protection officer…”. The same principle also applies according to Article 14 of the GDPR “where the personal data have not been obtained from the data subject”.At this juncture, a subtle distinction regarding clinical trials should be noted, which does not allow the strict compliance with the provisions of the GDPR, namely the fact that this information is not provided to the data subjects directly by the data controller, “at the time the data concerned are obtained”. It is in fact the investigator who is in direct contact with the data subject, who will inform the latter verbally and provide an information form, prepared by the sponsor often in conjunction with the coordinating investigator. For its part, the sponsor does not have, at any time, direct contact with data subjects included in the trial, nor does he have access to their identity. The information regarding the trial and the data subjects necessarily passes through an intermediary, i.e. the investigator who is managing and overseeing the implementation of the trial. Since 25 May 2018, we have fortunately not found any changes to information forms providing that this information must be imperatively provided by the sponsor. However, since this date, many people consider that the information forms must state the identity and contact details of the sponsor’s DPO. Such information would therefore enable people taking part in trials, in application of item 4 of article 38 of the GDPR, to contact the sponsor’s DPO with regard to any question about the processing of their personal data and above all about the exercise of the rights they have under the GDPR. For those who have been working in the field of clinical trials for some years, doesn’t this situation seem rather shocking ? Indeed, under these circumstances, the sponsor’s DPO could be in direct contact with volunteers and patients taking part in clinical trials, although trials are conducted by an investigator who is, as a basic principle, a doctor. Even though the DPO is bound by professional secrecy and must perform his duties completely independently, is there any justification for a DPO to be the recipient of information relating to the health of people taking part in a clinical trial ? What would the DPO do with this information ? He would have no other option than to invite the data subject to contact the investigator and his team as only they have access to the volunteer’s data and in particular the raw data and observation logs. They alone are able to enforce the data subjects’ exercise their right to access, correct, oppose or even, within certain limits, restrict the use of their data. Given these conditions, is it useful to increase the number of intermediaries and to disclose to the sponsor’s DPO, whether in-house or not, the identity of a person taking part in a clinical trial who is for example testing a new chemotherapy ? This solution eventually results in an increase in the risk of data breach and thus a reduction in the protection of data about people taking part in a clinical trial. Furthermore, we should bear in mind that specific rules exist to limit these risks and the adverse effects of the GDPR, namely the provisions regarding the processing of data concerning health, and those regarding medical confidentiality which are fully applicable to the field of clinical trials. An investigator in this situation remains first and foremost a doctor bound by medical confidentiality. In this respect it should be borne in mind that the provisions of the French Public Health Code, namely its article R4127-4, provide that : “The professional confidentiality instituted in the interests of patients is incumbent on every doctor at the conditions established by law.The confidentiality covers everything which the doctor comes to know in the exercise of his profession, i.e. not only what he is told, but also what he sees, hears and understands”. Moreover, article L. 1110-4 of the same code provides that “Except in the event of exemptions expressly provided by law, this confidentiality covers all personal information coming to the knowledge of the professional, and any member of the personnel of these establishments, services or organisations and any other person in contact, by his activities, with these establishments or organisations. It is required of all professionals working in the healthcare system”. However, there is no specific provision allowing this confidential information to be shared with the sponsor’s DPO. It is thus surprising that investigators agree to the contact details of the sponsor’s DPO being provided on information forms considering the risks of breach of medical confidentiality, by which they are legally bound. National and international texts governing clinical trials and in particular the guideline for good clinical practice (GCP) are clear on this matter : “1.16 - Confidentiality“Prevention of disclosure, to other than authorized individuals, of a sponsor’s proprietary information or of a subject’s identity”. (GCP ICH E6) GCP also provide that only the investigator may hold, during and at the end of the trial, a complete list of the volunteer identification codes (8.3.21, 8.3.22 and 8.4.3). This list (concordance table) allows all the subjects taking part in the trial to be identified in case a follow-up should be necessary and this list must remain confidential. Only the supervisory authorities and Clinical Research Associates (CRA) or auditors can, subject to certain conditions, access the identity of people taking part in a clinical trial. “5.15 – Record Access5.15.1 The sponsor should ensure that it is specified in the protocol or other written agreement that the investigator(s)/institution(s) provide direct access to source data/documents for trial-related monitoring, audits, IRB/IEC review, and regulatory inspection.5.15.2 The sponsor should verify that each subject has consented, in writing, to direct access to his/her original medical records for trial-related monitoring, audit, IRB/IEC review, and regulatory inspection” (GCP ICH E6) Direct access consists of permission to examine, analyse, verify and reproduce all the files and reports needed for the assessment of a clinical trial. Anyone with direct access to these documents must take all reasonable precautions, within the limits of applicable regulatory requirements, to ensure the confidentiality of the identity of the subjects. No national, European or international text gives the sponsor’s DPO permission to access the identity of people taking part in clinical trials. However, by requiring the provision of the identity and the contact details of the sponsor’s DPO on the information form, the DPO is potentially given access (if contacted by a volunteer) to information which he should not know, namely the volunteer’s identity, which could be analysed as a form of incitement to breach medical confidentiality. Furthermore, the indication of the DPO’s contact details on the information form does not appear useful as the volunteer/patient can easily contact the DPO without this information being provided on the ICF. This identification remains possible since the sponsor must, in application of item 7 of article 37 of the GDPR, publish the contact details of the DPO and notify them to the supervisory authority. Therefore, by knowing the identity of the sponsor, it is thus normally possible to identify the sponsor’s DPO, either through basic research or by contacting the sponsor directly. Thus, if a volunteer/patient feels that he has suffered a prejudice relating to his participation in a trial or that his rights have not been respected by the investigator, he may still be able to contact the sponsor’s DPO to enforce his rights.

Finally, in conclusion and to further prove the relevance of the adage “specialia generalibus derogant”, let us just review a few facts :

  • The investigator is responsible for the information about people who may be taking part in a trial and, following a cooling-off period, for obtaining their consent.
  • The investigator, in his capacity as doctor or qualified person, remains at all times bound by the requirement of confidentiality regarding the state of health of the person taking part in the trial and can only agree to share this information with people who are expressly authorised by law.
  • As such, the investigator is the sole and exclusive contact for people taking part in clinical trials and the volunteer can only exercise the rights granted by the GDPR through the investigator

Therefore, to ensure the protection of data about people taking part in clinical trials and to comply with the GDPR, the contact details of the sponsor’s DPO must not be stated on the information forms !

Related Articles

Privacy Practice


by Casey Waughn

Data protection is all the rage among tech companies and state, national (and even transnational) governments alike. Is it a passing fad or here to stay? And how should businesses and groups of all sizes handle compliance with a blizzard of new laws?

Data Protection Prompt New Privacy Laws

New England States With Incoming Legislation


by Gregory Sirico

Best Lawyers takes an in depth look at newly proposed bills, litigation and cases coming out of four New England states.

New England Laws Taking Effect in 2022

An Interview With Bastian Finkel of BLD Bach Langheid Dallmayr, Germany's 2019 "Law Firm of the Year" Winner in Insurance Law


by Best Lawyers

A look at the new European policies changing the insurance landscape in Germany.

BLD Bach Langheid Dallmayr Interview

Recent Developments on Privacy and Data Protection in Brazil


by Ricardo Barretto Ferreira da Silva and Camila Taliberti Ribeiro da Silva

A change of paradigm is urgent and requires a robust legislation on personal data protection.

Privacy and Data Protection Brazil

The Future of Data Privacy: You Can Run but You Can’t Hide (or Can You?)


by Chad W. King

In Ernest Cline’s dystopian novel "Ready Player One," the world’s population is addicted to a virtual reality game called the OASIS.

The Future of Data Privacy

My Data My Rules: An Overview of Data Protection in Brazil


by Fábio Pereira

My Data My Rules

Trending Articles

Introducing the 2026 Best Lawyers Awards in Australia, Japan, New Zealand and Singapore


by Jennifer Verta

This year’s awards reflect the strength of the Best Lawyers network and its role in elevating legal talent worldwide.

2026 Best Lawyers Awards in Australia, Japan, New Zealand and Singapore

Discover The Best Lawyers in Spain 2025 Edition


by Jennifer Verta

Highlighting Spain’s leading legal professionals and rising talents.

Flags of Spain, representing Best Lawyers country

How to Increase Your Online Visibility With a Legal Directory Profile


by Jennifer Verta

Maximize your firm’s reach with a legal directory profile.

Image of a legal directory profile

Effective Communication: A Conversation with Jefferson Fisher


by Jamilla Tabbara

The power of effective communication beyond the law.

 Image of Jefferson Fisher and Phillip Greer engaged in a conversation about effective communication

Paramount Hit With NY Class Action Lawsuit Over Mass Layoffs


by Gregory Sirico

Paramount Global faces a class action lawsuit for allegedly violating New York's WARN Act after laying off 300+ employees without proper notice in September.

Animated man in suit being erased with Paramount logo in background

The Future of Family Law: 3 Top Trends Driving the Field


by Gregory Sirico

How technology, mental health awareness and alternative dispute resolution are transforming family law to better support evolving family dynamics.

Animated child looking at staircase to beach scene

The 2025 Legal Outlook Survey Results Are In


by Jennifer Verta

Discover what Best Lawyers honorees see ahead for the legal industry.

Person standing at a crossroads with multiple intersecting paths and a signpost.

Safe Drinking Water Is the Law, First Nations Tell Canada in $1.1B Class Action


by Gregory Sirico

Canada's argument that it has "no legal obligation" to provide First Nations with clean drinking water has sparked a major human rights debate.

Individual drinking water in front of window

New Mass. Child Custody Bills Could Transform US Family Law


by Gregory Sirico

How new shared-parenting child custody bills may reshape family law in the state and set a national precedent.

Two children in a field holding hands with parents

The Best Lawyers Network: Global Recognition with Long-term Value


by Jamilla Tabbara

Learn how Best Lawyers' peer-review process helps recognized lawyers attract more clients and referral opportunities.

Lawyers networking

Jefferson Fisher: The Secrets to Influential Legal Marketing


by Jennifer Verta

How lawyers can apply Jefferson Fisher’s communication and marketing strategies to build trust, attract clients and grow their practice.

Portrait of Jefferson Fisher a legal marketing expert

Finding the Right Divorce Attorney


by Best Lawyers

Divorce proceedings are inherently a complex legal undertaking. Hiring the right divorce attorney can make all the difference in the outcome of any case.

Person at a computer holding a phone and pen

The Future of Canadian Law. Insights from Best Lawyers: Ones to Watch Honorees


by Jennifer Verta

Emerging leaders in Canada share their perspectives on the challenges and opportunities shaping the future of Canadian law

Digital eye with futuristic overlays, symbolizing legal innovation and technology

New Texas Law Opens Door for Non-Lawyers to Practice


by Gregory Sirico

Texas is at a critical turning point in addressing longstanding legal challenges. Could licensing paralegals to provide legal services to low-income and rural communities close the justice gap?

Animated figures walk up a steep hill with hand

Is Your Law Firm’s Website Driving Clients Away?


by Jamilla Tabbara

Identify key website issues that may be affecting client engagement and retention.

Phone displaying 'This site cannot be reached' message

Family Law Wrestles With Ethics as It Embraces Technology


by Michele M. Jochner

Generative AI is revolutionizing family law with far-reaching implications for the practice area.

Microchip above animated head with eyes closed