The contact details of the sponsor’s DPO do not have to appear on the ICFs !

The contact details of the sponsor’s DPO do not have to appear on the ICFs !

Thomas Roche

Thomas Roche

March 5, 2020 03:21 AM

The GDPR is often used in an inappropriate way and unfortunately in a less than pragmatic fashion. The legal system is not a binary system, it is far more complex than that. What should be done where two legal frameworks apply to a single situation and these legal frameworks seem to contradict each other ? For instance, how should we react if another legal provision conflicts with those provided for in the GDPR ? Long before us, some wise old men reached a decision in this regard and decreed : “specialia generalibus derogant”. If two laws can apply to a certain situation, the specific law has priority over the general law. Within the context we are referring to, the GDPR is the general legal framework as its very title testifies incontrovertibly to this : “GENERAL data protection regulation”, whereas the specific legal framework will thus be the regulations applicable to clinical trials. According to Article 13 of the GDPR, “where personal data relating to a data subject are collected from the data subject, the controller shall […) provide the data subject with […] the contact details of the data protection officer…”. The same principle also applies according to Article 14 of the GDPR “where the personal data have not been obtained from the data subject”.At this juncture, a subtle distinction regarding clinical trials should be noted, which does not allow the strict compliance with the provisions of the GDPR, namely the fact that this information is not provided to the data subjects directly by the data controller, “at the time the data concerned are obtained”. It is in fact the investigator who is in direct contact with the data subject, who will inform the latter verbally and provide an information form, prepared by the sponsor often in conjunction with the coordinating investigator. For its part, the sponsor does not have, at any time, direct contact with data subjects included in the trial, nor does he have access to their identity. The information regarding the trial and the data subjects necessarily passes through an intermediary, i.e. the investigator who is managing and overseeing the implementation of the trial. Since 25 May 2018, we have fortunately not found any changes to information forms providing that this information must be imperatively provided by the sponsor. However, since this date, many people consider that the information forms must state the identity and contact details of the sponsor’s DPO. Such information would therefore enable people taking part in trials, in application of item 4 of article 38 of the GDPR, to contact the sponsor’s DPO with regard to any question about the processing of their personal data and above all about the exercise of the rights they have under the GDPR. For those who have been working in the field of clinical trials for some years, doesn’t this situation seem rather shocking ? Indeed, under these circumstances, the sponsor’s DPO could be in direct contact with volunteers and patients taking part in clinical trials, although trials are conducted by an investigator who is, as a basic principle, a doctor. Even though the DPO is bound by professional secrecy and must perform his duties completely independently, is there any justification for a DPO to be the recipient of information relating to the health of people taking part in a clinical trial ? What would the DPO do with this information ? He would have no other option than to invite the data subject to contact the investigator and his team as only they have access to the volunteer’s data and in particular the raw data and observation logs. They alone are able to enforce the data subjects’ exercise their right to access, correct, oppose or even, within certain limits, restrict the use of their data. Given these conditions, is it useful to increase the number of intermediaries and to disclose to the sponsor’s DPO, whether in-house or not, the identity of a person taking part in a clinical trial who is for example testing a new chemotherapy ? This solution eventually results in an increase in the risk of data breach and thus a reduction in the protection of data about people taking part in a clinical trial. Furthermore, we should bear in mind that specific rules exist to limit these risks and the adverse effects of the GDPR, namely the provisions regarding the processing of data concerning health, and those regarding medical confidentiality which are fully applicable to the field of clinical trials. An investigator in this situation remains first and foremost a doctor bound by medical confidentiality. In this respect it should be borne in mind that the provisions of the French Public Health Code, namely its article R4127-4, provide that : “The professional confidentiality instituted in the interests of patients is incumbent on every doctor at the conditions established by law.The confidentiality covers everything which the doctor comes to know in the exercise of his profession, i.e. not only what he is told, but also what he sees, hears and understands”. Moreover, article L. 1110-4 of the same code provides that “Except in the event of exemptions expressly provided by law, this confidentiality covers all personal information coming to the knowledge of the professional, and any member of the personnel of these establishments, services or organisations and any other person in contact, by his activities, with these establishments or organisations. It is required of all professionals working in the healthcare system”. However, there is no specific provision allowing this confidential information to be shared with the sponsor’s DPO. It is thus surprising that investigators agree to the contact details of the sponsor’s DPO being provided on information forms considering the risks of breach of medical confidentiality, by which they are legally bound. National and international texts governing clinical trials and in particular the guideline for good clinical practice (GCP) are clear on this matter : “1.16 - Confidentiality“Prevention of disclosure, to other than authorized individuals, of a sponsor’s proprietary information or of a subject’s identity”. (GCP ICH E6) GCP also provide that only the investigator may hold, during and at the end of the trial, a complete list of the volunteer identification codes (8.3.21, 8.3.22 and 8.4.3). This list (concordance table) allows all the subjects taking part in the trial to be identified in case a follow-up should be necessary and this list must remain confidential. Only the supervisory authorities and Clinical Research Associates (CRA) or auditors can, subject to certain conditions, access the identity of people taking part in a clinical trial. “5.15 – Record Access5.15.1 The sponsor should ensure that it is specified in the protocol or other written agreement that the investigator(s)/institution(s) provide direct access to source data/documents for trial-related monitoring, audits, IRB/IEC review, and regulatory inspection.5.15.2 The sponsor should verify that each subject has consented, in writing, to direct access to his/her original medical records for trial-related monitoring, audit, IRB/IEC review, and regulatory inspection” (GCP ICH E6) Direct access consists of permission to examine, analyse, verify and reproduce all the files and reports needed for the assessment of a clinical trial. Anyone with direct access to these documents must take all reasonable precautions, within the limits of applicable regulatory requirements, to ensure the confidentiality of the identity of the subjects. No national, European or international text gives the sponsor’s DPO permission to access the identity of people taking part in clinical trials. However, by requiring the provision of the identity and the contact details of the sponsor’s DPO on the information form, the DPO is potentially given access (if contacted by a volunteer) to information which he should not know, namely the volunteer’s identity, which could be analysed as a form of incitement to breach medical confidentiality. Furthermore, the indication of the DPO’s contact details on the information form does not appear useful as the volunteer/patient can easily contact the DPO without this information being provided on the ICF. This identification remains possible since the sponsor must, in application of item 7 of article 37 of the GDPR, publish the contact details of the DPO and notify them to the supervisory authority. Therefore, by knowing the identity of the sponsor, it is thus normally possible to identify the sponsor’s DPO, either through basic research or by contacting the sponsor directly. Thus, if a volunteer/patient feels that he has suffered a prejudice relating to his participation in a trial or that his rights have not been respected by the investigator, he may still be able to contact the sponsor’s DPO to enforce his rights.

Finally, in conclusion and to further prove the relevance of the adage “specialia generalibus derogant”, let us just review a few facts :

  • The investigator is responsible for the information about people who may be taking part in a trial and, following a cooling-off period, for obtaining their consent.
  • The investigator, in his capacity as doctor or qualified person, remains at all times bound by the requirement of confidentiality regarding the state of health of the person taking part in the trial and can only agree to share this information with people who are expressly authorised by law.
  • As such, the investigator is the sole and exclusive contact for people taking part in clinical trials and the volunteer can only exercise the rights granted by the GDPR through the investigator

Therefore, to ensure the protection of data about people taking part in clinical trials and to comply with the GDPR, the contact details of the sponsor’s DPO must not be stated on the information forms !

Related Articles

Privacy Practice

by Casey Waughn

Data protection is all the rage among tech companies and state, national (and even transnational) governments alike. Is it a passing fad or here to stay? And how should businesses and groups of all sizes handle compliance with a blizzard of new laws?

Data Protection Prompt New Privacy Laws

New England States With Incoming Legislation

by Gregory Sirico

Best Lawyers takes an in depth look at newly proposed bills, litigation and cases coming out of four New England states.

New England Laws Taking Effect in 2022

An Interview With Bastian Finkel of BLD Bach Langheid Dallmayr, Germany's 2019 "Law Firm of the Year" Winner in Insurance Law

by Best Lawyers

A look at the new European policies changing the insurance landscape in Germany.

BLD Bach Langheid Dallmayr Interview

Recent Developments on Privacy and Data Protection in Brazil

by Ricardo Barretto Ferreira da Silva and Camila Taliberti Ribeiro da Silva

A change of paradigm is urgent and requires a robust legislation on personal data protection.

Privacy and Data Protection Brazil

The Future of Data Privacy: You Can Run but You Can’t Hide (or Can You?)

by Chad W. King

In Ernest Cline’s dystopian novel "Ready Player One," the world’s population is addicted to a virtual reality game called the OASIS.

The Future of Data Privacy

My Data My Rules: An Overview of Data Protection in Brazil

by Fábio Pereira

My Data My Rules

Trending Articles

Best Lawyers: Ones to Watch in America for 2023

by Best Lawyers

The third edition of Best Lawyers: Ones to Watch in America™ highlights the legal talent of lawyers who have been in practice less than 10 years.

Three arrows made of lines and dots on blue background

The Best Lawyers in New Zealand™ 2024 Awards

by Best Lawyers

The Best Lawyers in New Zealand 2024 awards include an elite field of top lawyers and law firms.

Auckland, New Zealand Skyline at twilight

Presenting The Best Lawyers in Singapore™ 2024

by Best Lawyers

Best Lawyers offers the most prestigious awards for lawyers and law firms in Singapore for 2024.

Singapore skyline at night

Announcing the 2023 The Best Lawyers in America Honorees

by Best Lawyers

Only the top 5.3% of all practicing lawyers in the U.S. were selected by their peers for inclusion in the 29th edition of The Best Lawyers in America®.

Gold strings and dots connecting to form US map

The Best Lawyers in Australia™ 2024 Launch

by Best Lawyers

Best Lawyers is excited to announce The Best Lawyers in Australia™ for 2023, including the top lawyers and law firms from Australia.

Australian Parliament beside water at sunset

Announcing The Best Lawyers in Japan™ 2024

by Best Lawyers

We are proud to present the 2024 edition of Best Lawyers awards for Japan which include the top lawyers and law firms in the country.

Mt. Fuji in the background with fall leaves and structure in front


Salvi & Maher, LLP: Illinois and Wisconsin's Personal Injury Firm

by Justin Smulison

For more than 35 years, Salvi & Maher LLP has defended their clients throughout Illinois and Wisconsin in various areas of personal injury law, including medical malpractice, motor vehicle accidents, premises liability and trucking litigation.

Skyline of Chicago with green river and blue background


Athea Trial Lawyers

by Justin Smulison

Athea Trial Lawyers is a nationally recognized firm who has received record-breaking victories throughout the country on behalf of personal injury victims.

women with shades of blue in mass arrangement


Rash Mueller Knows What it Means to Help

by Jeffrey Beasley

David Rash of Rash Mueller draws from first-hand experience on the affects of tragic personal injury and loss. His Florida law firm has spent years dedicated to helping the injured find justice.

Doctor with scope reviewing brain scan on screen

The Best Lawyers in South Africa™ 2023

by Best Lawyers

Best Lawyers proudly announces lawyers recognized in South Africa for 2023.

South African flag


Mastering the Art of Trial Practice

by John Fields

With its billion-dollar track record, Morelli Law Firm has earned a reputation as one of the country's most successful trial firms.

Morelli and team at table in office with windows

Announcing The Best Lawyers in Germany™ 2023

by Best Lawyers

The results include an elite field of top lawyers and firms from Germany.

Black, red and yellow stripes

Choosing a Title Company: What a Seller Should Expect

by Roy D. Oppenheim

When it comes to choosing a title company, how much power exactly does a seller have?

Choosing the Title Company As Seller

Famous Songs Unprotected by Copyright Could Mean Royalties for Some

by Michael B. Fein

A guide to navigating copyright claims on famous songs.

Can I Sing "Happy Birthday" in Public?

The Role of a Lawyer in the Slip-and-Fall Settlement Process

by Best Lawyers

Let’s examine the role of a lawyer in the slip-and-fall settlement process and how they can help you achieve a fair and just outcome for your case.

Unseen man with wrap on wrist sits across from woman in suit


Paulson & Nace, PLLC: A Pioneer in Personal Injury Law

by Best Lawyers

Since its inception more than 40 years ago, Paulson & Nace, PLLC, a Washington D.C., Maryland and West Virginia-based personal injury firm, has always led with compassion first. Here are some key insights from the firm on how to go about filing a personal injury claim.

Group of lawyers meet around a conference table