Insight

The Sponsor is the sole data controller in the context of clinical studies

The Sponsor is the sole data controller in the context of clinical studies

Thomas Roche

Thomas Roche

March 5, 2020 03:22 AM

As part of our external DPO assignments, we often encounter difficulties during the elaboration or evaluation of Privacy Impact Assessments carried out to determine the compliance of personal data processing operations in the context of multicentric clinical trials conducted throughout the European Union. Indeed, we are frequently asked to analyse contracts and information consent forms that expressly qualify the study sponsor and the study’s investigating centres as joint data controllers for the processing of personal data carried out in the course of clinical trials. This interpretation of the situation in which the investigating centres are qualified as joint data controllers with the study sponsors is also backed by a number of supervisory authorities throughout the European Union. For instance, the Italian supervisory authority (Garante per la Protezione dei Dati Personali) stated in its Guidelines for Data Processing within the Framework of Clinical Drug Trials dated 24th July 2008 that “it appears that the responsibilities vested in the individual trial centres and sponsors are different as regards clinical trials – accordingly, they should be regarded as either separate data controllers or joint data controllers…”.However, in light of the applicable regulations, namely Regulation (EU) n° 2016/679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the GDPR), this assertion appears to be incorrect. Indeed, according to the latter Regulation, the data Controller is the natural or legal person, […] which, alone or jointly with others, determines the purposes and means of the processing of personal data, whereas the data Processor is the natural or legal person […] which processes personal data on behalf of the controller.In the context of clinical trials, the informed consent which is required to carry out data processing is gathered by the investigators practising in the investigating centres, who are also in charge of collecting and transferring the data which will be processed and analysed by the different stakeholders for the performance of the clinical trial. Therefore, it appears that the investigating centres carry out data processing operations on behalf of the study sponsor, i.e. data collection and data transfer, in the same way that the contract research organisations (CROs) process personal data on behalf of the study sponsors in the context of clinical trials.Accordingly, within the framework of clinical trials, investigating centres (or trial centres) and CROs are among the legal persons who must be qualified as data processors. This analysis of the situation is that of the French supervisory authority (i.e. the “CNIL”), which considers the study sponsor to be necessarily the data controller, as it is he that determines the purposes and means of the processing of the personal data. On the other hand, the CRO and investigating centres qualify as data processors, as they process the personal data in the context of the clinical trial exclusively in order to achieve the purposes that are pursued by the sponsor, and which are described in the protocol applied by the CRO and the investigating centres. Furthermore, to back this position we can refer to the Regulation on clinical trials, which describes the sponsor as “an individual, company or organisation which takes responsibility for the initiation, for the management and for setting up of the clinical trial”, whereas investigator “means an individual responsible for the conduct of a clinical trial at a clinical trial site”. Yet, if we strictly consider the aforementioned stipulations, it is clear that the sponsor takes responsibility for the initiation, the management and for setting up of the clinical trial, as well as determining the purposes of the processing of personal data which is to carry out the said clinical trial. Furthermore, the data that is processed are strictly limited to what is required by the study protocol and is necessary to conduct the clinical trial. This analysis does not affect the assumption according to which a healthcare institution acting as an investigating centre is qualified as a data controller for the processing of personal data which it carries out on its own behalf, in the context of the management of patients’ medical files. Ultimately, it should be acknowledged that the sponsor of a clinical trial is the sole data controller in the context of the trial, while the CRO and the investigating centres that collect and process data on its behalf must be qualified as a data processor in accordance with the applicable regulations on the protection of personal data.

Related Articles

Privacy Practice


by Casey Waughn

Data protection is all the rage among tech companies and state, national (and even transnational) governments alike. Is it a passing fad or here to stay? And how should businesses and groups of all sizes handle compliance with a blizzard of new laws?

Data Protection Prompt New Privacy Laws

New England States With Incoming Legislation


by Gregory Sirico

Best Lawyers takes an in depth look at newly proposed bills, litigation and cases coming out of four New England states.

New England Laws Taking Effect in 2022

Recent Developments on Privacy and Data Protection in Brazil


by Ricardo Barretto Ferreira da Silva and Camila Taliberti Ribeiro da Silva

A change of paradigm is urgent and requires a robust legislation on personal data protection.

Privacy and Data Protection Brazil

The Future of Data Privacy: You Can Run but You Can’t Hide (or Can You?)


by Chad W. King

In Ernest Cline’s dystopian novel "Ready Player One," the world’s population is addicted to a virtual reality game called the OASIS.

The Future of Data Privacy

My Data My Rules: An Overview of Data Protection in Brazil


by Fábio Pereira

My Data My Rules

Trending Articles

The 2024 Best Lawyers in Spain™


by Best Lawyers

Best Lawyers is honored to announce the 16th edition of The Best Lawyers in Spain™ and the third edition of Best Lawyers: Ones to Watch in Spain™ for 2024.

Tall buildings and rushing traffic against clouds and sun in sky

Best Lawyers Expands Chilean 2024 Awards


by Best Lawyers

Best Lawyers is pleased to announce the 14th edition of The Best Lawyers in Chile™ and the inaugural edition of Best Lawyers: Ones to Watch in Chile™, honoring the top lawyers and firms conferred on by their Chilean peers.

Landscape of city in Chile

The Best Lawyers in Spain™ 2023


by Best Lawyers

Announcing Spain's recognized lawyers for 2023.

Flag of Spain

Announcing The Best Lawyers in South Africa™ 2024


by Best Lawyers

Best Lawyers is excited to announce the landmark 15th edition of The Best Lawyers in South Africa™ for 2024, including the exclusive "Law Firm of the Year" awards.

Sky view of South Africa town and waterways

Announcing the 2023 The Best Lawyers in America Honorees


by Best Lawyers

Only the top 5.3% of all practicing lawyers in the U.S. were selected by their peers for inclusion in the 29th edition of The Best Lawyers in America®.

Gold strings and dots connecting to form US map

The Best Lawyers in Portugal™ 2024


by Best Lawyers

The 2024 awards for Portugal include the 14th edition of The Best Lawyers in Portugal™ and 2nd edition of Best Lawyers: Ones to Watch in Portugal™.

City and beach with green water and blue sky

The Best Lawyers in Peru™ 2024


by Best Lawyers

Best Lawyers is excited to announce the landmark 10th edition of The Best Lawyers in Peru, the prestigious award recognizing the country's lop legal talent.

Landscape of Peru city with cliffside and ocean

The Best Lawyers in South Africa™ 2023


by Best Lawyers

Best Lawyers proudly announces lawyers recognized in South Africa for 2023.

South African flag

The Best Lawyers in Chile™ 2023


by Best Lawyers

The results include an elite field of top lawyers and firms in Chile.

White star in blue box beside white box with red box on bottom

The Best Lawyers in Colombia™ 2024


by Best Lawyers

Best Lawyers is honored to announce the 14th edition of The Best Lawyers in Colombia™ for 2024, which honors Colombia's most esteemed lawyers and law firms.

Cityscape of Colombia with blue cloudy sky above

Announcing the 2024 Best Lawyers in Puerto Rico™


by Best Lawyers

Best Lawyers is proud to announce the 11th edition of The Best Lawyers in Puerto Rico™, honoring the top lawyers and firms across the country for 2024.

View of Puerto Rico city from the ocean

The 2023 Best Lawyers in Portugal™


by Best Lawyers

Announcing the elite group of lawyers recognized in Portugal for 2023.

Green and red Portuguese flag

Unwrapping Shrinkflation


by Justin Smulison

Through the lens of the United States, we take a closer look at the global implication of companies downsizing products while maintaining and often raising prices.

Chocolate bar being unwrapped from foil

Best Lawyers: Ones to Watch in America for 2023


by Best Lawyers

The third edition of Best Lawyers: Ones to Watch in America™ highlights the legal talent of lawyers who have been in practice less than 10 years.

Three arrows made of lines and dots on blue background

2021 Best Lawyers: The Global Issue


by Best Lawyers

The 2021 Global Issue features top legal talent from the most recent editions of Best Lawyers and Best Lawyers: Ones to Watch worldwide.

2021 Best Lawyers: The Global Issue

Announcing the 2023 The Best Lawyers in Canada Honorees


by Best Lawyers

The Best Lawyers in Canada™ is entering its 17th edition for 2023. We highlight the elite lawyers awarded this year.

Red map of Canada with white lines and dots