Insight

The Sponsor is the sole data controller in the context of clinical studies

The Sponsor is the sole data controller in the context of clinical studies

Thomas Roche

Thomas Roche

March 5, 2020 03:22 AM

As part of our external DPO assignments, we often encounter difficulties during the elaboration or evaluation of Privacy Impact Assessments carried out to determine the compliance of personal data processing operations in the context of multicentric clinical trials conducted throughout the European Union. Indeed, we are frequently asked to analyse contracts and information consent forms that expressly qualify the study sponsor and the study’s investigating centres as joint data controllers for the processing of personal data carried out in the course of clinical trials. This interpretation of the situation in which the investigating centres are qualified as joint data controllers with the study sponsors is also backed by a number of supervisory authorities throughout the European Union. For instance, the Italian supervisory authority (Garante per la Protezione dei Dati Personali) stated in its Guidelines for Data Processing within the Framework of Clinical Drug Trials dated 24th July 2008 that “it appears that the responsibilities vested in the individual trial centres and sponsors are different as regards clinical trials – accordingly, they should be regarded as either separate data controllers or joint data controllers…”.However, in light of the applicable regulations, namely Regulation (EU) n° 2016/679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the GDPR), this assertion appears to be incorrect. Indeed, according to the latter Regulation, the data Controller is the natural or legal person, […] which, alone or jointly with others, determines the purposes and means of the processing of personal data, whereas the data Processor is the natural or legal person […] which processes personal data on behalf of the controller.In the context of clinical trials, the informed consent which is required to carry out data processing is gathered by the investigators practising in the investigating centres, who are also in charge of collecting and transferring the data which will be processed and analysed by the different stakeholders for the performance of the clinical trial. Therefore, it appears that the investigating centres carry out data processing operations on behalf of the study sponsor, i.e. data collection and data transfer, in the same way that the contract research organisations (CROs) process personal data on behalf of the study sponsors in the context of clinical trials.Accordingly, within the framework of clinical trials, investigating centres (or trial centres) and CROs are among the legal persons who must be qualified as data processors. This analysis of the situation is that of the French supervisory authority (i.e. the “CNIL”), which considers the study sponsor to be necessarily the data controller, as it is he that determines the purposes and means of the processing of the personal data. On the other hand, the CRO and investigating centres qualify as data processors, as they process the personal data in the context of the clinical trial exclusively in order to achieve the purposes that are pursued by the sponsor, and which are described in the protocol applied by the CRO and the investigating centres. Furthermore, to back this position we can refer to the Regulation on clinical trials, which describes the sponsor as “an individual, company or organisation which takes responsibility for the initiation, for the management and for setting up of the clinical trial”, whereas investigator “means an individual responsible for the conduct of a clinical trial at a clinical trial site”. Yet, if we strictly consider the aforementioned stipulations, it is clear that the sponsor takes responsibility for the initiation, the management and for setting up of the clinical trial, as well as determining the purposes of the processing of personal data which is to carry out the said clinical trial. Furthermore, the data that is processed are strictly limited to what is required by the study protocol and is necessary to conduct the clinical trial. This analysis does not affect the assumption according to which a healthcare institution acting as an investigating centre is qualified as a data controller for the processing of personal data which it carries out on its own behalf, in the context of the management of patients’ medical files. Ultimately, it should be acknowledged that the sponsor of a clinical trial is the sole data controller in the context of the trial, while the CRO and the investigating centres that collect and process data on its behalf must be qualified as a data processor in accordance with the applicable regulations on the protection of personal data.

Related Articles

Privacy Practice


by Casey Waughn

Data protection is all the rage among tech companies and state, national (and even transnational) governments alike. Is it a passing fad or here to stay? And how should businesses and groups of all sizes handle compliance with a blizzard of new laws?

Data Protection Prompt New Privacy Laws

New England States With Incoming Legislation


by Gregory Sirico

Best Lawyers takes an in depth look at newly proposed bills, litigation and cases coming out of four New England states.

New England Laws Taking Effect in 2022

Recent Developments on Privacy and Data Protection in Brazil


by Ricardo Barretto Ferreira da Silva and Camila Taliberti Ribeiro da Silva

A change of paradigm is urgent and requires a robust legislation on personal data protection.

Privacy and Data Protection Brazil

My Data My Rules: An Overview of Data Protection in Brazil


by Fábio Pereira

My Data My Rules

Trending Articles

The Real Camille: An Interview with Johnny Depp’s Lawyer Camille Vasquez


by Rebecca Blackwell

Camille Vasquez, a young lawyer at Brown Rudnick, sat down with Best Lawyers CEO Phillip Greer to talk about her distinguished career, recently being named partner and what comes next for her.

Camille Vasquez in office

Announcing the 2022 Best Lawyers® in the United States


by Best Lawyers

The results include an elite field of top lawyers listed in the 28th Edition of The Best Lawyers in America® and in the 2nd Edition of Best Lawyers: Ones to Watch in America for 2022.

2022 Best Lawyers Listings for United States

Famous Songs Unprotected by Copyright Could Mean Royalties for Some


by Michael B. Fein

A guide to navigating copyright claims on famous songs.

Can I Sing "Happy Birthday" in Public?

Announcing the 2022 Best Lawyers in Canada™


by Best Lawyers

The results include an elite field of top lawyers listed in the 16th Edition of The Best Lawyers in Canada™ and 1st Edition of Best Lawyers: Ones to Watch in Canada.

Announcing the 2022 Best Lawyers in Canada™

How A Claim Can Create A ‘Class’ of Its Own


by Justin Smulison

One civil claim can help a victim recover, prevent others from the same harm and even save lives. Tom Connick has experienced this directly, having been at the ground floor of injury claims that have led to high-value class action settlements.

Fire Consuming Paper Money

Choosing a Title Company: What a Seller Should Expect


by Roy D. Oppenheim

When it comes to choosing a title company, how much power exactly does a seller have?

Choosing the Title Company As Seller

Johnny Depp and Amber Heard: The Best Lawyers Honorees Behind the Litigation


by Gregory Sirico

Best Lawyers takes a look at the recognized legal talent representing Johnny Depp and Amber Heard in their ongoing defamation trial.

Lawyers for Johnny Depp and Amber Heard

Best Lawyers: Ones to Watch – The Future of Legal Talent Looks Bright


by Justin Smulison

Best Lawyers: Ones to Watch is launching its second edition in the United States, and after talking with both a company leader and esteemed lawyers on the list, the importance of this prestigious list is evident.

Best Lawyers: Ones to Watch in America 2022

Announcing the 2022 "Best Law Firms" Rankings


by Best Lawyers

The 2022 “Best Law Firms” publication includes all “Law Firm of the Year” recipients, national and metro Tier 1 ranked firms and editorial from thought leaders in the legal industry.

The 2022 Best Law Firms Awards

Announcing the 2022 Best Lawyers™ in Australia


by Best Lawyers

The results include an elite field of top lawyers and firms.

Announcing the 2022 Best Lawyers™ in Australi

Caffeine Overload and DUI Tests


by Daniel Taylor

While it might come as a surprise, the over-consumption of caffeine could trigger a false positive on a breathalyzer test.

Can Caffeine Cause You to Fail DUI Test?

Announcing The Best Lawyers in Australia™ 2023


by Best Lawyers

The results include an elite field of top lawyers and firms from Australia.

The Best Lawyers in Australia™ 2023

Wage and Overtime Laws for Truck Drivers


by Greg Mansell

For truck drivers nationwide, underpayment and overtime violations are just the beginning of a long list of problems. Below we explore the wages you are entitled to but may not be receiving.

Truck Driver Wage and Overtime Laws in the US

Why Cariola Díez Pérez-Cotapos Developed Its Own Legal Tech


by Best Lawyers

Juan Pablo Matus of Cariola Díez Pérez-Cotapos, 2019 "Law Firm of the Year" award for Corporate and M&A Law in Chile, discusses his firm's joint venture with Cognitiva in creating Lexnova, a legal AI system.

Cariola Díez Pérez-Cotapos Interview

Announcing the 2022 Best Lawyers in South Africa™


by Best Lawyers

The results include an elite field of top lawyers and firms.

Announcing 2022 Best Lawyers in South Africa

Announcing The Best Lawyers in The United Kingdom™ 2023


by Best Lawyers

The results include an elite field of top lawyers and firms from the United Kingdom.

The Best Lawyers in The United Kingdom 2023