Spanish Data Protection Agency permits remote monitoring of clinical trials during pandemic

The Spanish Data Protection Agency (“AEPD”) has issued a favorable response to the consultation on the possibility of remotely monitoring clinical trials with medicines during the pandemic, as an exceptional measure to guarantee the continuity of the monitoring during the health crisis. The consulting entity states the need to continue the monitoring to make the clinical trials valid.

In particular, remote monitoring with source data verification is proposed.

The consulting entity states that this remote monitoring only refers to the current situation and that it will follow the guidelines of the Spanish Agency of Medicinal Products and Medical Devices (“AEMPS”). These guidelines, which we discussed in this blog post, have been updated to include the clinical trials understood to be possible to remotely monitor with source data verification during the pandemic: (i) clinical trials investigating the prevention and treatment of COVID-19, and (ii) the final preparation of data before locking the database in pivotal trials investigating treatments for serious illnesses with no therapeutic alternatives.

The AEMPS establishes that, in these cases, all the safeguards and precautions indicated in the European Union guidelines must be adopted and it will only require prior approval of each research center, signed by the center’s data protection officer, which must be duly documented and kept in the clinical trial file. Thus, prior approval by the Spanish Drug Research Ethics Committee is not required, nor is authorization by the AEMPS, AEPD or the patient (this is within the informed consent provided, as this access is necessary to duly conduct the trial).

The consulting entity also provides an addendum to the agreement signed by the developer with the research center, along with two appendices on (i) a confidentiality agreement for the monitor and (ii) remote-access security protocol.

Following the AEMPS guidelines, the AEPD has responded favorably to the consultation insofar as:

• Monitoring of the trial by the monitor, as data processor on behalf of the developer, is necessary.
• An addendum is submitted to the initial agreement between the developer and the research center (i) in which the center authorizes the use of the remote-access system; (ii) including the verification of the source data as an alternative to in-person monitoring in the context of the current public health emergency; (iii) justifying the measure based on the impossibility of postponing the verification of source data without harming the participants; (iv) assuming the commitment to meet the criteria established by the AEMPS; (v) in which the developer guarantees, as data controller, that the monitor will carry out all functions according to standard working procedures and will only access strictly necessary information, signing a confidentiality agreement; and (vi) the developer also agrees to comply with the security measures implemented by the center, assuming full liability in case of breach.

In view of the above and mainly based on the documentation provided, the AEPD approves the consultation on remote monitoring activities with data verification. Therefore, these activities can be carried out in the terms described as long as the public health emergency continues.

By Adaya Esteban