Data protection in clinical trials

The protection of personal data is a key aspect of drugs trials, which require obtaining and documenting the informed consent of participants. However, informed consent involves not only informing participants about the clinical aspects of the trial, but also about the processing of personal data collected and used in it. The Spanish Data Protection Authority (SDPA) has recently issued a Report analyzing the proposed data protection information clause drafted by the Spanish Agency for Medicines and Health Products (AEMPS) to be included in the Guidelines for correct preparation of a model patient information sheet and informed consent form.

The report from the SDPA, published on March 12, 2024, includes a series of recommendations and proposals for improvement to adapt the text proposed by the AEMPS to the provisions of articles 12 and 13 of the General Data Protection Regulation, ensuring transparency and providing clear information about responsibilities, purposes, legal bases, recipients, international transfers, retention periods and the rights of data subjects in the processing of data within the context of clinical trials. Here are some of the key points of the report:

• Data protection information must be provided separately from clinical trial information, using a concise, transparent, intelligible and easily accessible form, with clear and simple language, especially when directed at children.
• A layered approach can be used to providing information under article 11 of the Spanish Organic Law on the Protection of Personal Data and the Guarantee of Digital Rights.
• Data controllers in a clinical trial, the promoter and the center must be clearly identified, and their contact details and those of the data protection officer must be provided.
• Participants must be informed of the use of pseudonymized patient data and the possibility of reidentification, as well as the data retention periods and further data processing for research purposes after the trial.
• The legal bases for the data processing must be included in the information sheet.