Following the implementation of the EU General Data Protection Regulation (GDPR), there has been concern about the extent to which consent must be the only lawful ground for processing special categories of personal data in clinical trials.
Whilst consent is not the only lawful ground for processing of personal data, the fact that the majority of personal data in clinical trials relate to sensitive health data has driven practitioners and regulators to focus primarily on consent.
The UK Health Research Authority, in consultation with the UK Information Commissioner’s Office, in 2018 published guidance that indicated that consent should not be the preferred lawful ground for processing but rather that the lawful grounds of legitimate interest and also public health should be the preferred route.
A number of regulators have taken an opposite view and continued to focus on consent and so the latest opinion from the European Data Protection Board (Opinion 3/2019) is helpful in clarifying that, “as an alternative to data subjects consent, the lawful grounds of processing provided under Article 6(1)(e) or 6(1)(f) are more appropriate – namely necessary for the performance of the task carried out in the “public interest” or upon “legitimate interests”.