EDPB Opinion on Consent and Legal Basis in Clinical Trials

On January 23, 2019, the European Data Protection Board (EDPB) issued an opinion (Opinion) on the interplay between the Clinical Trial Regulation (CTR) and the General Data Protection Regulation (GDPR), an issue which has been the subject of intense debate and that resulted in a draft, and still non-public, FAQ prepared by the EU Commission. The Opinion comments on the draft FAQ and provides some insight on data protection regulators’ view on how the GDPR applies to patient data collected as a part of a clinical trial.

In short, the EDPB takes the position that consent under the GDPR, and informed consent under the CTR, are different concepts, and that various legal grounds, including consent, are available under the GDPR to process patient personal data in the clinical trial context. Practically speaking, organizations will have to conduct a case-by-case assessment of the various options available.


The GDPR requires organizations involved in clinical trials (such as sponsors, sites, and contract research organizations—CRO—in some cases) to rely on a legal ground to process patient personal data. The GDPR provides a limited number of legal grounds, including a patient’s unambiguous consent, compliance with a legal obligation, relying on an organization’s legitimate interest, and the necessity to perform a task in the public interest. The GDPR further restricts the legal grounds available for the processing of sensitive data (such as health or genetic data); in those instances, an organization can only rely on a patient’s consent, if that consent is explicit and can only rely on public interest if it involves public health or a scientific purpose as provided under applicable law.

In parallel to the GDPR, the CTR requires patients’ informed consent to participate in clinical trials. This requirement is central to the World Medical Association Declaration of Helsinki, and reflects respect for patients’ dignity and, in certain cases, their physical integrity. Such informed consent could be confused with the (explicit) consent required to collect patient data, especially because the CTR contains some cross-references to data protection.

Key Takeaways

The main takeaway from the EDPB opinion is that informed consent under the CTR must be dissociated from consent under the GDPR. This means that consent is not the only available legal ground to process personal data in the clinical trial context, and that even though the legal ground for processing patient data may not be GDPR consent, patients should still be asked to sign an informed consent form (ICF) based on the CTR.

In addition, the EDPB analyzes the GDPR legal grounds as follows:

  • Consent: Consent remains a valid legal ground (and the “default” especially in case of sensitive data processing), but before relying on consent, organizations should assess whether the GDPR’s consent requirements are effectively met. The EDPB advises to ensure that consent is in all cases freely given, which may, according to the Opinion, require specific effort in case trial patients are “economically or socially disadvantaged” or are in a “situation of institutional or hierarchical dependency”. Furthermore, patients can withdraw their consent at any time, which means that all processing activities must be stopped if a patient withdraws his/her consent unless the organization can rely on another legal ground.
  • Compliance with a legal obligation. Compliance with an EU or member state legal obligation is a valid legal ground if personal data are processed for purposes such as safety reporting, archiving of the clinical trial master file and disclosure to relevant authorities. The EDPB further reminds that sensitive data may be processed for “reasons of public interest in the area of public health […] on the basis of Member State law” (Article 9(2)(i) GDPR).
  • Other legal grounds. Organizations can rely on other legal grounds such as the public interest legal ground or an organization’s legitimate interest to process personal data. However, these legal grounds cannot be relied on when an organization is processing sensitive data. When such data are processed, the EDPB considers that organizations should assess whether they can rely on specific GDPR derogations, in particular if the processing could be completed for “reasons of public interest in the area of public health […] on the basis of Member State law” (Article 9(2)(i) GDPR), or “scientific … purposes in accordance with Article 89(1) GDPR based on Union or Member State law”(Article 9(2)(j) GDPR).
  • Secondary uses. If an organization wants to use the personal data for other scientific purposes than the purposes defined in the clinical trial protocol, it should rely on another legal ground than the one used for the primary purpose. However, if the secondary use is for archiving purposes in the public interest, or for scientific, historical research or statistical purposes, the organization may proceed without a new legal ground.


The EDPB opinion comments on the draft FAQ prepared by the EU Commission and intends to clarify the interplay between the GDPR and the CTR. It now remains to be seen whether and how the EU Commission FAQs will incorporate these comments. In addition, the Opinion does not account for the fact that many clinical trials are conducted by organizations located outside of the EU, thus practically preventing them from relying on compliance with a legal obligation or on the public interest legal ground. According to the EDPB, consent under the GDPR and the CTR are different, and GDPR consent is not the panacea, but it can be relied on after a careful factual assessment. It will be interesting to see if and how market practices will evolve in light of this EDPB Opinion.

California Consumer Privacy Act: Industry, Advocate, and Enforcement Concerns and Legislative Amendments

On September 23, 2018, Governor Jerry Brown signed into law SB-1121, a bill that makes several amendments to the California Consumer Privacy Act (CCPA or the Act). The controversial privacy law, which is set to take effect in 2020, recently sparked a war of words among industry, privacy advocates, and the California Attorney General, each of whom sent letters to the California legislature urging amendments to the legislation. The California Chamber of Commerce, along with 36 business coalitions (Industry), submitted a letter to California Senator Bill Dodd in August, calling the Act “unworkable,” urging both technical and substantive cleanup of the Act, and introducing 21 proposed amendments. A coalition of 20 consumer privacy advocate groups (Advocates) responded with their own letter, highlighting the negative consequences Industry’s proposed changes would have on consumer rights.

The Industry and Consumer Advocates did not wholly disagree. Both coalitions urge the legislature to make technical fixes, such as clarification that businesses do not have to collect extra information to comply with the Act, as well as clarification of the definition of de-identified information. The California Attorney General also weighed in with comments, requesting specific amendments and additional time to issue regulations. In response to the input from these various stakeholders, the legislature amended the Act on August 31, 2018 and sent it to the Governor’s desk. This article sets forth the principal issues discussed in the letters and the legislature’s response. Continue Reading

Vermont Enacts Groundbreaking Data Broker Regulation

Recently, Vermont became the first state to enact legislation that regulates data brokers who buy and sell personal information. Under the new law, data brokers in Vermont will now have to register with the state, adopt standard security measures, and provide information to the state regarding their data collection practices. The law was passed in response to reported risks associated with the widespread aggregation and sale of data about consumers, and is intended to provide consumers with more information about data brokers and their data collection practices. Continue Reading

Key Developments in Internet of Things Law

California Signs the First IoT Security Bill into Law, and the FTC Submits Comments to the Consumer Product Safety Commission Regarding the IoT

California’s New IoT Law

On September 28, 2018, California Governor Jerry Brown signed into law a cybersecurity bill governing Internet of Things (IoT) devices, the first law of its kind in the nation. SB 327 requires manufacturers of internet-connected, or “smart” devices, to ensure the devices have “reasonable” security features by January 1, 2020.

The law applies to any “device, or other physical object that is capable of connecting to the Internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address.” This definition is broad and includes not only smart TVs, smart speakers, and other smart home devices, but also computers (laptops and desktops), connected cars, smartphones, smartwatches, and many other modern electronics.

The law does not contemplate further rulemaking, and it is unclear whether revisions to the law will be sought. Continue Reading

France: CNIL Issues Formal Notices Against Two Marketing Platforms for Lack of Valid Consent for the Processing of Location Data

In July 2018, the French data protection authority (the CNIL) issued two public formal notices against two marketing platform providers—

Teemo1 and Fidzup2—for failing to obtain valid consent under the General Data Protection Regulaton (GDPR) for the use of location data for profiling and targeted advertising.3 The CNIL gave the two French companies three months to change their practices to comply with EU data protection law. On October 3, 2018, the CNIL closed the matter against Teemo,4 as it considered that its updated practices now comply with the GDPR.5 The actions provide an indicator as to how Data Protection Authorities (DPAs) may approach enforcement under the GDPR. Continue Reading

New Colorado Law Takes Effect That Includes Strict 30-Day Data Breach Notification Requirement

On September 1, 2018, a new Colorado law took effect that, among other things, amends the state’s data breach law to: (1) expand the scope of the categories of “personal information” that trigger notification requirements; (2) require notification to residents and the state attorney general no more than 30 days after determining that a security breach has occurred; and (3) specify what must be included in these notifications.1 In addition, the statute requires entities that maintain, own, or license personal identifying information (PII) to implement and maintain reasonable security practices and procedures to secure PII and impose similar security obligations on third party service providers with which the entity shares PII. Finally, the law amends Colorado’s data disposal law to clarify the appropriate procedure for disposing of documents that contain PII. The passage of the Colorado law serves as a reminder that not only do state data breach notification requirements vary, but state laws also change over time in significant ways. Companies are well-advised to continue monitoring state laws for such changes. Continue Reading


We use cookies on our site to analyze traffic, enhance your experience, and provide you with tailored content. For more information or to opt-out, visit our privacy policy.

I agree