Mon, Sep
59 New Articles

Czech Republic: Data Privacy in Clinical Trials

Czech Republic: Data Privacy in Clinical Trials

Czech Republic
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

The COVID-19 pandemic has accelerated the digital evolution of clinical trials. Introducing new technologies and ways of working with clinical data, improving clinical data access, review, and monitoring processes, and making better use of the data for further scientific research are trends that are here to stay. Side by side with these developments come legal questions about personal data protection. The aim of this article is to shed light on the core legal issue in data processing within clinical trials: its legal basis.

Clinical trials involve the processing of an extensive amount of personal data, including health data and other special categories of personal data regulated under EU General Data Protection Regulation no. 2016/679. The particularity of this processing activity deserves special attention by controllers and their data protection officers. The appropriate legal basis for processing trial participants’ personal data and determining whether explicit consent is necessary under the GDPR has been a hot topic of debate. But Opinion no. 3/2019 of the European Data Protection Board confirms that explicit consent is merely one of the possible legal grounds for processing personal data in clinical trials, and that several others may be appropriate, in specific situations, and should be considered by the controllers. The Czech Data Protection Authority has expressed a similar view, stating that informed consent to participate in a clinical trial should not be confused with the explicit consent required by the GDPR. In addition, guidelines issued by the Czech Institute for Drug Control recommend that the written request for informed consent regarding participation in a clinical trial and the privacy notice (or written request for consent to data processing, if applicable) required by the GDPR be provided to trial participants as two separate documents.

According to the EDPB’s Opinion, the legal grounds for processing should be determined on a case-by-case basis, taking into consideration the purpose for which the data will be processed in the course of a clinical trial. Therefore, the appropriate legal basis should be determined separately for processing operations that relate to protecting the patient’s health and safety, on one hand, and processing performed purely for research, on the other. Alternative legal bases for research-processing activities may be the legitimate interests of the trial sponsor or a task carried out in the public interest, and health data may be processed based on public interest in the area of public health or scientific research purposes. Processing activities related to protection of patient health and safety may be based on the legal obligations of the trial sponsor, while processing of health data may be based on public interest in the area of public health.

Controllers should also separately assess the appropriate legal basis for a secondary use of personal data collected in the course of clinical trials for scientific research purposes, as it may differ from the primary use. In this context, it is worth mentioning that Czech law on data processing provides certain derogations from the GDPR and additional safeguards for the processing of data for scientific research purposes. In particular, Czech law imposes additional obligations on controllers performing scientific research, including the obligation to appoint a data protection officer and adopt specific technical and organizational measures.

The position of the EDPB related to the personal data processing for scientific research purposes was further clarified in the context of the COVID-19 outbreak. The EDPB adopted Guidelines no. 03/2020, which reiterated that explicit consent may be an appropriate legal basis, but depending on the context of the processing, other alternative legal bases should be considered as well. When consent is relied upon, it must be freely given, active, specific, informed, and unambiguous. Controllers should also take into account that data subjects have the right to withdraw their consent. Upon withdrawal of consent, controllers may have to delete the personal data concerned, unless further retention is justified on other lawful bases.

To conclude, controllers should take the time to properly identify the data processing purposes of clinical trials, and carefully assess the applicable legal basis for each processing activity. Explicit consent may be the first one that comes in mind, but other alternatives may be more appropriate, depending on the specific context.

By Monika Maskova, Partner, and Ivana Rosenzweigova, Attorney, PRK Partners

This Article was originally published in Issue 8.5 of the CEE Legal Matters Magazine. If you would like to receive a hard copy of the magazine, you can subscribe here.

Czech Republic Knowledge Partner

HAVEL & PARTNERS, attorneys-at-law, with offices in Prague, Brno, Bratislava, Pilsen, Olomouc, and Ostrava, has a team of 250 lawyers, tax advisors and 500 employees in total, is the largest independent law firm in Central Europe.

Our clients include large international companies, leading Czech and Slovak firms, including strategic state-owned companies and public sector authorities, as well as medium-size businesses, individual entrepreneurs, and investors. We advise approximately  150 of the Fortune 500 companies, almost 50 of the Czech Top 100 companies and 20 of the TOP 100 Slovak companies. HAVEL & PARTNERS currently provides its services to a total of 2,500 clients. We have the most comprehensive international support available to both Czech and Slovak law firms. We provide legal and tax advice in 12 languages in more than 110 countries around the globe. Up to 70 % of the transactions we deal with involve an international aspect.

HAVEL & PARTNERS was named the best law firm operating in the Czech Republic by the prestigious global rating agencies Chambers and Partners (2020, 2021) and Who’s Who Legal (2018, 2019). It is also the most successful law firm, providing the most comprehensive legal services in the Czech Republic and Slovakia, based on the total number of all nominations and awards in all years of the Law Firm of the Year awards. The firm became the absolute winner of this competition four times in the last six years, receiving the main award Domestic Law Firm of the Year in the Czech Republic (2015, 2017, 2018, 2020) and ranking as one of the most recommended law firms in all categories of law. Our company is also a four -time winner of the Law Firm of the Year award for Best Client Services (2015, 2016, 2019, 2020). In the field of M&A, HAVEL & PARTNERS is the best law firm in the Czech Republic based on the annual International Advisory Experts awards (2018, 2019). Prestigious international rating agencies EMIS DealWatch and Mergermarket have ranked HAVEL & PARTNERS among the leading law firms by the number of transactions completed in the Czech Republic since 2010. Based on annual awards of the Acquisition International magazine, HAVEL & PARTNERS has become the Law Firm of the Year 2019 in the M&A category in the CEE region.

Firm's website: https://www.havelpartners.cz/en/

Our Latest Issue