Which aspects of personal data protection should be included in the patient information sheet and informed consent form?

Following the entry into force of Royal Decree 1090/2015, regulating clinical trials with medicinal products, the AEMPS issued an instruction document for the conduct of clinical trials in Spain. This Q&A format document provides useful information on practical aspects derived from the application of this Royal Decree. The instruction document is updated periodically, as well as its annexes, including Annex VIIIA, which contains the “Guideline for correct preparation of a model patient information sheet and informed consent form (PIS/ICF)”.

In addition to the information required to participate in the clinical trial, the Guideline also addresses the information to be provided to the patient for the processing of personal data. In the Guideline, the AEMPS includes the proposed wording that the PIS/ICF should contain in relation to these issues.

The AEMPS proactively requested the AEPD to analyse whether the Guidelines, and in short, the PIS/ICF, complied with the principles of information and transparency required by the General Data Protection Regulation (GDPR). In the report we discuss, the AEPD makes various recommendations and proposals for improvement, which have been gradually incorporated into the latest versions of Annex VIIIA published by the AEMPS on its website.

Responsibilities of the Site and the Sponsor

According to the AEPD, one of the essential aspects that must be specified in any PIS/ICF concerns what specific data processing is carried out by the Site and the Sponsor, respectively, and in relation to which data. Otherwise, the trial participant will not have a clear understanding of the responsibility of each of these parties for the processing of their data. However, the AEPD also recommends not to provide excessively detailed information that may be difficult for the average citizen to understand. Furthermore, the AEPD states that it is necessary to include the contact details of the Data Protection Officer (DPO) of the Sponsor, even if the latter only processes pseudonymised data.

Purpose, legal basis for processing and recipients

The AEPD considers that another relevant topic that should be informed about, in a clear and differentiated manner, is that relating to the purpose of the processing. In relation to the legal basis for the processing, the AEPD refers to Opinion 3/2019 of the European Data Protection Board, in order to determine which could be appropriate. In addition to the usual consent, the processing of health data may be based on the following basis: compliance with a legal obligation (art.6.1 c GDPR), the public interest in public health (art. 9.2 i GDPR) and the conduct of scientific research (art. 9.2 j GDPR). On the other hand, the AEPD also recommends delimiting the categories of recipients: health authorities, Ethics Committees for Investigation with medicinal products, or third parties providing services to the Sponsor or the Site, among others.

Other aspects to consider

In the event that international data transfers are foreseen, the AEPD understands that a generic text should not be offered to inform on this matter, but that it would be advisable to adapt its wording to each trial according to its specific circumstances.

On the other hand, as regards the period of data retention beyond 25 years after the end of the clinical trial, the AEPD considers that it should be specified for how much longer these data will be kept and for what specific purpose. Imprecise formulas that could affect the data subjects’ right to information should be avoided.

Finally, according to the AEPD, it would be desirable for the PIS/ICF to establish, in a differentiated and clear manner, the cases in which the re-identification of trial participants is possible (e.g., to protect the vital interests of the data subject) and the corresponding legal basis for this (Art. 6.1 d and Art. 9.2 c GDPR).

In short, it is essential that when drafting a PIS/ICF, all the improvements proposed by the AEMPS in the aforementioned Annex VIIIA, in line with the AEPD’s report, are considered; especially when dealing with sensitive data, such as the health data of patients participating in clinical trials.