EDPB Opinion Raises Questions over Irish Health Research Regulations

The EDPB issued its opinion on draft FAQs on the interplay between the Clinical Trial Regulation (CTR) (which is expected to become applicable in 2020) and the General Data Protection Regulation (GDPR) on 23 January 2019. The EDPB focuses on the issue of the appropriate legal basis for the processing of personal data in the context of clinical trials (which is described in the opinion as a ‘primary use’) the use of clinical trial data for other scientific purposes, such as health research (described as a ‘secondary use’). In summary, the EDPB states that:

• Where personal data is processed in this context for the primary purpose of conducting clinical trials for reliability and safety purposes, ‘compliance with a legal obligation’ (Article 6(1)(c) of the GDPR) would be the most appropriate legal basis for processing. To the extent that special categories of personal data (such as health data) are processed for these purposes, Article 9(2)(i) of the GDPR is the appropriate condition to be relied upon.
• Where personal data is processed in this context for a ‘secondary purpose’, such as for health research purposes; ‘consent’ (Article 6(1)(a)); or ‘task carried out in the public interest’ (Article 6(1)(e)); or ‘legitimate interests’ (Article 6(1)(f)) may be the most appropriate legal basis, depending on the specific circumstances.  Notably, the EDPB confirms that the requirement to obtain ‘informed consent’ under the Clinical Trials Regulation does not give rise to a requirement to rely on ‘consent’ for the purpose of the GDPR.
• The EDPB states that in the context of clinical trials, for the purpose of the GDPR it is questionable whether ‘consent’ to the processing of personal data could be considered to be freely given.  As such, according to the EDPB “consent will not be the appropriate legal basis in most cases, and other legal bases than consent must be relied upon”. “As an alternative to data subject’s consent, the lawful grounds of processing provided under Article 6(1)(e) or 6(1)(f) are more appropriate”.  For the purposes of compliance with Article 9, according to the EDPB the most appropriate conditions to be relied upon could either by Article 9(2)(i) or 9(2)((j) (rather than explicit consent).

While the EDPB’s opinion does not preclude relying on consent for the purpose of Article 6 and explicit consent for the purpose of Article 9, it is clearly of the view that doing so should be the exception rather than the norm. Under the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (which came into effect in August 2018 and therefore predate the EDPB’s opinion), however, controllers who are processing personal data in connection with health research must ensure certain specified “suitable and specific measures” are taken, which most notably include obtaining explicit consent from the data subjects. This is subject to a limited exception, where an exemption from the requirement to obtain consent is granted on foot of an application to a Health Research Consent Declaration Committee.   

Organisations involved in clinical trials and health research in Ireland are now faced with an EDPB opinion that conflicts with Irish legislative requirements. While the Health Research Regulations 2018 will clearly take precedence where they apply, it may be disconcerting to such organisations to be required to take steps in Ireland that seem contrary to the EDPB’s view of best practice and are likely to be divergent with the approaches taken in other EU Member States.