Dutch CCMO publishes information on impact of GDPR on clinical research

On 13 April 2018, the Dutch Central Committee on Research Involving Human Subjects (CCMO) published a Q&A on the impact of the upcoming General Data Protection Regulation ((EU) 2016/679) (GDPR) on clinical research.

According to the CCMO, to process the personal data of current or past participants of research that comes under the Dutch Clinical Research with People Act (WMO) in compliance with the GDPR, it is not necessary to make an additional request for their prior consent. Research under the WMO already requires explicit consent from the subjects of research for the processing of personal data under conditions that meet the requirements of the GDPR.

The current model agreement for subjects involved in clinical trials in hospitals will nonetheless be updated to better inform them on the rules around data processing, and to ensure full compliance with the GDPR. The model will include additional information such as contact details of the "controller" and the "data protection officer", and a reference to the Dutch Data Protection Authority's website where more information can be found on the data subject rights. The subject of research will also be able to find information from general information campaigns and on other websites.

The GDPR requires that consent for the processing of personal data must be sufficiently specific; however, at the time when permission is requested for the processing of personal data for research purposes, the details of such research are frequently not specific enough. There may be concerns, therefore, about obtaining valid consent under the GDPR. In such cases consent for the "reuse" and processing of personal data can be granted, provided that such reuse and processing is adequately defined.

A prior version of this post was originally published by the same author in Practical Law – Life Sciences, April 2018 issue (Thomson Reuters).