The Pharmaceutical Journal
Vol 273 No 7329 p859
11 December 2004

This article
Reprint   Photocopy

PDF 60K, Acrobat Reader

Biopharmacy

Impact of data protection legislation on the running of clinical trials

Data protection rules impact on several aspects of clinical trials, pharmacovigilence and pharmacogenomics, according to Mark Watts, solicitor at intellectual property and technology law firm, Bristows.

The regulations only apply to “personal data” — that is information relating to an identified or identifiable person, Mr Watts explained. Data that has been completely anonymised is therefore not covered by the rules. Which types of coded data are covered can depend on the particular European country involved. For example, in the UK, data is only considered to be personal data in the hands of sponsors (eg, pharmaceutical companies) if other information that enables the subject (eg, patients) to be identified in conjunction with it is likely also to come into their hands. In other countries (and in the European legislation itself), data will generally be considered to be personal data if the other information that enables the subject to be identified exists at all. This can make running cross-border clinical trials difficult, Mr Watts said. He also pointed out that data that is not considered to be personal data in the hands of sponsors in the UK, at least, will most likely be personal data in the hands of trial investigators (ie, health professionals running the trial). This is because they, unlike sponsors, will have contact with the clinical trial subjects and so will know from whom the data came.

Sensitive personal data is a subset of personal data and includes information about a person’s health, Mr Watts continued. This can only be processed if the trial subject gives their explicit consent, or one of the following exemptions apply:

· Processing it is necessary to protect “vital interests” (ie, in a life or death situation)
· Processing it is necessary for medical purposes and is undertaken by a health care professional (or equivalent)
· Processing it is in the substantial public interest and is necessary for research generally and is unlikely to cause substantial harm or distress

The second exemption can allow medical research data to be processed and the third can allow historical or records-based research, Mr Watts said. However, processing must be “necessary” not just “convenient’ for these exemptions to apply, and so obtaining the proper consent is the best approach to take if possible.

Several rules govern how the data can be processed, including that it must be processed for a specified purpose(s) and that it must not be kept for longer than necessary. Subjects must also have certain rights of access to the data stored (although these can usually be deferred to the end of a trial, so that the trial is not compromised). In addition, data cannot be transferred to countries that have less stringent data protection laws than those in Europe, which includes the US and India. This is unless, for example, patients consent to the transfer, knowing that less strict rules are in place in such countries, or the organisation to whom the data is transferred essentially agrees to put the same type of rules in place as apply in Europe.

Data protection rules are acknowledged in the Clinical Trials Directive, Mr Watts added. One issue, however, is that it is not clear whether the sponsor of a trial or the investigator is the controller of the data in data protection terms. This matters, he explained, because the obligations to ensure data is processed in accordance with the law fall to the controller.

Genetics and pharmacovigilence

Turning to genetic issues, Mr Watts explained that there is no consensus across Europe as to whether a sample of DNA (without any other information identifying the person it was taken from) constitutes personal data. “Thirty per cent of regulatory authorities do not regard it as such,” he said. In addition, there is no specific category in the definition of sensitive personal data for DNA and other genetic information.

Pharmacovigilence is also affected by data protection, Mr Watts explained. This is because information obtained about adverse effects after a drug has been launched can constitute sensitive personal data in the hands of a pharmaceutical company, unless it is codified to the extent that it is effectively anonymised. It is not clear whether the second and third exemptions to process sensitive personal data (see previous bullet points) apply in these circumstances, Mr Watts added.

Tissue samples

New rules about storing and using human tissue, will soon come into place now that the Human Tissue Act 2004 has received royal assent, Alex Wilson, also at Bristows, told delegates. Tissues include human cells and organs but not, for example, cells created outside the body (ie, such as, presumably, cell lines and DNA samples that have been, for example, amplified using polymerase chain reaction).

Under the legislation, a person’s consent is required to use their tissue for research, transplantation and anatomical examination. If the person from whom the sample is taken is deceased, then appropriate consent (eg, from relatives) is also needed to use it in activities such as clinical audit, public health monitoring and staff training for health care professionals. For tissues from living people, there are certain exceptions including for imported (but not reimported) material and where the “research person” will not be able to identify the person from whom the tissue was extracted. It is not clear, however, whether “research person” is an individual or the organisation he or she works for, although guidance is expected shortly, Mr Wilson said. Carrying out certain activities on samples already in storage is also exempt, he added.

Provisions to guard against a person’s DNA being analysed without their consent are also included in the legislation. There are exemptions, including ethically approved and anonymised research. Some activities will require licensing by the Human Tissue Authority. Although full details are not yet known, it is thought that, for example, licences will be required to create and maintain biobanks but that more straightforward research projects will not need them, Mr Wilson said.