The EU General Data Protection Regulation (GDPR) 2016/679 is applicable as of May 25th, 2018 in all member states(MS) to harmonize data privacy laws across Europe. It clarifies the legal basis for data processing in clinical research (mainly in Art. 6 and 9), specifies the rights of the data subject (Art.12-21) and the legal requirements for the transfer of data to third countries (Art. 44-49). Art.89 provides special derogations for research. In consideration of the complexities of the GDPR it is not yet clear how detailed the review of the compliance of the controller with the GDPR by the ECs has to be. The GDPR specifies that only the official data protection authorities of the MS are entitled to monitor the proper application, the ECs are however responsible that the data subjects are adequately informed about the scope and risks of data processing before they provide consent. Thus this is a potential area of conflict. Unfortunately there are even a couple of discrepancies between the CTR 536/2014 and the GDPR. The European Data Protection Board whose task it is to harmonize the application of the GDPR in the EU MS has already issued a statement on the interplay between the CTR and the GDPR(Opinion 3/2019) which is considered by the ECs of many MS as not helpful. Thus I expect that there will remain differences in the application among the MS.
Graduated as medical doctor J. Hasford serves since 1994 as Professor for medical informatics, biometry and epidemiology at the University of Munich, Germany.
Dr. Hasford’s main research interests include clinical trials methodology and pharmacoepidemiology. There are about 190 Medline-listed publications. In 2000 he received the Paul Martini Prize for his research. In 2008 he became Fellow of the Society for Clinical Trials.
He is chairman of the Ethics Committee of the Bavarian Physicians’ Chamber and president of the Association of the Medical Ethics Committees in Germany. Since 2010 he is a member of the Expert Group on Clinical Trials of the European Commission.