Data protection in clinical trials: Key issues from a legal perspective

National and international data privacy legislation and guidelines

Several national and international regulations contain provisions aimed at protecting study participants’ data and privacy. Switzerland’s Human Research Act (HRA) is a key piece of federal legislation and contains general principles such as the right to informed consent and special safeguards for vulnerable individuals in research. The related ordinances on clinical trials (Clinical Trials Ordinance (ClinO)) and on human research (Human Research Ordinance (HRO) set out the detailed framework of research regulation in Switzerland and address the specifics of data privacy.

This is where the international regulations come into play. The Swiss ordinances are largely based on the guidelines of the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH). The ongoing revision of the ICH Guideline for Good Clinical Practice E6(R3) places a high priority on digitisation in research and data safety. The Swiss ordinances should be adapted accordingly in the future. Because medical research does not stop at national borders, EU regulation is also relevant to researchers and research participants in Switzerland, although it is not directly applicable to Switzerland. Especially worthy of mention is the EU’s Clinical Trials Regulation (CTR), which entered into application on 31 January 2022. And towering over all the regulations is the EU’s bureaucratic behemoth, the General Data Protection Regulation (GDPR), whose most visible impact is that internet users may now freely choose cookies when visiting websites. The GDPR, however, does not directly protect patients from sharing their personal experience too freely on the internet.

Improved protection at the price of complexity?

Although many research participants may not be familiar with the provisions in these regulations and guidelines, having this legal framework is essential for protecting their data and their privacy. Undoubtedly, this mass of new regulations improves the legal position of trial participants. Standards for informed consent, the safe handling of genetic data, or privacy by design in trials are set to benefit participants. However, there are concerns that a multiplicity of standards does not ensure data security beyond that which a principal investigator (PI) can provide by drawing up a professionally designed study plan and responsibly monitoring the execution of a trial. What is certain, though, is that the regulatory requirements for researchers have become much more complex. In 2019, Regulatory Affairs Watch 1 took a deep dive into the GDPR, pointing out certain inconsistencies within research law. Legal desks at industry and university trial centres must tackle these mandatory requirements. In the end, the right balance needs to be struck between having legislation and standards in place that effectively protect research participants without adding unnecessary complexity to the research process.

Data controller and study participant

An important aspect of data protection is the recurring question regarding data ownership. Participants in a trial usually consider themselves the owners of their personal data. However, legal ownership according to the Swiss Civil Code is possible only with physical objects (e.g. biological samples or a paper medical record) and not data (Art. 641 et seq.). Alternatively, intellectual property could be considered. Data can be subject to exclusive rights if it involves an invention or the result of a creative process (Copyright Act, Art. 2). A participant’s physical address or therapy plan, however, are not considered results of a creative process and are therefore not his or her intellectual property.

Data protection laws therefore refer to the ownership of a database on the one hand and the protection of individual rights on the other. Switzerland’s current Federal Act on Data Protection (FADP) defines the controller of the data file as private persons or federal bodies that decide on the purpose and content of a data file (Art. 3, let. i). In human research, the person responsible for study data is the sponsor or the sponsor-investigator/principal investigator. They take strategic decisions regarding the safe handling and the purpose of use of data in a clinical trial, which therefore makes them the owners, or rather controllers, of the database as a whole. The participant, on the other hand, is the data subject (i.e. the data donor and the beneficiary of the rules of data protection).

Informed consent as a key element of data protection

Due to the particularities of data protection laws, disclosure of data in a clinical trial by participants means, above all, that they consent to the processing of their personal data. Therefore, informed or general consent and the right to withdraw it are of great importance. Generally speaking, a study participant transfers control over his or her data to the PI while retaining sovereignty over his or her personal data. This extends to a participant’s right to withdraw consent and have his or her data deleted, which is not easy to achieve in practice but is one of the core requirements of the GDPR and Switzerland’s revised FADP, which will be enacted in 2023. The right to deletion also conflicts with the data storage obligations under research law. A solution to this conflict could possibly be the anonymisation of the data in question because anonymised data are no longer personal data.

Participants’ biological samples and genetic information

Swiss research law contains special provisions on the handling of research participants’ biological material and genetic data (HRO, Art. 28). Depending on the degree of coding or anonymisation, different requirements exist for general consent for further use in research. The requirements range from written consent to the mere right to object to the use of anonymised data. At the same time, genetic data are generally exposed to reidentification, so technical safeguards must be established.

Research with children and adolescents and research on rare diseases

Children and adolescents are vulnerable persons, which is why the HRA contains a chapter that sets stricter provisions for their protection (Chapter 3, Section 1). First, no research should be conducted with children and adolescents if the findings can also be obtained with adults. Second, the principle of the best possible involvement in the consent process applies. Children are defined as persons up to the age of 14 years (Art. 3, HRA). In addition to age, a relevant criterion is capacity of judgment, which has to be assessed individually by the researcher. Children who have the capacity to judge must give their own written consent to a clinical trial in addition to the consent of their legal representatives (Art. 22, HRA). There is no provision for the renewal of consent when an adolescent reaches the age of majority; however, the right to withdraw previous consent still applies.

Another point to consider is that research with children is often research on rare diseases. As the word rare implies, the data available for this research is usually sparse and requires international cooperation and cross-border data disclosure (i.e. the guarantee that Swiss minimum standards are met abroad). Swiss data protection rules require specific guarantees for cross-border data sharing (Art. 6, FADP). Within the framework of the Swiss Personalized Health Network (SPHN) funding program, a multicentre project is dedicated to improving the data situation and strengthening cooperation among paediatric clinics.

High willingness to participate in research studies

Why are patients willing to disclose sensitive data and participate in trials at all? According to a recent survey of 10,000 patients in the US,¹ there is a high willingness of patients to participate in studies, despite the public debate about privacy and the risk of abuse. Participants not only expect a personal benefit but also see a larger societal benefit to participating in a scientific project. Participation was shown to be highest for people with rare diseases and for better educated individuals. It is not possible to say conclusively whether the results of the US survey can be transferred to the conditions in Europe and Switzerland; however, the findings can inform researchers’ efforts to improve participation. For example, by including patient representatives early on in the planning stage of a trial and by providing a clear, even personal and verbal, explanation of a trial that is easy to understand, more individuals with less education might be persuaded to participate in a trial.

Patients appreciate feedback

In a recent, albeit non-representative, unpublished survey in a Swiss registry study, it emerged that study participants highly value regular feedback from the PI. There is a trend toward periodic digital exchange in which communication with participants does not end with the mere signing of the informed consent form. Especially in longitudinal studies such as cohorts, communication in newsletters is a suitable means of staying in contact with participants. Communication also improves retention within a study. However, effective communication requires an appropriate study design in which, in the best case, patients can share their ideas in advance. The Swiss Clinical Trial Organisation (SCTO) is currently building a platform of relevant patient boards that will foster a more patient-centred approach in Swiss clinical trials.

Conclusion

There is no lack of legal standards when it comes to protecting the personal data of study participants. This is due to the rapidly evolving regulation of data protection and human research in Switzerland. Researchers in Swiss institutions also need to keep an eye on international developments, such as the GDPR and CTR. Although the regulations aim to benefit patients and participants, it is the task of principal investigators to effectively meet the standards by setting up professional and compliant study designs. Despite a public debate about the risks of data abuse, there is a high willingness to participate in trials. And those who participate in trials appreciate updates. Investigators should take advantage of this willingness and involve patients early on in the study design as a standard of practice.

References

1. Sanderson SC et al. (2017) Public attitudes toward consent and data sharing in biobank research: A large multi-site experimental survey in the US. American Journal of Human Genetics (100)3:414–247. doi: https://www.cell.com/ajhg/fulltext/S0002-9297(17)30021-6