TY - JOUR AU - Pormeister, Kärt AB - Key Points The European Data Protection Board's opinion on the interplay between the General Data Protection Regulation and the Clinical Trials Regulation (CTR) contains logical fallacies. The European Data Protection Board (EDPB) argues that consent is generally not an appropriate legal basis for the processing of personal data for primary research purposes in clinical trials due to a presumed imbalance of power between trial sponsor and participant, neglecting the fact that such an imbalance of power would render participation in the trial impossible in the first place. The EDPB insists that the CTR does not regulate consent to data processing, but only consent to trial participation, whereas article 28(2) CTR could be argued to establish a notion of consent for the secondary research uses of the personal data obtained for and during clinical trials. Introduction Clinical trials on humans are a form of medical research aimed at ultimately developing medicinal products for human use. As such, they inevitably involve the processing of health, genetic and other types of (possibly highly sensitive) personal data that are needed to assess the safety and efficacy of a medicinal product. This means that data protection is an unavoidable topic that needs attention in the specific realm of clinical trials as well. And clinical trials have, in fact, received such attention from the European Data Protection Board1 (EDPB) in the form of an opinion concerning the interplay between the General Data Protection Regulation2 (GDPR) and regulation (EU) 536/2014 on clinical trials on medicinal products for human use3 [Clinical Trials Regulation (CTR)].4 Unfortunately, this opinion of the EDPB contains logical fallacies regarding consent as a legal basis for the processing of personal data in clinical trials, and the secondary use of such data in further research, including beyond clinical trials. Regarding the research use of ‘special categories’ of personal data, the GDPR leaves this to be regulated either in national Member State or other EU law.5 Currently, the CTR seems to be the one piece of EU legislation that may arguably contain a specific rule on consent to data processing for the secondary research use of (special categories of) personal data. However, this very statement establishes the crux of the matter: the EDPB firmly claims that the CTR does not to any extent regulate consent to data processing, whereas a literal reading and systematic interpretation of both the GDPR and the CTR could lead one to this conclusion. This article aims to address two major points of contention regarding the interplay between the GDPR and the CTR. First, there is the matter of the appropriate legal basis for the primary research uses of personal data obtained for and processed during clinical trials specifically. This article will argue that the EDPB has got it wrong by claiming that in most cases informed consent cannot be the appropriate legal basis. Second, this article will argue that the CTR does, in fact, contain a specific data protection related rule regarding consent for the secondary research use of personal data obtained for and during clinical trials beyond such trial protocols. To develop these two main arguments, the article will first analyse the regulation (or rather lack thereof) of clinical trials under the GDPR. Thereafter the opinion of the EDPB regarding the legal bases for the primary and secondary research uses of personal data obtained for clinical trials will be scrutinized respectively. As the following analysis will contain numerous references to recitals in EU legislation, it is important to note that, as established by the Court of Justice of the EU, ‘the preamble to a Community act has no binding legal force and cannot be relied on as a ground for derogating from the actual provisions of the act in question’.6 Recitals have been seen as performing a ‘supplementary normative role’ and acting as ‘interpretative tools in the EU legal order’.7 Thus it should be kept in mind throughout the analysis that although recitals can help interpret legal rules established in the legally binding parts of EU legal acts, recitals do not establish them. What impact exactly a specific recital has in practice, is a matter to ultimately be settled in jurisprudence.8 Clinical trials under the GDPR The GDPR makes a specific reference to clinical trials in recital 161 by clarifying that, ‘For the purpose of consenting to the participation in scientific research activities in clinical trials, the relevant provisions of [the CTR] should apply’. Other than this one specific reference to the interplay between the GDPR and the CTR, the GDPR generally refers in recital 156 to the fact that, ‘The processing of personal data for scientific purposes should also comply with other relevant legislation such as on clinical trials’. These two quotations present the entirety of specific references to clinical trials in the GDPR. This means that, in general, clinical trials are simply seen as ‘scientific research’ within the meaning of the GDPR.9 The two specific references in the GDPR to clinical trials make rather obvious statements. There should be no doubt that ‘consenting to the participation in scientific research activities in clinical trials’ is a matter that spills over the realm of personal data processing and into the physical world, where the primary or sole concern is no longer data protection, but the actual physical and emotional well-being of a person participating in a clinical trial, where interventions are undertaken on humans for scientific purposes. As emphasized in recital 1 of the CTR, it is the rights, safety, dignity, and well-being of persons participating in clinical trials that is of utmost importance in the context of clinical trials. The EDPB has explained in this regard that the requirements of consent for participation in a clinical trial under the CTR, […] respond primarily to core ethical requirements of research projects involving humans deriving from the Helsinki Declaration. The obligation to obtain the informed consent of participants in a clinical trial is primarily a measure to ensure the protection of the right to human dignity and the right to integrity of individuals under Art 1 and 3 of the Charter of Fundamental Rights of the EU; it is not conceived as an instrument for data protection compliance.10 Consent to participation in clinical trials is deemed by the EDPB to ‘serve as an ethical standard or procedural obligation’, which in the context of data protection law is regarded as ‘an additional safeguard’.11 It is a somewhat contradictory qualification for the EDPB to consider consent to participation in clinical trials ‘an additional safeguard’ within the meaning of data protection law, as they at the same time so clearly state that it is ‘not conceived as an instrument for data protection compliance’, as noted in the quote above. There is no dispute about the fact that a clear distinction must be made between ‘consenting to participation in clinical trials’ on the one hand, and ‘consenting to data processing’ on the other.12 The former is regulated by the CTR, and the latter is ‘generally’13 regulated by the GDPR.14 The object and scope of the two are inherently different, whereas arguably the main characteristics remain the same: in both cases consent must be voluntary, ie, freely given,15 and the individual must be thoroughly informed prior to giving consent.16 However, in denying the appropriateness of consent as a legal basis for data processing in clinical trials, the EDPB seems to argue that the same set of factual circumstances could lead to a different outcome when determining whether consent could be given freely in the context of consenting to participation in a clinical trial on the one hand, and, on the other hand, in the context of consenting to data processing within that same clinical trial. The legal basis for the primary research use of personal data in clinical trials The CTR makes references to data protection rules throughout. In a most general manner, the CTR stipulates that personal data protection rules are to be followed when personal data processing is undertaken pursuant to the CTR, ie, within the framework of clinical trials.17 Thereby the CTR reaffirms the analogous general principles expressed in the above cited recitals of the GDPR. There is no dispute about the fact that the GDPR and the CTR apply simultaneously, and that the CTR does not seem to regulate the legal bases for personal data processing for the primary research uses of personal data in clinical trials. In practice so far, this processing has been subject to and based on participants’ informed consent to data processing,18 which is typically obtained in parallel to the consent to participation in the trial (usually as part of the information and consent package given to the potential participant). However, the EDPB has declared in their 2019 opinion on the interplay between the GDPR and the CTR that consent is, in most cases, not the appropriate legal basis for personal data processing in clinical trials. This assertion will be thoroughly scrutinized as follows. First, the EDPB’s argument of ‘imbalance of power’ will be rebutted. Second, alternative arguments in support of the EDPB’s conclusion on the inappropriateness of consent as a legal basis will be offered and explored. Third, the EDPB’s arguments regarding issues related to withdrawal of consent will be challenged. Fourth, problems concerning alternative legal bases suggested by the EDPB will be discussed. Fifth, and finally, it will be argued that consent is and, to an extent, should be the preferred legal basis for primary processing of personal data in scientific research (incl. clinical trials). The ‘Imbalance of Power’ Argument as the greatest logical fallacy in the EDPB’s opinion The position of the EDPB in denying consent as an appropriate legal basis for the primary research use of personal data in clinical trials is centred on an argued imbalance of power. The EDPB concludes that consent will not be the appropriate basis for data processing in most cases.19 There are two major problems with the EDPB’s line of argumentation: (i) in its position, the EDPB refers to the WP29 opinion on consent under the GDPR erroneously when stating that consent is generally not an appropriate legal basis for data processing; and (ii) an imbalance of power between the trial sponsor and potential participant would generally preclude participation in the clinical trial in the first place. In denying the appropriateness of consent as a legal basis for data processing in clinical trials the EDPB refers to the opinion of the WP29 on consent.20 In doing so, the EDPB refers to a part of the WP29 opinion in which the WP29 discusses specifically the imbalance of power where processing takes place by public authorities21 or in the context of employment.22 The WP29 does note at the end of the relevant subsection in their opinion that the possibility of an imbalance of power is not limited to public authorities and employers, and could apply if the data subject is unable to exercise a real choice, there is a risk of deception, intimidation, coercion or significant negative consequences (eg substantial extra costs) if consent is not given. The WP29 concludes by stating that, ‘Consent will not be free in cases where there is any element of compulsion, pressure or inability to exercise free will’.23 Based on this opinion of the WP29, the EDPB remarks that, ‘consent will not be the appropriate legal basis in most cases, and other legal bases than consent must be relied upon’.24 This is not what the WP29 concluded, as they did not argue a general inappropriateness of consent as a legal basis for data processing. Conceded, the EDPB might have meant ‘in most cases [concerning clinical trials]’. But even in this case, the problem is that the EDPB brings as examples cases ‘when a participant is not in good health conditions, when participants belong to an economically or socially disadvantaged group or in any situation of institutional or hierarchical dependency’.25 Only the first of these examples (‘when a participant is not in good health conditions’) could allow for a debate as explained later, but the latter two are clearly also addressed in the CTR as precluding voluntariness of consent. Namely, participation in a clinical trial is generally only possible based on prior free and informed consent of the person concerned, or a legally designated representative.26 The only exception to the rule of prior informed consent are emergency situations, where ‘it is not possible to obtain informed consent prior to the intervention’.27 Regarding the voluntariness of consent to participation in clinical trials recital 31 CTR specifically states that: In order to certify that informed consent is given freely, the investigator should take into account all relevant circumstances which might influence the decision of a potential subject to participate in a clinical trial, in particular whether the potential subject belongs to an economically or socially disadvantaged group or is in a situation of institutional or hierarchical dependency that could inappropriately influence her or his decision to participate. Thus, if there should occur an imbalance of power as described in recital 31 CTR, and consent to participation in the clinical trial can therefore not be freely given, then participation in the trial is not possible at all. Although, as noted above, the notion of informed consent to participation in a clinical trial must be differentiated from informed consent to data processing, the underlying circumstances giving rise to an argument of imbalance of power and excluding voluntariness of consent remain the same for both types of consent. If there are circumstances that give rise to concerns regarding consent being freely given, this will exclude the possibility of participating in the trial. Vice versa, if there are no concerns of an imbalance of power, and free and informed consent to participation in the clinical trial can be given, there could not at the same time be grounds for alleging an imbalance of power regarding consent to data processing within the context of the same clinical trial. This is the greatest logical fallacy in the position of the EDPB regarding consent as legal basis for the primary research use of personal data in clinical trials. The author does not stand alone in her criticism of the EDPB’s argument of a presumed imbalance of power excluding consent from being an appropriate legal basis for data processing in clinical trials. Peloquin et al. refer to the EDPB’s argument of imbalance of power as ‘a very curious – even anomalous – result, given that the EU CTR typically requires the consent of the subject for enrolment in the clinical trial despite the same power dynamics inherent to the clinical trials context’.28 Alternative arguments to support the EDPB’s stance on consent as a legal basis There are (at least) two alternative lines of argumentation that could support the EDPB’s overall stance on consent as a legal basis for the primary research use of personal data in clinical trials: (i) arguing that standards for the voluntariness of consent are different within the GDPR and the CTR; (ii) arguing that once consent to participation has been given, there is no real choice regarding data processing as data processing is an inherent part of participating in the trial, thereby excluding specifically the voluntariness of the consent to data processing. US scholars have referred to the ‘legal doctrine of voluntariness’, which establishes that ‘for legal purposes, a decision is presumed to be voluntary if no evidence exists that someone else has unduly influenced it or coerced the person deciding’.29 Wertheimer explains that ‘from this perspective, a decision is not regarded as involuntary if it is driven by the agent’s own values and preferences or the agent’s circumstance, such as poverty, illness, or, in medical cases, the lack of “alternative treatment options”’.30 However, this legal doctrine of voluntariness that is attributable to the US legal system is not compatible with the meaning of ‘freely given’ neither under the GDPR nor the CTR. Both the GDPR and the CTR set a much higher threshold for voluntariness of consent. Article 4(11) GDPR incorporates the requirement of ‘freely given’ into the definition of consent to data processing within the meaning of the GDPR. Recital 42 GDPR explains that ‘Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment’. Recital 43 GDPR further sets out that consent cannot be considered freely given if there is an imbalance of power, which is presumed to be the case if the controller is a public authority. As for clinical trials and consent to participation, article 2(21) CTR as well incorporates the requirement of voluntariness of consent into the definition of ‘informed consent’. Recital 31 CTR emphasizes that ‘all relevant circumstances which might influence the decision of a potential subject’ must be considered when determining whether consent is freely given. The question is whether by referring to a ‘genuine or free choice’ in recital 42, the GDPR sets a higher standard of voluntariness than the CTR? As laid out above, the EDPB suggests that in the context of clinical trials, consent to data processing within the meaning of the GDPR could not be ‘freely given’ ‘when a participant is not in good health conditions, when participants belong to an economically or socially disadvantaged group or in any situation of institutional or hierarchical dependency’.31 It is clear that the latter examples would rule out voluntariness of consent under the CTR as well, as these are explicitly listed in recital 31 CTR. What remains is the scenario in which the potential participant is ‘not in good health conditions’. If there is no approved treatment of a specific medical condition, one option to receive treatment would be to participate in a clinical trial. In this case, the choice for the individual would be whether to participate in a clinical trial and receive an investigational medicinal product (ie, one still being tested) or a placebo, or whether not to participate in a clinical trial and not receive any medicinal products at all (if there is no approved treatment). The question then is whether this sort of predicament would render consent not ‘freely given’? Within the context of the CTR, it would not make sense to preclude participation from a trial on the grounds that there is no existing approved treatment available. It is important to note that the aim of clinical research is not to provide clinical care to the participants,32 but to ‘generate useful information for future patients and not necessarily to achieve a therapeutic benefit, since this cannot be guaranteed’.33 Furthermore, as noted, even within a clinical trial, a participant might receive just a placebo instead of an actual medicinal product. This means that the choice of the individual is not that between no care at all and guaranteed therapeutic benefits from the trial; rather the choice is between no treatment with medicinal products on the one hand, and participation in an investigational study on the other, which might entail receiving an investigational treatment with unknown effects on the specific individual or receiving a mere placebo. This means that the individual does, in fact, have a genuine choice of two options with different risks attached. Considering the possible negative consequences of participation in a clinical trial, if any differentiation is to be made, the threshold for voluntariness of consent should be higher under the CTR than it is under the GDPR. Furthermore, if the individual can be deemed to exercise their choice freely within the meaning of participation to a trial, their ‘freedom of choice’ should be seen as extending to the processing of data. Although informed consent to participation in a clinical trial and that to data processing are two distinct notions, the underlying motivations of an individual extend to both as there can be no participation in the trial without the processing of the data of the individual. In fact, the processing of (personal) data is the very core aim of a clinical trial. Voluntariness depends on factual circumstances and is not impacted by whether consent is given to participation in a clinical trial, or to data processing within that trial—if the factual circumstances are the same, one type of consent could not be argued to have been given voluntarily without the other being attributed the same assessment, unless one were to adopt the following absolute approach. Another alternative argument would be to make an absolute claim that consent could never be an appropriate legal basis for data processing in clinical trials. This argument would be based on the simple logic that once the individual consents to participation in the trial, processing of their data is inevitable, as it is the very core of a clinical trial to process (personal) data. This means that consent to data processing would never be subject to a ‘genuine or free choice’ as referred to in recital 42 GDPR, as the notion of choice regarding data processing can be said to have ended once the individual has chosen to participate in the trial. However, this is not the line of argumentation pursued by the EDPB. The EDPB does not absolutely preclude consent as an appropriate legal basis for data processing in clinical trials, although they seem to heavily discourage it. The issue of withdrawal of consent Another argument against consent as a legal basis brought forth by the EDPB is the matter of withdrawal of consent. The EDPB indicates that if consent were to be used as a legal basis, withdrawal of consent by the data subject would mean that the controller would have to ‘stop the processing actions concerned and if there is no other lawful basis justifying the retention for further processing, the data should be deleted by the controller’.34 However, the EDPB thereby also refers to article 17(3) GDPR, which, inter alia, specifically creates an exception to the right to be forgotten and the controller’s respective obligation to delete the data if further processing is necessary for purposes of scientific research (article 17(3)(d) GDPR). Of course, article 17(d)(3) GDPR only counter-acts the data subject’s request for deletion of their data but does not in itself provide for a legal basis for further processing. However, such a legal basis might arise from article 6(1) GDPR, or national or other EU law when it comes to special categories of personal data governed by article 9 GDPR. This alternative basis for processing is something that the EDPB not only recognizes, but, in fact, relies upon in its argumentation against consent as a legal basis for data processing in clinical trials. Furthermore, relying on recital 50 GDPR, the EDPB explains that under certain circumstances, relying on the ‘presumption of compatibility’, there might not even be a need for a new legal basis if the processing is undertaken for research purposes.35 An argument could be made that the use of consent as a legal basis could be construed as misleading to individuals if withdrawal of consent might not disable the further research use of the data. However, the possible consequences of withdrawal of consent in the specific context of research would have to be communicated to the individual. Although article 13(2)(c) GDPR does not explicitly refer to this nuance regarding consent and withdrawal thereof, it derives logically from the aim of article 13(2) GDPR, which is to ensure fair and transparent processing. Furthermore, under article 13(3) GDPR the controller would have to inform the individual of such further processing before commencing it, and the individual would retain their right to object as provided in article 21 GDPR—just like would be the case if the processing would rely on a legal basis other than consent. The problems with the alternative legal bases suggested by the EDPB Strongly tied into the logical fallacy regarding the inappropriateness of consent as a legal basis are the alternative legal bases suggested by the EDPB for the primary research use of personal data in clinical trials. Referring to consent as a last resort for a legal basis, the EDPB suggests that the processing of personal data for the primary research use in clinical trials could be based on: a task carried out in the public interest under Art 6(1)(e) in conjunction with Art 9(2), (i) or (j) of the GDPR; or the legitimate interests of the controller under Art 6(1)(f) in conjunction with Art 9(2) (j) of the GDPR.36 However, as far as special categories of personal data are concerned, these alternative legal bases suggested by the EDPB presume the existence of relevant legal clauses in national or other EU law (article 9(2)(i) and (j) GDPR). Alternative legal bases for data processing in clinical trials are a theoretical possibility and, depending on national laws, a practical one, if there exists a relevant legal basis in law. If there was a legal basis in national or other EU law that would legitimize personal data processing in clinical trials without consent, then these could also serve as a legal basis in the case of withdrawal of consent. This is another logical fallacy in the opinion of the EDPB—whilst building their entire approach on the above referred alternative legal bases for processing, they ignore the existence of such legal bases when asserting that consent as a legal basis would be impractical since withdrawal of consent would preclude the prospective use of the data from the trial. However, the matter of legal bases for data processing alternative to consent is not as simple as the EDPB might make it seem. As far as special categories of personal data are concerned, there are only a few scenarios in which the GDPR itself would suffice as a legal basis, ie, where no specific legal rule in national or other EU law would be required. These are outlined in subparagraphs (b)–(e) and in part also in subparagraph (h) of article 9(2) GDPR. Some of these subparagraphs do require something other than the GDPR itself as a legal basis. For example, article 9(2)(b) allows for a collective agreement to serve as a legal basis for data processing for the purposes laid out in that subparagraph, if it is ‘pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject’. Similarly, article 9(2)(h) GDPR allows data processing based on a contract with a health professional for the purposes listed in that subparagraph, provided that additional requirements of confidentiality laid out in article 9(3) GDPR are met. For the cases described in subparagraphs (c)–(e) of article 9(2) GDPR, the referred subparagraphs themselves are the legal basis for data processing in those specific circumstances. As noted earlier, for clinical trials as scientific research, article 9(2)(j) would be the relevant subparagraph in the GDPR. However, article 9(2)(j) GDPR is not a legal basis for data processing in clinical trials, but it refers to the legal basis being established on a discretionary basis in either Member State or other EU law. For example, the Estonian Data Protection Act37 allows in § 6 for personal data (incl. special categories) to be processed for purposes of scientific research without consent of the individual, and on certain conditions, with direct identifiers.38 This paragraph provides legal bases for the processing of any type of personal data for research purposes, including as part of clinical trials. This is an example of national law providing legal bases alternative to informed consent for personal data to be processed in clinical trials. If national law lacks such an alternative legal basis as is established in the Estonian Data Protection Act, then consent could be the only possible legal basis for the primary research uses of special categories of personal data in clinical trials. To claim otherwise would be arbitrary and render the GDPR nothing but a disarranged compilation of principles, as opposed to a logically comprehensible system of rules, which every legal act should be. This presents another logical fallacy in the EDPB’s approach to personal data processing in clinical trials: their opinion relies entirely on Member State law, which makes data protection compliance for multi-national clinical trials in the EU extremely difficult due to possible differences in or even conflicts of law between different Member States.39 Consent as a privileged legal basis for data processing in (health) research? As Ni Loideain notes, the question of appropriateness of consent as a legal basis for data processing in health research is an ongoing legal and policymaking challenge.40 However, the arguments in favour of consent as a legal basis for data processing in clinical trials go beyond rebuttals to the EDPB’s opinion. As Dove and Chen point out, although the GDPR as an overarching legal framework does not seem to privilege consent as a legal basis for data processing, in many jurisdictions consent seems to be the preferred legal basis for data processing in health research.41 Whereas Dove and Chen criticize affording consent too much privilege, they ultimately argue in support of consent being privileged to a certain degree.42 They emphasize that, ‘Consent enables individuals to exercise some degree of control over their body and bodily integrity, of which personal data forms a crucial component’.43 Mourby and others44 refer to studies that show that participants value consent as a means of giving approval to research projects,45 and a mechanism for respecting their autonomy.46 Furthermore, generally the underlying motivation for enabling legal bases alternative to consent for data processing in research has been to remove hindrances from conducting research,47 as opposed to being necessitated by concerns regarding participants, such as that of voluntariness of consent. For example, consent as a legal basis for data processing in research might prove impractical for large-scale data intensive studies,48 or due to granularity requirements of consent under the GDPR.49 Due to this, many jurisdictions enable data processing in research without consent if certain conditions are met—some with quite generous approaches,50 and others less so. As shown by Dove and Chen, some national legislators seem to view consent as the default option and set quite high thresholds for circumventing the requirement of consent for using personal data in health research.51 This type of preference afforded to consent as a legal basis in national laws further reaffirms the general perception of consent as a privileged legal basis for personal data processing in health research. This is in stark contrast with the EDPB’s opinion on consent as a legal basis for data processing in clinical trials. In addition to the above presented problems with the EDPB’s opinion, another point of contention concerns the legal basis for secondary research uses of personal data obtained for and during clinical trials, which shall be addressed next. The legal basis for the secondary research uses of personal data beyond clinical trials The GDPR does not directly regulate the secondary research use of personal data. It does so indirectly by relieving research uses from the purpose and storage limitations (article 5(1)(b) and (e) GDPR). In terms of special categories of data, article 9(2)(j) GDPR clearly gives discretion to both national and EU lawmakers to regulate the use of special categories of personal data for research purposes. From this it must follow that such national and EU law would then apply simultaneously with the GDPR.52 The author asserts that the CTR is, in fact, one such piece of EU legislation as referred to in article 9(2)(j) GDPR, as it arguably regulates consent for the secondary research use of data obtained for and during clinical trials. Namely, the CTR contains in article 28(2) a notion of consent, which the author of this article argues to be consent for data processing within the meaning of the GDPR, whereas the EDPB claims the opposite. Article 28(2) CTR states that, Without prejudice to Directive 95/46/EC, the sponsor may ask the subject or, where the subject is not able to give informed consent, his or her legally designated representative at the time when the subject or the legally designated representative gives his or her informed consent to participate in the clinical trial to consent to the use of his or her data outside the protocol of the clinical trial exclusively for scientific purposes. (emphasis added) As noted, there is no dispute about the fact that the GDPR and the CTR apply simultaneously, however, the EDPB firmly claims that the CTR does not create any derogations from the GDPR by stating that, It follows that both legislations apply simultaneously and that the CTR constitutes a sectoral law containing specific provisions relevant from a data protection viewpoint but no derogations to the GDPR.53 It is unclear what exactly the EDPB means by the CTR ‘containing specific provisions relevant from a data protection viewpoint’, other than the very general references in the CTR to the data protection framework. The EDPB does, however, make it abundantly clear that they consider none of the notions of consent under article 28 CTR to be ‘conceived as an instrument for data protection compliance’, but instead to respond ‘primarily to core ethical requirements of research projects involving humans deriving from the Helsinki Declaration’.54 The EDPB supports this argument mainly by referring to the structure of the CTR and the fact that article 28 is a part of Chapter V CTR, which primarily concerns the protection of human research subjects from the viewpoint of human dignity and the right to integrity, rather than data protection. In terms of article 28(2) CTR specifically, the EDPB reiterates the same line of argumentation and emphasizes that, […] consent foreseen in article 28(2) CTR is not the same consent referred to in the GDPR as one of the legal bases for the processing of personal data, regardless of whether it is or not the legal ground used for the primary processing.55 This approach of the EDPB regarding article 28(2) CTR makes no sense considering the text and literal reading of the CTR. Article 28(2) CTR clearly states that the consent referred to in this paragraph is one for the use of the trial participant’s personal data in future research, ie, not consent to participation in any future human subject research within the meaning of the Helsinki Declaration. Thus, article 28(2) CTR can reasonably not be conceived as anything other than consent to data processing as it clearly only concerns the further use of data. This conclusion is supported by recital 29 CTR, which explains that consent within the meaning of article 28(2) CTR concerns the use of data in further research and that such further research projects shall be subject to appropriate (ethical) reviews. This means that the consent referred to in article 28(2) CTR is not meant to establish an ethical safeguard but is simply consent for the future research use of data—thereby literally establishing consent for data processing. It is important to understand in this regard that, as made clear in its first article, the CTR only applies to research that is defined as a ‘clinical trial’ within the meaning of the CTR. This means that the CTR does not apply to future secondary research based on data obtained during a clinical trial (unless that future research happens to be a new clinical trial). This leads to the conclusion that the CTR could not establish any safeguards or ethical requirements to future studies based on the data obtained during clinical trials as such future studies would likely not fall within the scope of the CTR in the first place. What the CTR can do and does, however, is provide a notion of broader consent as a legal basis for the secondary research use of the data obtained for and during clinical trials, which are within its scope. The European Data Protection Supervisor (EDPS) seems to remain unopinionated on this matter as of yet. In their opinion on data protection and scientific research, the EDPS refers to the EDPB’s opinion, but do not take a stance on the meaning of article 28(2) CTR. Instead, they simply refer to the fact that the secondary use of personal data obtained for and during clinical trials is subject to consent of the research participant for the use of their data outside the clinical trial.56 Unfortunately, the EDPS offers no insight as to whether they classify this consent as consent to data processing within the meaning of the GDPR or not. It cannot be ignored that article 28(2) CTR does state that it applies ‘Without prejudice to Directive 95/46/EC’. The use of the phrase ‘without prejudice’ is a somewhat curious occurrence in EU law as it is not clearly defined anywhere. The notion of ‘without prejudice’ is attributable to common law,57 whereas the EU is in most part composed of countries of the civil law tradition.58 There is no common meaning to or interpretation of what ‘without prejudice’ means in the context of EU law, nor is there any such definition provided in EU law. Perhaps the ‘without prejudice to’ reference in article 28(2) CTR simply refers to the fact that the GDPR still applies as a general framework for personal data processing rules, which is a fact not disputed by anyone. Whichever way ‘without prejudice’ might be interpreted or understood in the context of article 28(2) CTR, it is important to recognize that there is no direct conflict between article 28(2) CTR and rules on consent under the GDPR. Recital 33 GDPR and article 9(2)(j) GDPR leave it within the discretion of national and EU lawmakers to specify the scope of consent when it comes to consent as a legal basis for the research use of (special) categories of data. Although the GDPR-compliant breadth of consent in research per recital 33 GDPR is a whole debate in itself,59 consent to the research use of data is meant to be a discretionary matter for Member States and EU lawmakers to regulate.60 The question of whether article 28(2) CTR establishes a notion of informed consent for data processing is a matter of practical importance. If it does not, and if there is no national law regulating this matter, personal data obtained for and during clinical trials could generally only be used in further research either based on specific consent (article 6(1)(a) or article 9(2)(a) GDPR), or on the alternative bases suggested by the EDPB in their opinion on the interplay between the GDPR and the CTR.61 However, as concluded in the previous section of this article, legal bases alternative to consent would require relevant national laws to enable such processing of personal data without consent—at least as far as special categories of data are concerned, eg, health or genetic data, which is always the case in clinical trials. Arguably, as explained by the EDPB, based on article 5(1)(b) and recital 50 GDPR (‘the presumption of compatibility’) secondary research uses of personal data might not need a new legal basis for processing.62 However, the EDPB emphasizes that although the ‘presumption of compatibility’ should not be excluded, ‘These conditions, due to their horizontal and complex nature, will require specific attention and guidance from the EDPB in the future’.63 Hence, the ‘presumption of compatibility’ would not be a catch it all solution. Thus, the lack of relevant national law might present a practical hurdle for the secondary research use of personal data obtained for and during clinical trials if article 28(2) CTR is not regarded as a legal basis for broader consent as referred to in recital 33 GDPR. Conclusion There is no dispute about the fact that the GDPR and the CTR always apply simultaneously, as any clinical trial would require the processing of special categories of personal data (always health data, but likely also other types of special categories, like genetic data and data on racial or ethnic origin, as these might influence drug reactions). However, there is no clarity on the appropriate legal bases for the research use of personal data when it pertains to clinical trials, or the secondary research uses of personal data obtained for and during clinical trials. Whereas consent seems to be, and to an extent arguably should be, the preferred legal basis for personal data processing in scientific research, the EDPB claims in their opinion on the interplay between the GDPR and the CTR that consent is generally not an appropriate legal basis for personal data processing for research purposes in clinical trials. Their argument is mainly centred on an alleged imbalance of power between trial sponsor and potential participant, which would exclude the voluntariness of consent. Although the EDPB recognizes that the CTR does address the possibility of an imbalance of power in terms of the consent given for participation in the trial, the EDPB ignores the fact that such an imbalance of power would preclude participation in the trial in the first place. In other words, if specific circumstances would give rise to the argument that there is an imbalance of power between the trial sponsor and the potential participant, this would mean that consent to participation in the trial cannot be freely given, and thus participation is not possible, which, in turn, would render the discussion on the legal basis of data processing moot. Vice versa, if there are no circumstances indicating an imbalance of power and consent to participation in the trial can be freely given, the same must be said for consent to data processing. Two alternative lines of argumentation, not pursued by the EDPB, could be used to support the EDPB’s general conclusion on the inappropriateness of consent as a legal basis for data processing in clinical trials. First would be the assertion that the threshold of voluntariness is higher under the GDPR compared to the CTR. However, this is a nonsensical argument given possible risks adherent to participation in clinical trials. The second alternative would be to argue that consent to data processing cannot ever be freely given in a clinical trial, as giving consent to participation would leave no real or genuine choice in terms of personal data processing within that trial [given that the very core of clinical trials is to collect and process (personal) data]. As to the secondary research uses of personal data obtained for and during clinical trials, the EDPB insists that the CTR does not establish any rules pertaining to consent to data processing. Whereas article 28(2) CTR clearly and explicitly refers to consent for the future use of data, which is, literally, consent to data processing. The GDPR specifically refers to the discretion of national and EU lawmakers in regulating the research uses of special categories of personal data, and recital 33 GDPR furthermore emphasizes the practical need to approach consent to data processing more broadly when it comes to research. Hence, a systematic interpretation of the GDPR and a literal reading of article 28(2) CTR lead to the following conclusion: article 28(2) CTR establishes a notion of broad(er) consent for trial sponsors to allow them to use the personal data obtained for and during clinical trials for research purposes beyond trial protocols as long as the data are used ‘exclusively for scientific purposes’. Footnotes 1 A body of the European Union established under art 83 of the GDPR. 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), OJ L 119/1. 3 Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC (CTR), OJ L 158/1. 4 EDPB, ‘Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art 70.1.b))’ (23 January 2019) (EDPB Opinion 3/2019), at 5, para 15. The conclusions made by the EDPB in Opinion 3/2019 were reaffirmed in a document published by the European Commission, although this document includes a disclaimer stating that the document serves information purposes only and ‘does not contain any authoritative interpretation of EU law, in particular EU acts referred to in it, and it does not constitute a decision or position of the Commission’. Directorate-General for Health and Food Safety of the European Commission, ‘Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation’, at 1. 5 GDPR, art 9(2)(j). 6 Case C-162/97 Nilsson and others [1998] ECR I-07477, para 54. 7 Roberto Baratta, ‘Complexity of EU Law in the Domestic Implementing Process’ (2014) 2(3) Theory Pract Legis 293, 296 and 302. See also Kärt Pormeister, Transparency in Relation to the Data Subject in Genetic Research – An Analysis on the Example of Estonia (University of Tartu Press 2019) 39. 8 For example, it is not clear how GDPR recital 33 interacts with GDPR arts 9(2)(a) and 9(2)(j) when it comes to the breadth of informed consent in research. It could be argued, that GDPR recital 33 sets boundaries to the discretion afforded to Member States and EU lawmakers in GDPR art 9(2)(j) to establish specific rules on the use of special categories of data for research purposes, allowing for exceptions from the general rules on consent for using special categories of data as set out in GDPR art 9(2)(a). The Article 29 Working Party seems to take an approach similar to this. See Pormeister (n 7) 37ff. See also Article 29 Working Party, ‘See Article 29 Working Party, ‘Guidelines on consent under Regulation 2016/679’ (WP259 rev.01, 10 April 2018) (WP29 guidelines on consent), at 28. 9 The concept of ‘scientific research’ is approached broadly in GDPR recital 159. See Kärt Pormeister, ‘Genetic Data and the Research Exemption: is the GDPR Going Too Far?’ (2017) 7(2) Int Data Privacy L 137. The WP29 has stated that ‘scientific research’ within the meaning of the GDPR means ‘a research project set up in accordance with relevant sector-related methodological and ethical standards, in conformity with good practice’. See WP29 guidelines on consent (n 8) 28. However, the European Data Protection Supervisor has tried to limit this broad approach somewhat by further explaining that only ethical research can fall within the scope of ‘scientific research’ within the meaning of the GDPR. See Giovanni Buttarelli, European Data Protection Supervisor, ‘Speech’ (Fifth World Congress for Freedom of Scientific research, 12 April 2018), at 2 accessed 29 October 2021. See also European Data Protection Supervisor, ‘A Preliminary Opinion on data protection and scientific research’ (6 January 2020) (EDPS preliminary opinion), at 12. 10 EDPB Opinion 3/2019 (n 4) 5–6, para 16. 11 European Data Protection Board, ‘Guidelines 05/2020 on consent under Regulation 2016/679’ (ver. 1.1, 4 May 2020), at 30, para 154. 12 Pormeister (n 7) 52. See also Edward S Dove and Jiahong Chen, ‘Should Consent for Data Processing be Privileged in Health Research? A Comparative Legal Analysis’ (2020) 10(2) Int Data Privacy L 117, 128. 13 Although the GDPR serves as a general legal framework for personal data processing, and it shall apply as such in all cases that fall under the scope of the GDPR, specific nuances might be regulated by national or other EU law, as the GDPR leaves discretionary room to Member States and EU lawmakers in many aspects. See, eg, GDPR arts 9(2)(j) and 9(4). 14 EDPB Opinion 3/2019 (n 4) 5, para 15. 15 CTR, art 2(21) defines informed consent as meaning ‘a subject's free and voluntary expression of his or her willingness to participate in a particular clinical trial’. GDPR, art 4(11) refers to consent having to be ‘freely given’. 16 CTR, art 2(21) states that ‘informed consent’ can only be given by an individual ‘after having been informed of all aspects of the clinical trial that are relevant to the subject's decision to participate’. GDPR, art 4(11) combines the notion of being informed into the very definition of consent within the meaning of the GDPR. 17 CTR, art 93. 18 The author was not able to find any official statistics on this, but the fact that consent has been the primary legal basis for data processing in clinical trials has been evidenced in practice as witnessed by the author as a member of the Research Ethics Committee of the University of Tartu from 2016 to 2019. This has also been reaffirmed in professional legal blogs. See, for example, Patrice Navarro and Elisabethann Wright, ‘EDPB’s Position on Clinical Trials Creates Friction with other EU Legislation’ (Engage: Legal Insight and Analysis, 25 April 2019) accessed 29 October 2021. See also Wim Nauwelaerts, ‘Consent for Personal Data Use In Clinical Trials: A Wind Of Regulatory Change?’ (Lexology, 16 May 2019) accessed 29 October 2021. 19 EDPB Opinion 3/2019 (n 4) 6, paras 18–20. 20 EDPB Opinion 3/2019 (n 4) 6, paras 17ff; referring to WP29 guidelines on consent (n 8) 6. 21 In certain jurisdictions, and concerning specific institutions, research institutions might be considered ‘public authorities’, however, even in such cases the notion of ‘imbalance of power’ is quite different as opposed to public authorities in the more traditional sense (ie those providing services to citizens). See Miranda Mourby and others, ‘Governance of Academic Research Data under the GDPR—Lessons from the UK’ (2019) 9(3) Int Data Privacy L 192, 205–6. 22 WP29 guidelines on consent (n 8) 6ff. 23 ibid 7. 24 EDPB Opinion 3/2019 (n 4) 6, para 20. 25 ibid. 26 CTR, recital 27 and arts 28ff. 27 CTR, recital 36 and art 35. 28 David Peloquin and others, ‘Disruptive and Avoidable: GDPR Challenges to Secondary Research Uses of Data’ (2020) 28 Eur J Hum Genet 697, 700. 29 Paul S Appelbaum, Charles W Lidz and Robert Klitzman, ‘Voluntariness of Consent to Research: A Conceptual Model’ (2009) 39(1) Hastings Center Report 30, 32. 30 Alan Wertheimer, ‘Voluntary Consent: Why a Value-Neutral Concept Won’t Work’ (2012) 37(3) J Med Philos 226, 230–31. 31 EDPB Opinion 3/2019 (n 4) 6, para 20. 32 For example, Mourby and others address this scenario in the context of a research institution that is deemed a public authority, and debate whether not giving consent in a clinial trial (Mourby and others seem not to clearly distinguish between consent to participation and consent to data processing) would deprive the individual of access to a core service, and thus preclude voluntariness of such consent. See Mourby and others (n 21) 206. However, what they neglect to consider in this line of argumentation is that provision of medical care is not a core service provided by a research institution. Although a research institution might simultaneously operate as a medical facility providing health care services, a clear distinction must be made between activities carried out as part of a research protocol, and those carried out as part of the provision of health care services. 33 José A Sacristán and others, ‘Patient Involvement in Clinical Research: Why, When, and How’ (2016) 10 Patient Prefer Adherence 631, 634. 34 EDPB Opinion 3/2019 (n 4) 6–7, paras 22–24. 35 ibid 8, para 31. 36 ibid 9, para 34. 37 RT I, 04.01.2019, 11. English translation available at accessed 23 February 2021. 38 Kärt Pormeister, ‘Regulatory Environment for Biobanking in Estonia’ in Santa Slokenberga, Olga Tzortzatou and Jane Reichel (eds), GDPR and Biobanking: Individual Rights, Public Interest and Research Regulation across Europe (Springer 2021) 227. 39 Kärt Pormeister, ‘Genetic Research and Applicable Law: The Intra-EU Conflict of Laws as a Regulatory Challenge to Cross-Border Genetic Research’ (2018) 5(3) J Law Biosci 706. 40 Nóra Ni Loideain, ‘Regulating Health Research and Respecting Data Protection: a Global Dialogue’ (2020) 10(2) Int Data Privacy L 115, 116. 41 Dove and Chen (n 12). 42 ibid 129. 43 ibid. 44 Mourby and others (n 21) 206. 45 Mhairi Aitken and others, ‘Public Responses to the Sharing and Linkage of Health Data for Research Purposes: A Systematic Review and Thematic Synthesis of Qualitative Studies’ (2016) 17 BMC Medical Ethics 73. 46 Amy L McGuire and others, ‘DNA Data Sharing: Research Participants’ Perspectives’ (2008) 10 Genet Med 46. 47 See, eg, Niamh Clarke and others, ‘GDPR: An Impediment to Research?’ (2019) 188(4) Irish J Med Sci 1129–35. 48 ibid. 49 Leslie Stevens, ‘The Proposed Data Protection Regulation and Its Potential Impact on Social Sciences Research in the UK’ (2015) 1 Eur Data Prot Law Rev 97; David Erdos, ‘Systematically Handicapped? Social Research in the Data Protection Framework’ (2011) 20 Inf Commun Technol Law 83. 50 Pormeister (n 38). 51 Dove and Cheng (n 12). 52 For example, if a Member State were to regulate consent to data processing in research in accordance with the guidances provided in GDPR, Recital 33, such national regulation would have to be applied, although the GDPR would clearly still apply as a general framework. Pormeister (n 38); Pormeister (n 7). 53 EDPB Opinion 3/2019 (n 4) 3, para 4. 54 ibid 5, para 16. 55 ibid 8, para 29. 56 EDPS preliminary opinion (n 9) 15–16. 57 See, eg, Bankim Thanki (ed), The Law of Privilege (2nd edn, OUP 2011) 319ff. 58 After the exit of the UK from the EU, Ireland and Cyprus remain the only common law countries in the EU. See Kevin Burns, ‘Legal experts say common law Ireland to be ‘isolated’ within EU after Brexit’ (Irish Legal News, 11 September 2017) accessed 29 October 2021. 59 Kärt Pormeister, ‘Genetic Research and Consent: On the Crossroads of Human and Data Research’ (2019) 33(3) Bioethics 347. 60 Otherwise, it would have been regulated already within the GDPR, as was unsuccessfully attempted during the drafting process. See ibid. 61 EDPB Opinion 3/2019 (n 4) 8, para 34. 62 ibid, para 31. 63 ibid. Author notes † This article is based on a line of argumentation developed by the author in her PhD thesis. See Kärt Pormeister, Transparency in relation to the data subject in genetic research – an analysis on the example of Estonia (University of Tartu Press 2019) accessed 6 November 2021, 47–54. The thesis was successfully defended in January 2020 at the University of Tartu (Estonia). © The Author(s) 2022. Published by Oxford University Press. All rights reserved. For permissions, please email: journals.permissions@oup.com This article is published and distributed under the terms of the Oxford University Press, Standard Journals Publication Model (https://academic.oup.com/journals/pages/open_access/funder_policies/chorus/standard_publication_model) TI - The logical fallacies of the legal bases for data processing in and beyond clinical trials JF - International Data Privacy Law DO - 10.1093/idpl/ipac003 DA - 2022-02-11 UR - https://www.deepdyve.com/lp/oxford-university-press/the-logical-fallacies-of-the-legal-bases-for-data-processing-in-and-gK8I35mWyp SP - 132 EP - 142 VL - 12 IS - 2 DP - DeepDyve ER -