FRANCE Law and Practice Contributed by: Emmanuelle Trombe, Anthony Paronneau, Anne-France Moreau and Lorraine Maisnier-Boché, McDermott Will & Emery
was previously available in the EU Clinical Trials Register. Medical Devices On the other hand, there is currently no publicly accessible database for clinical trials on medi- cal devices. However, once the Clinical Inves- tigations and Performance Studies module of EUDAMED becomes operational, mandatory registration will be required. This requirement will take effect six months after the module is officially declared operational, as announced in the Official Journal of the EU by the European Commission. 2.4 Restriction on Using Online Tools to Support Clinical Trials The use of online tools to support clinical tri- als (eg, for recruiting or monitoring purposes) is not fully regulated in France, although there are guidelines at the EU level. Restrictions however apply on the processing of patient data (see 2.5 Use of Data Resulting From Clinical Trials and 2.6 Databases Containing Personal or Sensi- tive Data ). 2.5 Use of Data Resulting From Clinical Trials Data resulting from clinical trials usually relate to both participants and investigating personnel, thereby qualifying as personal data under Arti- cle 4 of the General Data Protection Regulation (EU) 2016/679 (GDPR). More specifically, data relating to clinical trial participants often reveals details about their health status and generally falls within the category of “data concerning health” (GDPR, Article 4(15)), which is part of the broader classification of sensitive data. Even when pseudonymised, such data remains classified as personal data, as pseudonymisa- tion does not irreversibly prevent the re-iden-
tification of individuals, unlike anonymisation, which is the determining factor for data to be considered non-personal. The transfer of health data to affiliates or third parties may occur under the established GDPR framework, provided that participants are informed and that the processing is based on one of the exemptions outlined in Article 9 of the GDPR, which serves as the legal basis for processing sensitive health data. In the con- text of clinical trials, such processing generally relies either on consent or on public interest, as defined under Article 9 of the GDPR and Article 44, 3° of the French Data Protection Act ( Loi No 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés , or LIL). Where processing is grounded on consent, the transfer of data is permissible only if explicitly addressed in the consent form signed by the participants. Where the processing is based on public interest, the data controller must obtain prior authorisation from the French Data Protec- tion Authority (CNIL) or adhere to a reference methodology. In addition, such authorisation or reference methodology must identify the third party or the affiliate as an authorised recipient. When the recipient is located outside the Euro- pean Union, additional requirements come into play. The data controller must ensure that the transfer is subject to an adequacy decision by the European Commission or, failing that, is gov- erned by standard contractual clauses or binding corporate rules. Furthermore, the data control- ler may need to conduct an impact assessment to evaluate the adequacy of the third country’s legal framework in safeguarding the rights of data subjects.
100 CHAMBERS.COM
Powered by FlippingBook