UK Law and Practice Contributed by: Jackie Mulryne, Ewan Townsend, Adela Williams and Libby Amos-Stone, Arnold & Porter
Since 1 January 2022, the Health Research Authority (HRA) automatically registers clinical trials submitted through IRAS with the Interna- tional Standard Randomised Controlled Trial Number (ISRCTN) registry. Information about trials (for both medicinal and devices) being conducted in the UK is made publicly available on the HRA research summa- ries website and on the UK “Be Part of Research” website. In addition, the advertising code for the phar- maceutical industry published by the Associa- tion of the British Pharmaceutical Industry (ABPI) requires companies to disclose details of clinical trials in accordance with international require- ments. This is not set out in the equivalent Code applicable to medical devices. 2.4 Restriction on Using Online Tools to Support Clinical Trials There are no restrictions on using online tools to support clinical trials or clinical investigations. However, all advertising and all materials pro- vided or directed to subjects will be reviewed by the REC. 2.5 Use of Data Resulting From Clinical Trials Data resulting from clinical trials is likely to be considered as special category (sensitive) per- sonal health data for the purposes of the data protection legislation, even if it is in coded/pseu- donymised form, and will be afforded greater protection than non-special category personal data. The Data Protection Act 2018 and the UK GDPR provide that pseudonymisation is a secu- rity measure that can be used to protect per- sonal data, but it does not mean that the data is beyond the scope of the UK GDPR.
The resulting data can be transferred to a third party or affiliate, provided that any UK GDPR provisions governing such a transfer are com- plied with. The Data (Use and Access) Bill was introduced in October 2024, and it proposes to amend the UK GDPR and Data Protection Act 2018 in vari- ous ways. In particular, it will allow for patients to provide “broad consent” to use of their personal data for scientific research, allowing use of their personal data for broad research purposes. If the Bill receives royal assent, its provisions may come into force by early 2026. 2.6 Databases Containing Personal or Sensitive Data If a database contains personal or special cat- egory (sensitive) personal health data, the UK GDPR would need to be complied with. The key requirements are as follows: • the data is processed lawfully; • the data stored is relevant, up to date and limited to what is required; • sufficient security measures are put in place; • the data is not stored for longer than is nec- essary; and • the relevant individuals have been informed of the use and storage of their data. The party managing the database would also need to comply with the UK GDPR more widely. 3. Marketing Authorisations for Pharmaceuticals or Medical Devices 3.1 Product Classification: Pharmaceuticals or Medical Devices The HMRs define a medicinal product as:
363 CHAMBERS.COM
Powered by FlippingBook