In its Position No. 1/2002, the Office for Personal Data Protection addresses inter alia the issue of personal data processing in connection with clinical testing and “post-marketing” monitoring of drugs. Since the year 2003 brought some major legislative changes in the provisions that stipulate rights and responsibilities of persons using medical substances in health care, certain parts of the aforementioned position must be amended.
The clinical testing of drugs and other medical substances and the related processing of personal data of data subjects is carried out on the basis of Act No. 79/1997 Coll., on Drugs, Amending Certain Related Laws, as amended (hereinafter referred to as “Drugs Act”). Another relevant regulation is Decree No. 472/2000 Coll., of the Ministry of Healthcare and the Ministry of Agriculture, Stipulating Correct Clinical Procedure and Specifying Conditions for the Clinical Testing of Drugs, as amended by Decree No. 301/2003 Coll. (hereinafter referred to as “Decree”).
The aforementioned legislation creates a basic legal framework, referred to in Act No. 101/2000 Coll., on Personal Data Protection, Amending Certain Related Laws, as amended (hereinafter referred to only as “Personal Data Protection Act”). The Personal Data Protection Act presupposes the existence of leges speciales – special legislation, which will regulate procedures as well as rights and duties involved in the processing of sensitive personal data (see Article 9 of the Personal Data Protection Act) together with the general law – the Personal Data Protection Act. The relation of the Personal Data Protection Act and the Drugs Act is therefore the relation between lex generalis and lex specialis, where the provisions of the latter must be applied in precedence to the provisions of the former. However, the Drugs Act also fully respects the fact that there is a law regulating general aspects of the problem. This is reflected in the wording of Article 34, which deals with the protection of the individual taking part in the clinical testing (hereinafter referred to as “test subject”). Paragraph 1 of this Article stipulates that the provisions of the Drugs Act do not in any way affect legislation relating to the protection of those that are subject to the testing.
The Drugs Act and the related Decree authorise the commissioning subject and the person carrying out the tests to launch, carry out and direct the clinical testing on the condition that they ensure observance of the rules laid down by the aforementioned legal regulations. According to the earlier position taken by the Office for Personal Data Protection (No. 1/2002), only the commissioning subject was to be considered the data controller as defined by the Personal Data Protection Act (cit.: “The commissioning subject is therefore in the position of a data controller and consequently has all the duties of a data controller ensuing from the Personal Data Protection Act.”). Here it is necessary to point out that, in accordance with the current wording of the Drugs Act, the commissioning subject is an individual or a legal entity that takes on responsibility for launching, directing and possibly also financing the clinical tests, but that is not responsible for the actual testing, since this is the responsibility of the person carrying out the tests (Article 33(3)(e) and (f) of the Drugs Act).
Still, even the new legislation has not relieved the commissioning subject of all the duties connected with the processing of personal data of data subjects. This is true especially with regard to potential accidents or negative effects, and also with respect to the notification duty, which the person carrying out the tests has in relation to the commissioning subject, including the reporting duty under Article 38 of the Drugs Act. In this case, the commissioning subject is also in the position of a data controller, together with the person carrying out the tests.
In accordance with Article 33(3)(f) of the Drugs Act, the person carrying out the tests is always a doctor. Under Article 34(4) of the Drugs Act, he or she must have adequate qualifications not only for providing medical treatment to the test subjects, but also for making medical decisions in relation to them. Although the term “medical decision” is not defined in more detail in the Drugs Act, the overall context of the provision justifies general interpretation, i.e. it is assumed that the term covers the whole series of decisions that are made by the person carrying out the tests and that ensure proper conduct of the clinical testing under the Drugs Act in relation to the test subjects. This means that the term also covers the decision on whether all conditions necessary for the proper protection of the test subject have been met.
To judge whether the person carrying out the tests observes the conditions necessary for the protection of privacy, one must also take into account certain related provisions of the Drugs Act, which express not only general principles, but also define concrete framework of rights and duties.
The aforementioned related provisions include above all Article 34(9), stipulating that
“interests of the patient must always be regarded in preference to the interests of scientific research and society”.
This principle is further developed by Article 34(3)(c), stipulating that
“clinical tests may be conducted only if the rights of the test subject to physical and psychical inviolability of the person, the right to privacy and to the protection of data relating to the test subject are protected in accordance with a special legal regulation.”
The concrete framework of rights and duties of the person carrying out the tests and the rights of the test subject stem from the aforementioned general principles and conditions. The provisions to be applied in personal data processing include above all Article 34, which stipulates the duty of the person carrying out the tests to obtain an “informed” consent of the test subject or his or her legal guardian with the conduct of the testing. Article 33(3)(j) sets down requirements relating to the form and content of such informed consent in the following manner:
“informed consent means a decision of the test subject to take part in the clinical tests“, which
is made in writing,
is dated and signed,
is made freely after having obtained detailed information about the nature, significance, effects and risks of clinical testing,
is adequately documented,
is made by a person capable of making such a decision or, if the person in question is incapable of making it, by his or her legal guardian; if the aforementioned person cannot write, it is possible to accept oral consent given in the presence of at least one witness. The giving of the oral consent must be recorded in writing; the text of the informed consent must be clearly formulated and intelligible, made out in a language that the test subject understands well. Further details of the instructions and content of the informed consent are stipulated by the Decree in its Article 8.
In general it can be said that the existing legislation divides responsibility between the commissioning subject and the person carrying out the tests in such a way that the commissioning subject is responsible for the launch, directing and possibly also financing of the clinical tests (Article 33(3)(d) of the Drugs Act). This means that the commissioning subject is obliged to submit an application for authorisation of the clinical tests or report the launch of the tests to the National Institute for Drugs Control (Article 37(2) of the Drugs Act, Article 13(1) of the Decree). The commissioning subject must also appoint the person who will be carrying out the tests, taking into account his or her qualifications, the nature of the clinical tests and the equipment available at the medical establishment, in which the tests are to be conducted (Article 12(2) of the Decree), obtain insurance against potential damage or loss that might be incurred by the person carrying out the tests and by the commissioning subject, as well as insurance against potential health damage on the part of the test subjects, arising in consequence of the clinical tests (Article 34(3)(f) of the Drugs Act). Other duties of the commissioning subject include: the duty to inform the National Institute for Drugs Control about the launch of clinical tests (Article 37(7) of the Drugs Act), the duty to make detailed records of all negative occurrences reported to the commissioning subject by the person(s) carrying out the tests (Article 38b (4), (6) and (7) of the Drugs Act), the duty to obtain and provide further information (Article 38b (9) and (10) of the Drugs Act) and other duties (e.g. Article 38b (14) of the Drugs Act).
However, only some of these duties involve processing data about test subjects in a form which enables the commissioning subject to relate these data to a specific or identifiable data subject. If no problems occur in the course of the clinical tests, the commissioning subject need not even know the identity of the individual test subjects and need not possess any information that would classify as personal data within the meaning of Article 4(a) or as sensitive data within the meaning of Article 4(b) of the Personal Data Protection Act.
The person carrying out the tests is therefore always in the position of a data controller, as defined by the relevant provisions of the Personal Data Protection Act, while the commissioning subject takes on the responsibilities of a data controller only under exceptional circumstances defined by law. This is because, under Article 33(3)(f) of the Drugs Act, the person carrying out the tests, or possibly the leader of a team carrying out the tests, is responsible for the conduct of the clinical tests in the relevant testing facility. If the clinical tests are carried out by a team working all in a single facility, the leader of the team takes on this responsibility for the whole team. The aforementioned responsibility of the person carrying out the tests involves a number of concrete duties stipulated by legal regulations. These duties and tasks of the person carrying out the tests require him or her to acquire from the test subjects data about the state of their health, i.e. sensitive data within the meaning of Article 4(b) of the Personal Data Protection Act, and to process these data in a form which enables him or her to relate them to a specific or identifiable data subject. The aforementioned duties include e.g. obtaining “informed” consent of the test subject or his or her legal guardian, providing information to the test subject, obtaining positive opinion of the Ethics Commission, reporting about negative occurrences and effects, archiving documentation on the clinical tests and many other duties related to the conduct of clinical testing, which oblige the person carrying out the tests to process data about the state of health of the test subject. The existing legislation obliges the person carrying out the tests, i.e. the person who has all the duties listed above, to preserve documentation on the clinical tests in such a way as to ensure protection of the data relating to the test subject. The required protection here is the protection under a special legal regulation – the Personal Data Protection Act. Also, after the end of the clinical testing, the person carrying out the tests is obliged to ensure that the source documents are preserved in accordance with legal provisions regulating the archiving of medical documentation and in accordance with the corresponding special legal regulation. The identification codes of the test subjects must be preserved for a minimum period of 15 years (Article 9(8) of the Decree).
Mode No graphics is currently switched on. Therefore you see the web page with no decorative graphics as well as any advanced formatting. If your browser supports CSS2, you can switch a graphic mode on.