European Union General Data Protection Regulation

The GDPR applies to organizations located within the EU and organizations outside of the EU if they offer goods or services to, or monitor the behavior of, EU data subjects and applies to all companies processing and holding the personal data of data subjects residing in the EU, regardless of the company’s location and whether the person is a citizen. The GDPR is therefore a significant change because the territorial scope of the regulation is more expansive than Directive 95/46/EC.

Example 1: Sponsor in the EU/EEA

• If the sponsor is based in the EU/EEA then the GDPR applies to the data processing activities, even if the processing itself is not performed within the EU/EEA and even if there are no data subjects within the EU/EEA.

Example 2: Sponsor not in the EU/EEA

• If an organization has offices in the EU/EEA involved in some aspects of the clinical trial (e.g. a central data management organization and/or system managed from a EU/EEA-based establishment), then the sponsor may be considered as established in the EU/EEA and the GDPR may apply.
• If the clinical trial data is intended to support a market authorization filing in the EU/EEA, then there is a data processing activity taking place in Europe for the purpose of the data submission. The GDPR may therefore apply.
• If a full service CRO established in the EU/EEA, is being delegated the definition of the purpose of the clinical trial, and, as such, qualifies as a joint-controller, then the GDPR would apply even if the sponsor is not located in the EU/EEA.

Example 3: Data Subjects in the EU/EEA

• If the clinical trial includes data subjects within the EU/EEA, then the GDPR applies in its entirety. This applies irrespective of where the sponsor and CROs/vendors are located, where the data processing is performed or where the data submission is planned.
• If a sponsor not based in the EU/EEA is processing data from data subjects within the EU/EEA then they must nominate in writing a representative within the EU/EEA who fulfills their responsibilities with regards to GDPR. Note that this applies even if the data subjects are not EU/EEA citizens, if their information is collected while they are within the EU/EEA.

Example 4: Person Living or Traveling in the EU/EEA

• A person in the EU/EEA (even if not a citizen) is subject to the GDPR.

Example 5: Application to U.S. Organizations

• The GDPR applies to U.S. Organizations if under the circumstances below, and will apply in a broader range of circumstances than prior to the repeal of the Directive: (1) Established in the EU/EEA (e.g. branch or office) and acts as a data controller or data processor; (2) Offers goods or services to individuals in the EU/EEA; and (3) Monitors the behavior of individuals in the EU/EEA.

Example 6: Lead site for research activities taking place at EU/EEA sites

• A prime recipient of an NIH grant which flows through sub-awards to EU/EEA sites.

Example 7: Studies involving the use of technology in research that target enrollment in the EU/EEA

Example 8: Conducting clinical trials for organizations located in the EU/EEA with personal data being sent to and/or processed in the EU/EEA

Example 9: Research arrangements involving European governmental grants or contracts.

• Institutions may be direct awardees or sub-recipients from EU/EEA institutions of European governmental grants or contracts to perform research services.
• Terms of grant may require compliance with GDPR.
• Personal data flows to and from EU/EEA may require compliance with the GDPR if offering goods or services to data subjects.

Example 10: Use of an investigational product in a clinical trial. (This is an example of offering a good or service.) Using an app to monitor the behavior of research participants. (This is an example of monitoring the behavior.)

a. What is the definition of Personal Data?
The definition of Personal Data related to a Data Subject is essentially unchanged under GDPR. “Personal Data” means any information relating to an identified or identifiable natural person (“data subject”). A “data subject” is an identifiable person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b. What is the definition of Sensitive Personal Data?
“Sensitive Personal Data” are special categories of personal data that are subject to additional protections. Under the GDPR, “Sensitive Personal Data” is defined as “personal data” revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership; and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

c. What is the Definition of Data Concerning Health
“Data Concerning Health” is defined as personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

d. What is the Definition of Pseudonymous Data and how is that different from Anonymous Data?
How is Data Subject to GDPR different than Data Subject to HIPAA?

“Pseudonymous Data” refers to personal data that can be amended in such a way that no individuals can be identified from the data without a key that allows the data to be re-identified. A Coded data set is an example of pseudonymous data. The GDPR encourages organizations to consider pseudonymization as a security measure when appropriate.

“Anonymous Data” refers to data sets that can be amended in such a way that no individuals can be identified from the data (whether directly or indirectly) by any means or by any person. Data that is fully anonymized is outside the scope of the GDPR.

Personal Data under the GDPR is broader than what is covered under HIPAA as the GDPR applies to all sectors of the economy, not just healthcare.

e. What is a definition of a Data Controller?
A “Data Controller” is … “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In clinical research, the Sponsor is always a controller”. Other types of organizations may qualify as joint controllers such as a Contract Research Organization, Investigator, or joint collaborator on a research project.

f. What is the definition of a Data Processor?
A “Data Processor” is “… a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller”. In clinical research, this corresponds to anyone appointed by the Sponsor to work with the clinical trial, including CROs (project management, monitoring, data management, statistics, medical coding, medical writing, etc.) and Vendors (eCRF/EDC and central labs, etc.).

g. What is the definition of Processing?
“Processing” is defined as “…any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”. An example is any operation that affects the data from a clinical trial during its entire life-cycle, from its collection by the sites as source data to its reporting, archival and destruction.

Under the GDPR, the processing of personal data must have a lawful basis. The lawful bases most likely to be relevant to a U.S. university are:

• Data subject consent to the processing.
• Processing necessary for the performance of a contract to which the data subject is a party.
• Processing necessary to protect vital interests of the data subject or a natural person.
• Processing necessary for the legitimate interests of the controller or a third party, except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject.

For a complete list, see GDPR, Article 6, Lawfullness of processing.

The GDPR requires a legal basis to transfer personal data from the EU/EEA to a country outside of the region such as the United States. A legal basis to transfer personal data from the EU/EEA includes, but is not limited to, the following:

• Obtaining the explicit consent of the data subject to the transfer of the personal data to the United States for processing.
• Entering into model contract clauses approved by the European Commission between the EU/EEA entity transferring personal data from the EU/EEA to the US and the US organization (such as a university or sponsor) receiving the data.
• Data transfers necessary to protect the vital interest of the data subject.

Example: A research collaborator established in the EU/EEA transfers files of pseudonymised (coded) data to a US organization for research purposes. In this case, the organization needs a legal basis to transfer the personal data to the US and a legal basis to process the data in the US.

Under the GDPR, consent means “any freely given, specific, information and unambiguous indication of the data subject’s wishes by which he or she, by a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” Depending on the nature of the processing, there also may be additional requirements. For example, when processing the personal data of children, the consent of the holder of parental responsibility may be required depending on the age and the type of processing.

The HRPP currently includes questions in its IRB submission platform (IRES-IRB) and application that collects information regarding data use. See below for an example of the questions asked.

• What type of data will you collect, share, and/or store for this study?
• Where will the study be conducted?
  • Yale University
  • Yale New Haven Health System
  • Other organization(s) outside of Yale University and Yale New Haven Health System

  If YNHH or Other Organizations options are chosen, a new field will appear to indicate the name of the organization.

• Will the study be conducted in the United States and/or another country?
  • In the United State
  • Outside of the United States
  • Both inside and outside the United States

  Additional fields will open to indicate state and/or country.

• Will you send data related to this study FROM the United States TO another country?
  • Yes
  • No

  If YES, a field will open to indicate country.

• Will you send data related to this study TO the United States FROM another country?
  • Yes
  • No

  If YES, a field will open to indicate country.

Yes, there are penalties for noncompliance. “Under the GDPR, organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). This is the maximum fine that can be imposed and in many cases, the fine may be lower; however, there is no doubt that noncompliance could have serious consequences.

If you have questions regarding GDPR compliance, please contact:

Office of General Counsel
Attention: Alyssa Greenwald; Carolyn Marks
iocc@yale.edu

Human Research Protection Program
Attention: Monika Lau; Linda Coleman
HRPP@yale.edu