Clause 6: Data Protection Sample Clauses

Clause 6: Data Protection. The mCTAs include general provisions related to compliance with the relevant data protection laws and guidance. It is noted that in addition to compliance with legislation, Sponsors (and CROs) are also required to comply with NHS-specific data protection guidance. Oversight of this compliance is provided through the clinical trials approval process which includes a review of the mechanisms for protecting personal data. Clause 6.2 constitutes a GDPR Article 28(3)-compliant data processing agreement between Sponsor, as controller of Personal Data processed for the purpose of the clinical trial, and the Participating Organisation, as processor of the Sponsor for this purpose. Clause 6.2.6 should set out the position of the Sponsor on the use of Participant Identification Centres (PICs) in the clinical trial and, where their use is permitted, whether the Participating Organisation may engage PICs under the general written authorisation of the agreement or only with specific written authorisation from, or on behalf of, the Sponsor. Clause 6.3 provides for the sharing of Personal Data and or the pseudonymised data of data subjects and provides the Participating Organisation with assurances as to safeguards enacted by, and/or on behalf of, the Sponsor to protect this data and handle it in an appropriate manner.

Clause 6: Data Protection. The mCTAs include general provisions related to compliance with the relevant data protection laws and guidance. The definition of the term “Data Protection Laws and Guidance” includes “legally enforceable NHS requirements, Codes of Practice or Guidance issued by the Information Commissioner’s Office, in each case in force from time to time in England, Northern Ireland, Scotland and/or Wales”. Oversight of this compliance is provided through the clinical trials approval process, which includes a review of the mechanisms for protecting personal data. Clause 6 is explicitly concerned with Personal Data as defined in the agreement, that is, only personal data of Clinical Trial Subjects, or potential Clinical Trial Subjects. The Personal Data of the Principal Investigator or Personnel are not dealt with in the template and requests to modify the template to change this will not be accepted. Sponsors are encouraged to fulfil their transparency obligations for processing the personal data of the PI and Personnel via their signature and delegation log, as per the example provided in IRAS. Clause 6.2, when taken together with the clinical trial protocol, constitutes a GDPR Article 28(3) compliant data processing agreement between Sponsor, as controller of Personal Data processed for the purpose of the clinical trial, and the Participating Organisation, as processor of the Sponsor for this purpose. (a) explicitly references GDPR Article 28(1) and gives “obligations as an NHS organisation” as the guarantee that the sponsor should take in accordance with 28(1). NHS organisations are held to high standards of data protection in each of the four UK nations. Sponsors should therefore take assurance that the measures taken by the NHS are appropriate when relying upon existing NHS processes, systems, etc. for the processing of personal data (as opposed to when study specific provisions are required by the sponsor, such as Electronic Case Report Forms (eCRF), where the requirements of the sponsor should be clearly set out in, for example, the protocol, eCRF manual or other relevant document).

Clause 6: Data Protection. The mCTA includes general provisions related to compliance with the relevant data protection laws. It is noted that in addition to compliance with legislation, Sponsors (and CROs) are also required to comply with NHS specific data protection guidance. Oversight of this compliance is provided through the clinical trials approval process which includes a review of the mechanisms for protecting personal data. It is noted that in order for personal data to be collected and processed, the legal basis for such collection must be established. With respect to the personal data of the Principal Investigator and any Sub-Investigators, the collection and processing of personal data is often based on the consent of each individual. The mCTA determines a clear principle that it is the responsibility of the Sponsor (or CRO, as applicable) to collect the consent of the Principal Investigator and all Sub-Investigators participating in the Clinical Trial. Sponsors (and CROs) are strongly encouraged to use the Clinical Trial delegation log to collect consent from the Principal Investigator and Sub- Investigators for the processing of their personal data. General guidance with respect to the consent process is set out in the Schedule to this Guidance. While acknowledging the responsibility of the Sponsor (or CRO) to obtain consent from the Principal Investigator and all Sub-Investigators, both the Sponsor (and CRO, where applicable) and the representatives of the Participating Organisation are encouraged to take a practical approach and to provide mutual assistance to facilitate the consent process. A failure to obtain consent in a timely manner can result in delays to the start of a Clinical Trial. A Sponsor or CRO request to assist in obtaining a signed form from someone who is on annual leave would be reasonable. Requesting that the representatives of the Participating Organisation take responsibility for collating all signatures would not be reasonable, as this is burdensome and takes NHS staff away from their day to day duties.