Despite their intention, requests to amend MCTs have increased significantly in recent years, due in part to the outdated data protection provisions contained in the models that have not fully taken into account the application of the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (DPA). The European Commission (EC) has published a question-and-answer paper on the interaction between the Clinical Trials Regulation (EU) 536/2014 (CTR) and the General Data Protection Regulation (EU) 2016/6792 (RGPD). The Q-A document will be relevant when the TCR is applicable, with the exception of question 11, which explains the current situation in accordance with the Clinical Trials Directive (DTC). The document shows that the two laws, RGPD and CTR, apply simultaneously. It reflects the state of affairs after the consultation of the European Data Protection Committee. With respect to data sharing in accordance with paragraph 6.3, we could have expected more in-depth provisions to fully reflect the recently updated ICO practice sharing code (for more information, check out our Hogan Lovells blog here). The revised MCTs replace the 2018 versions and introduce RGPD and DPA-compliant clauses for the processing and transfer of personal data between institutions, sponsors and clinical research organizations (CROs). The Association of the British Pharmaceutical Industry (ABPI), Health and Care Research Wales (HCRW), Health and Social Care Northern Ireland (HSC NI), the Health Research Authority (HRA), England) and NHS Research Scotland (NRS) have adopted 2020 versions of the Commercial Model Clinical Trial Agreement (mCTA) and the Clinical Research Organisation model Clinical Trial Agreement (CRO-mCTA), first published in 2003 and 2007 respectively. These model models have been designed to streamline the licensing process for commercial studies and should therefore be used without modification by proponents conducting clinical trials of patients with NHS/HSC in hospitals across the UK. As a first step, sponsors and ROC should focus on mapping data and reviewing contractual relationships and technologies to determine the changes needed to comply.
The beginning of this process in clinical development may contribute to the start of studies as well as possible. The MCTA has also been updated for industry-supported clinical research studies (CRO-mCTA), along with the accompanying guidelines for MCTA and CRO-mCTA. Both agreements have been amended to reflect changes to legislation and guidelines, including the General Data Protection Regulation (EU) 2016/679 and the ABPI guidelines for compensation for 2015 clinical trials. The MCTA is concluded by the sponsor and the institution (i.e. the organization of the participants), while the CRO-mCTA will be used if, in addition to these two parties, the sponsor enters into contracts with a CRO responsible for the aspects of field trial management. The role assigned to the parties continues to reflect the position of HRA and the business community, which considers the sponsor to be responsible for personal data and the organization of the participants and the CRO as a subcontractor acting on behalf of the sponsor for the purposes of the clinical trial (clauses 6.2.1 mCTA and CRO-mCTA). Under Article 27, a company that does not have a seat in the EU must retain a data protection delegate established in the EU. This representative ensures that the entity complies with its compliance obligations and, where appropriate, serves as a point of contact for data protection regulators. Updated versions of the UK Clinical Trial Agreement (mCTA) and the Clinical Research Organisation model Clinical Trial Agreement (CRO-mCTA) have been published. Given the growing importance of safe but rapid clinical trials in the coronavirus era, this contribution describes the key changes introduced from a data protection perspective and what they mean for contracting parties.