Hello everyone, this is Manon DURAND, health lawyer at Pharmaspecific. Today, we meet again to talk about the General Data Protection Regulation (the GDPR) which, I remind you, is the reference text in terms of personal data protection and which came into force in the European Union on May 25, 2018.
The question of the day is whether, when you have a pre-screening list, you can enter the patient’s initials into it before the patient has even signed their informed consent. So, to find the answer to this question, we have to look at the essence of the GDPR. When reading this text, we realize that the main subject of the text is the data subject. That is to say that we are really focused on the choice of the data subject as to what happens to his or her data, how it is processed and its security, obviously.
So, the patient’s initials are considered personal data. Therefore, you can’t do just anything with them. In this case, you can’t fill out the screening list with the patient’s initials until they have signed their informed consent, but why?
It is simple, in fact the processing of personal data must be based on what is called a legal basis. In fact, it’s a reason that would be legitimate. The legal bases are in Articles 6 and 9 of the GDPR. We have a list that is exhaustive, and, in this case, there are 2 legal bases that we can use: the consent of the data subject – so the patient – to the use of his personal data or the legitimate interests of the data controller.
If we were to base our treatment on the consent of the person concerned to the use of his or her personal data, this would mean that – since, as a rule, this consent is recorded in a single document with the informed consent – the patient would have to sign the consent to the use of his or her personal data first, and then, later, the informed consent, by a roundabout way. This is rare because in general, these two consents, even if they are not really the same thing, are in one and the same document. So, we can already discard the consent.
Secondly, the legitimate interests of the controller cannot be used either, since as long as the patient has not signed his informed consent, he is not part of the study. He is therefore not included in it since he can refuse to participate at any time. Therefore, the data controller cannot rely on his legitimate interests since he is not yet able to ensure that the patient will participate in the study.
In conclusion, it is not possible to use the initials of a participant in a clinical study in any way whatsoever before the participant has signed an informed consent.
I hope you enjoyed this video, if you do, do not hesitate to subscribe to the channel and to like this video. You will find in the information bar information on our various services; the monthly legal watch on one hand and the legal advice in clinical research on the other hand. As for us, we will soon meet again for a new video!