Hello everyone, this is Manon DURAND, health lawyer at Pharmaspecific. We meet again to talk about the General Data Protection Regulation (the GDPR), which is the reference text in terms of personal data protection, and which came into force in the European Union on May 25, 2018.

The topic of the day is the right to data portability and more specifically, the question of whether it is possible for a participant in a clinical study to retrieve his or her data from that study and transfer it, for example, to another sponsor.

The right to portability, therefore, allows a data subject to recover his electronic data (only electronic data) in an open and machine-readable format. Once this data is retrieved, he will be able to either store it or transfer it to another computerization system for reuse.

On the other hand, the right to portability only applies to data that are provided directly by the person concerned. That is to say, either the data that will be provided actively and consciously by this person – so if the patient gives you his name or address for example – or the data that will be generated by the activity of a person, this is the case, for example, of bank statements.

On the other hand, as soon as the data are derived, calculated or inferred from the data provided by the data subject, they are no longer subject to portability, precisely because they are not directly provided by the data subject but created by the organization.

Secondly, the right to portability only applies when the legal basis for the data processing derives either from the consent of the data subject or from the performance of a contract. That is, if the sponsor uses the legitimate interests of the controller as a legal basis for the processing, for example, the right to portability will not apply.

In conclusion, therefore, it is unlikely that the right to portability can be used in the context of a clinical study since, on the one hand, the data are not directly provided by the patient since they will undergo calculations, analyses… And also, because it is advisable, in clinical research, to use as a legal basis either the mission of public interest or the legitimate interests of the data controller.

I hope you will have enjoyed this video. If you do, don’t hesitate to subscribe to our channel, to like this video and you will find in the information bar the information concerning our monthly legal watch and the legal advice in clinical research. As for me, I’ll see you soon!{:}