In Europe, the EU Charter of Fundamental Rights stipulates that EU citizens have the right to protection of their personal data. Additionally, EU and national legislation addresses patient data access, data linkage and consent issues, including duty of confidentiality. Therefore, while individual data custodians may have differing requirements related to what approvals are needed before their data can be released for a particular study, all studies conducted in Europe must meet all applicable legislation.
The General Data Protection Regulation (GDPR) Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on free movement of such data came into force on 24 May 2016. It repeals Directive 95/46/EC and is aimed at making data protection fit for the digital age.
Regulation (EC) No 45/2001 sets forth the rules applicable to the processing of personal data by EU institutions and bodies. On 10 January 2017, a proposal was put forward to amend those rules to bring them in line with the GDPR.
For interventional research, Directive 2001/20/EC and the Guidelines for Good Clinical Practice (Commission Directive 2005/28/EC) apply. Directive 2001/20 EC will be repealed when the Clinical Trials Regulation (Regulation (EU) No 536/2014) comes into application. It will also apply to trials authorised under the previous legislation if they are still ongoing three years after the Regulation has come into operation. In addition, marketing authorisation holders (MAHs) and investigators must follow relevant national guidance of those Member States where the study is being conducted.
Article 36 of the Commission Implementing Regulation (EU) No. 520/2012 specifies that for post-authorisation safety studies (PASS) imposed as an obligation, MAHs shall ensure that all study information is handled and stored in a way that ensure the confidentiality of the study records. The GVP Module VIII - Post-authorisation safety studies recommends that these provisions should also be applied to PASS that are voluntarily initiated, managed or financed by a MAH.
The ISPE Good pharmacoepidemiology practice provides recommendations on the protection of human subjects and refers to the ISPE guidelines on Data Privacy, Medical Record Confidentiality, and Research in the Interest of Public Health. It also recommends that the plans for protecting human subjects should be described in a stand-alone section of the study protocol.