Role of sponsor, principal investigator and others

The Privacy Act does not contain the concept of controller and processor, to the extent the Sponsor is an APP entity with an Australian link (as described more fully in our answer to Question 3) collecting or handling personal information, the Sponsor will be bound by the Privacy Act and the APPs.

The Privacy Act does not contain the concept of controller and processor, to the extent the Principal Investigator is an APP entity with an Australian link (as described more fully in our answer to Question 3) collecting or handling personal information, the Sponsor will be bound by the Privacy Act and the APPs.

The Privacy Act does not contain the concept of controller and processor, to the extent the CTS is an APP entity with an Australian link (as described more fully in our answer to Question 3) collecting or handling personal information, the Sponsor will be bound by the Privacy Act and the APPs.

The Privacy Act does not contain the concept of controller and processor, to the extent the Moniotor is an APP entity with an Australian link (as described more fully in our answer to Question 3) collecting or handling personal information, the Sponsor will be bound by the Privacy Act and the APPs.

Sponsor

(Joint) Controller

Principal Investigator

No own role (employee of the Clinical Trial Site)

Clinical Trial Site

(Joint) Controller

Monitor

Depends on the specific circumstances and the tasks of the Monitor. Usually, the Monitor is a processor of the Sponsor since it acts on behalf and under the instructions of the Sponsor.

CRO

Depends on the specific circumstances and the tasks of the CRO. Usually, the CRO is a processor of the Sponsor since it acts on behalf and under the instructions of the Sponsor.

(Joint) controller; Any joint controllership would be in relation to the principal investigator where the sponsor would (jointly with the principal investigator) determine the essential means and purposes of the clinical trials.

(Joint) controller or processor depending on the degree of involvement in the decision and design process of the clinical trial.

Any joint controllership would be in relation to the sponsor (as per above).

If the principal investigator just accepts the protocol drafted by the sponsor, the investigator can be considered as a processor.

Data controller of the participants’ personal data for the purposes of providing adequate healthcare assistance which is independent/must be distinguished from the processing of this data for research purposes.

Sponsor’s data processor, in charge of supervising the correct development of the research.

Typically acts as a processor because of the intermediary function between a number of investigators (trial centers) and the sponsor in the clinical trial.

However, to the extent the CRO becomes more involved in the decision and design process of the trial, it may also be considered a joint controller.

Data controller of the key-coded data of participants.

Data controller of the participants personal data in connection with the data processing activity that arise because of performing the investigation activities.

Data controller of the participants personal data for the purpose of providing adequate healthcare assistance within the scope of the investigation.

Sponsor’s data processor, in charge of supervising the correct development of the investigation.

Data controller.

Data controller (jointly with the sponsor) but may only be a data processor depending on the structure of the clinical trial.

Sponsor's data processor, in charge of providing adequate healthcare assistance within the scope of the clinical trial.

Data processor engaged by the sponsor to supervise the correct development of the clinical trial.

Data controller of the key-coded data of participants.

Data controller of participants' personal data in connection with data processing activities, for the purpose of carrying out research activities.

Data Controller of participants' personal data for the purposes of providing healthcare within the scope of investigation.

Sponsor’s data processor, in charge of supervising the correct development of the investigation.

Data controller.

Data controller.

Data controller.

Presumably a data controller for personal information about research staff – does usually not process data of participants in the study.

Data controller / joint controller

Data controller / joint controller / processor

Data controller / joint controller / processor

Processor

The MR-001 and MR-003 state that the sponsor is the data controller.

Processor for the purposes of performing the protocol defined by the Sponsor or joint controller if the Principal Investigator launches the clinical trial with the Sponsor.

The MR-001 and MR-003 do not specify whether Principal Investigators should be considered as data controllers or data processors. 

In the absence of specific guidance in France, the  EDPB guidance (guidelines 07/2020 on the concepts of controller and processor in the GDPR) is followed: i.e., if the investigator does not participate to the drafting of the protocol (he just accepts the protocol already elaborated by the sponsor), and the protocol is only designed by the sponsor, the investigator should be considered as a processor and the sponsor as the controller for this clinical trial.  This is to be distinguished from the investigator’s processing of patient data outside of the context of the clinical trial / performance of the protocol, where the investigator will be acting as a controller.

The MR-001 and MR-003 state that the clinical site is a data processor.

Not clearly mentioned in the MR-001 and MR-003 but should act as data processor since they are in charge of supervising the correct development of the investigation on behalf of the sponsor.

(Joint) Controller

Employee of the Clinical Trial Site – no own role from a data protection perspective

(Joint) Controller

Depends on the specific circumstances and the tasks of the Monitor in regard to the data processing. Usually the Monitor is acting on behalf and under the instructions of the sponsor and is therefore to be considered as processor of the sponsor.

Pursuant to the aforementioned document, investigator shall act as data processor.

In practice, in most clinical trial agreements principal investigator is considered as data controller of the clinical trial participants’ personal data in connection with the data processing operations performed in conducting the investigation activities set forth in the Protocol.

Pursuant to the aforementioned document, clinical trial site shall act as data processor, acting on behalf of the sponsor.

In practice, in most clinical trial agreements the clinical trial site is qualified as data controller of clinical trial participants’ personal data for the purposes of providing adequate healthcare assistance within the scope of the investigation.

Το the extent such party would be in charge of supervising the correct development of the investigation on behalf of the sponsor, said party shall qualify as data processor.

Normally, this role is assumed by the CRO.

Pursuant to the aforementioned document, CRO shall be the data controller.

However, in practice most clinical trial agreements are formulated as tri-party agreements between sponsor or CRO, principal investigator and clinical trial site. Therefore, either sponsor or CRO are appointed as data controllers.

Sponsor’s data processor

(However, in accordance with Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR, the PI may qualify as a joint controller with the sponsor if they collaborate together to the drafting of the study protocol (i.e. purpose, methodology/design of the study, data to be collected, subject exclusion/inclusion criteria, database reuse (where relevant) etc.) as they jointly determine and agree on the same purpose and the essential means of the processing. (see example 4 after paragraph 66))

Joint controller with the sponsor, or sponsor’s data processor, for the same reasons specified above with respect to the PI.

Sponsor’s data processor, in charge of supervising the correct development of the investigation. 

‘Sponsor’ is the term used for the responsible legal entity for regulated clinical trials means an individual, company, institution or organisation which takes responsibility for the initiation, for the management and for setting up the financing of the clinical trial.¹

All clinical trial information shall be recorded, processed, handled, and stored by the sponsor or investigator, as applicable, in such a way that it can be accurately reported, interpreted and verified while the confidentiality of records and the personal data of the subjects remain protected in accordance with the applicable law on personal data protection. Appropriate technical and organisational measures shall be implemented to protect information and personal data processed against unauthorised or unlawful access, disclosure, dissemination, alteration, or destruction or accidental loss, in particular where the processing involves the transmission over a network.²

A statement by the sponsor or his or her representative that data will be collected and processed in accordance with Directive 95/46/EEC (which has been repealed by the GDPR) shall be provided.³

In light of the responsibilities of the Sponsor, it is likely that the Sponsor will be controller of personal data of participants in health research / clinical trials. This is also confirmed by the Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR, where it is stressed that the PI / Trial Site may be qualified as a joint controller with the Sponsor if they collaborate together to the drafting of the study protocol (i.e. purpose, methodology/design of the study, data to be collected, subject exclusion/inclusion criteria, database reuse (where relevant) etc.), as they jointly determine and agree on the same purpose and the essential means of the processing (see example 4 after paragraph 66).

Principal Investigator

‘Principal investigator’ means an investigator who is the responsible leader of a team of investigators who conduct a clinical trial at a clinical trial site;⁴ and is responsible for the day-to-day management of the research study at the research site. The Principal Investigator retains ultimate responsibility for the management of the research study, even if tasks are delegated to other research staff. A principal investigator shall ensure compliance of a clinical trial at a clinical trial site with the requirements of the Regulation. The principal investigator shall assign tasks among the members of the team of investigators in a way which is not compromising the safety of subjects and the reliability and robustness of the data generated in the clinical trial at that clinical trial site.⁵

In light of the responsibilities of the Principal Investigator, it is likely that they can be controllers of personal data of participants in health research / clinical trials, whether they are individuals or organisations.

In Ireland this is commonly referred to as the Research Site or Host Site and is a facility, location or service (e.g. hospital) where the research is being conducted. This includes:

• the organisation or organisations where the research is taking place; and/or,  
• the organisation whose service users, patients or staff are involved in the research; and/or 
• the organisation that provides research staff, primary data, infrastructure or premises to facilitate the research.

Given the involvement of the Research Site, it is likely to be a controller of the participants personal data for the purposes of providing adequate healthcare assistance within the scope of the investigation. This is also confirmed by the Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR, where it is stressed that the PI / Trial Site may be qualified as a joint controller with the Sponsor if they collaborate together to the drafting of the study protocol (i.e. purpose, methodology/design of the study, data to be collected, subject exclusion/inclusion criteria, database reuse (where relevant) etc.), as they jointly determine and agree on the same purpose and the essential means of the processing (see example 4 after paragraph 66).

The HPRA Guidance does not provide for a “monitor” per se but does provide that a sponsor is required to carry out monitoring procedures. These include plans for on-site monitoring, central monitoring and data committee monitoring.

The sponsor must be able to demonstrate that it has oversight of trial conduct and GCP compliance and has mechanisms in place to continuously monitor the benefit-risk balance.

The HPRA, in their review of adequate Clinical Trial protocols, may request documents including risk assessment, monitoring plans, follow-up letters, GCP non-compliance escalations, data committee charters and meeting minutes.⁶

The services that CROs provide include:

• Preclinical research activities
• Clinical research monitoring
• Protocol design
• Clinical trial management
• Preparation and submission of regulatory materials to the relevant regulatory agency
• Completing post approval regulatory obligations and reports.

The CRO mainly acts as the Sponsor’s data processor when (i) performing monitoring tasks, and (ii) in the event that the Sponsor subcontracts other tasks to the CRO that involve access by the CRO to encrypted participant data.

Data controller.

In particular, according to the DPA’s Guidelines the Sponsor may act as controller or joint controller, together with the Clinical Trial Site. This is also confirmed by the Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR, where it is stressed that the PI / Trial Site may be qualified as a joint controller with the Sponsor if they collaborate together to the drafting of the study protocol (i.e. purpose, methodology/design of the study, data to be collected, subject exclusion/inclusion criteria, database reuse (where relevant) etc.), as they jointly determine and agree on the same purpose and the essential means of the processing (see example 4 after paragraph 66).As a consequence, a case-by-case analysis is necessary.

That said, the default position provided for in the Template Agreement issued by the AIFA is that Sponsor is qualified as independent controller.

In most cases (i.e., where the PI is an employee of the Clinical Trial Site) the PI will be treated as an agent of the Clinical Trial Site, pursuant to Art. 29 of the GDPR.

Where this is not the case, then the PI will either the Sponsor’s data processor or, where the PI needs to process personal data to provide medical care outside of the context of the trial protocol, they will be an independent controller.

That said, the default position provided for in the Template Agreement issued by the AIFA qualifies the Principal Investigator as person in charge of the processing of participants’ data, pursuant to Art. 29 of the GDPR.  

According to the Italian DPA’s Guidelines, Clinical Trial Site is qualified as controller or joint controller, together with the Sponsor, of participants’ data, for the purposes of providing adequate healthcare assistance within the scope of the investigation.

However, the Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR stress that the Clinical Trial Site may be qualified either as a joint controller with the Sponsor or processor acting on behalf of Sponsor, depending on factual circumstances.

As a consequence, a case-by-case analysis is necessary.

According to the Italian DPA’s Guidelines, processor acting on Sponsor’s behalf, in charge of supervising the correct development of the investigation. 

Data controller, as it defines the selection criteria of the participants in the trial and the overall purpose of the processing.

This is also confirmed by the Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR, where it is stressed that the PI / Trial Site may be qualified as a joint controller with the Sponsor if they collaborate together to the drafting of the study protocol (i.e. purpose, methodology/design of the study, data to be collected, subject exclusion/inclusion criteria, database reuse (where relevant) etc.), as they jointly determine and agree on the same purpose and the essential means of the processing (see example 4 after paragraph 66).

He/she could be considered data controller, as they will determine the purposes of the processing of the data for the immediate actions related to the clinical trial (participant assistance and development of the investigation).

It should be noted that in most cases (i.e., where the PI is an employee of the Clinical Trial Site) the PI will be treated as an agent of the Clinical Trial Site, pursuant to Article 29 of the GDPR.

Depending on the circumstances, he/she might also be considered as data processor for the Clinical Trial Site, where he/she only processes data on behalf and upon instructions of the Clinical Trial Site (and he/she is not an employee thereof), but this has to be assessed on a case-by-case basis

Data controller for the same reasons as the principal investigator.

This is also confirmed by the Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR, where it is stressed that the PI / Trial Site may be qualified as a joint controller with the Sponsor if they collaborate together to the drafting of the study protocol (i.e. purpose, methodology/design of the study, data to be collected, subject exclusion/inclusion criteria, database reuse (where relevant) etc.), as they jointly determine and agree on the same purpose and the essential means of the processing (see example 4 after paragraph 66).

Usually, they will be considered data processor as they process the data on behalf of the Sponsor.

Data controller*.

Data controller, with respect to processing activities which represent Principal Investigator’s responsibilities in the specific clinical trial*.

Data controller, with respect to processing activities which represent Clinical Trial Site’s responsibilities in the specific clinical trial*.

Data processor on behalf of the Sponsor, with respect to processing activities which represent Monitors’ responsibilities in the specific clinical trial*.

Data processor on behalf of the Sponsor, with respect to processing activities which represent CRO’s responsibilities in the specific clinical trial*.

Data controller.

Data controller.

Data controller.

Data processor.

According to the Clinical trials Regulation the sponsor has a legal obligation (the responsibility) to make sure the trial is performed in accordance with the regulation and that the data involved is processed in accordance with relevant regulation. (GDPR and national legislation). By definition this would make the Sponsor the controller of the data processed in the trial. If the sponsor isn't involved in any data-processing it would be necessary to discuss if in fact the role as a controller should be shared with the P.I. or if it is the P.I who is the controller alone.   

Normally the P.I would be the controller in a medical trial or any research-project if he/she is not an employee of the Clinical Trial Site.

The Data controller of the participants personal data for the purposes of providing adequate healthcare assistance within the scope of the investigation.

Sponsor's data processor, in charge of supervising the correct development of the investigation. 

Data controller of the key-coded data of participants, as it determines the purposes and means of the processing of personal data during the clinical trial.

For the purpose of patient care within the clinical trial and performance of its own legal obligations or interests in this regard, Principal Investigator is a data controller.

Depending on the role in drafting of the research protocol and trial agreement, where the PI is not an employee of the trial site it might also be considered either a joint controller along with the Sponsor or a data processor on behalf of the Sponsor.

Data controller of the participants’ personal data for the purposes of providing adequate healthcare assistance within the scope of the investigation and data processor subject to the Sponsor within the investigation itself.

Sponsor’s data processor, in charge of supervising the correct development of the investigation.

Sponsor’s data processor when (i) performing monitoring tasks, and (ii) in the event that the Sponsor subcontracts other tasks to the CRO that involve access by the CRO to encrypted participant data.

Where the PI is not an employee of the trial site it is generally considered a processor. However, the qualification as (joint) data controller or processor should be assessed in a case-by-case basis depending on the level of participation on the clinical trial.

Data controller of the participants personal data for the purposes of providing adequate healthcare assistance within the scope of the investigation.

Sponsor’s data processor, in charge of supervising the correct development of the investigation.

(When contracted separately from the site) Data controller of the personal data of the clinical trials participants. 

Data controller of the personal data of the clinical trials participants during the provision of healthcare assistance within the clinical trials.

If they are a separate legal entity, the monitor company is the Sponsor’s data processor.

Sponsor's data processor.

Data controller*.

Data controller, with respect to processing activities which represent Principal Investigator’s responsibilities in the specific clinical trial*.

Data controller, with respect to processing activities which represent Clinical Trial Site’s responsibilities in the specific clinical trial*.

Data processor on behalf of the Sponsor, with respect to processing activities which represent Monitors’ responsibilities in the specific clinical trial*.

Data processor on behalf of the Sponsor, with respect to processing activities which represent CRO’s responsibilities in the specific clinical trial*.

Data controller of the participants personal data for the purposes of providing adequate healthcare assistance within the scope of the investigation.

However, in accordance with Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR, the PI / Trial Site may qualify as a joint controller with the sponsor if they collaborate together to the drafting of the study protocol (i.e. purpose, methodology/design of the study, data to be collected, subject exclusion/inclusion criteria, database reuse (where relevant) etc.) as they jointly determine and agree on the same purpose and the essential means of the processing. (see example 4 after paragraph 66).

As a consequence, a case-by-case analysis is necessary.

Data controller for the processing of key coded (pseudonymized) personal data needed to fulfill the Sponsor's processing purposes and responsibilities set forth in the Protocol and by applicable law.

Joint-controller together with Clinical Trial Site for conducting the study, at least where the Protocol has been jointly decided.

Where the PI is an employee of the trial site, it will be considered:

• Data controller for the data processing activity that arises because of the performance of the investigation activities set forth in the Protocol.
• Joint-controller with Sponsor for conducting the study if the Principal Investigator together with the Sponsor decides the purpose and the means for the trial.¹

Data controller for the processing of the participants' personal data for the purposes of providing adequate healthcare assistance within the scope of the investigation.

Sponsor’s data processor, in charge of supervising the correct development of the investigation.

Sponsor’s data processor when (i) performing monitoring tasks, and (ii) in the event that the Sponsor subcontracts other tasks to the CRO that involve processing of personal data on behalf of the Sponsor, e.g. access by the CRO to encrypted participant data.

In most cases (i.e., where the PI is an employee of the trial site) the PI will be treated as an agent of the Clinical Trial Site and not a controller / processor in its own right.

Where this is not the case, then the PI will be the Sponsor’s data processor (see comments below in relation to clinical trial site).

However, where the PI needs to process personal data to provide medical care outside of the context of the trial protocol, they will be an independent controller.

Sponsor’s data processor. This is the default position provided for in the HRA’s Model Clinical Trial Agreement.

However, in accordance with Guidelines 07/2020 of the European Data Protection Board on the concepts of controller and processor in the GDPR (which remain highly influential in the UK post-Brexit), the PI / Trial Site may qualify as a joint controller with the sponsor if they collaborate together to the drafting of the study protocol (i.e. purpose, methodology/design of the study, data to be collected, subject exclusion/inclusion criteria, database reuse (where relevant) etc.) as they jointly determine and agree on the same purpose and the essential means of the processing. (see example 4 after paragraph 66)

Sponsor’s data processor, in charge of supervising the correct development of the investigation.

Sponsor’s data processor when (i) performing monitoring tasks, and (ii) in the event that the Sponsor subcontracts other tasks to the CRO that involve access by the CRO to encrypted participant data.