BackgroundThe COVID-19 pandemic brought global disruption to health, society and economy, including to the conduct of clinical research. In the European Union (EU), the legal and ethical framework for research is complex and divergent. Many challenges exist in relation to the interplay of the various applicable rules, particularly with respect to compliance with the General Data Protection Regulation (GDPR). This study aimed to gain insights into the experience of key clinical research stakeholders [investigators, ethics committees (ECs), and data protection officers (DPOs)/legal experts working with clinical research sponsors] across the EU and the UK on the main challenges related to data protection in clinical research before and during the pandemic.Materials and methodsThe study consisted of an online survey and follow-up semi-structured interviews. Data collection occurred between April and December 2021. Survey data was analyzed descriptively, and the interviews underwent a framework analysis.Results and conclusionIn total, 191 respondents filled in the survey, of whom fourteen participated in the follow-up interviews. Out of the targeted 28 countries (EU and UK), 25 were represented in the survey. The majority of stakeholders were based in Western Europe. This study empirically elucidated numerous key legal and ethical issues related to GDPR compliance in the context of (cross-border) clinical research. It showed that the lack of legal harmonization remains the biggest challenge in the field, and that it is present not only at the level of the interplay of key EU legislative acts and national implementation of the GDPR, but also when it comes to interpretation at local, regional and institutional levels. Moreover, the role of ECs in data protection was further explored and possible ways forward for its normative delineation were discussed. According to the participants, the pandemic did not bring additional legal challenges. Although practical challenges (for instance, mainly related to the provision of information to patients) were high due to the globally enacted crisis measures, the key problematic issues on (cross-border) health research, interpretations of the legal texts and compliance strategies remained largely the same.

Despite its promising future, the application of artificial intelligence (AI) and automated decision-making in healthcare services and medical research faces several legal and ethical hurdles. The European Union (EU) is tackling these issues with the existing legal framework and drafting new regulations, such as the proposed AI Act. The EU General Data Protection Regulation (GDPR) partly regulates AI systems, with rules on processing personal data and protecting data subjects against solely automated decision-making. In healthcare services, (automated) decisions are made more frequently and rapidly. However, medical research focuses on innovation and efficacy, with less direct decisions on individuals. Therefore, the GDPR’s restrictions on solely automated decision-making apply mainly to healthcare services, and the rights of patients and research participants may significantly differ. The proposed AI Act introduced a risk-based approach to AI systems based on the principles of ethical AI. We analysed the complex connection between the GDPR and AI Act, highlighting the main issues and finding ways to harmonise the principles of data protection and ethical AI. The proposed AI Act may complement the GDPR in healthcare services and medical research. Although several years may pass before the AI Act comes into force, many of its goals will be realised before that.

In the age of big data and AI, the ability to extract knowledge and value from personal data is promising, especially for researchers and policymakers. The new findings based on the vast amount of data have the potential to save lives and reduce expenses for the whole society. However, processing sensitive data for a new purpose poses complex ethical, legal and technical challenges. The EU General Data Protection Regulation (GDPR) accounts for this challenge by allowing researchers to process and further use personal data under the 'research exemption'. However, many aspects of this exemption would need further clarification: what level of public interest is necessary e.g., general, important or substantial, how the data should be de-identified and what kind of activities can fit in the definition of 'scientific research'. The issue is elaborated through the GDPR and its implementation in England and Germany, focusing on the secondary use of health data.

BackgroundRapid technological advancements are reshaping the conduct of clinical research. Electronic informed consent (eIC) is one of these novel advancements, allowing to interactively convey research-related information to participants and obtain their consent. The COVID-19 pandemic highlighted the importance of establishing a digital, long-distance relationship between research participants and researchers. However, the regulatory landscape in the European Union (EU) is diverse, posing a legal challenge to implement eIC in clinical research. Therefore, this study takes the necessary steps forward by providing an overview of the current regulatory framework in the EU, relevant to eIC.MethodsWe reviewed and analyzed the key EU regulations, such as the EU General Data Protection Regulation (GDPR) and the Clinical Trials Regulation (CTR). We investigated the legality of eIC in several EU Member States, Switzerland, and the United Kingdom. To this end, we contacted the medicines agencies of various countries to clarify the national requirements related to the implementation and use of eIC in clinical research. Our research was complemented by comparing the legal acceptance of eIC between the EU and the United States.ResultsIn the EU, a distinction must be made between eIC for participation in clinical research and eIC for processing the participants’ personal data, complying respectively with requirements laid down by the CTR and the GDPR. On a national level, countries were classified into three groups: (1) countries accepting and regulating the use of eIC, (2) countries accepting the use of eIC without explicitly regulating it, and (3) countries not accepting the use of eIC. As a result, the regulation of eIC through laws and guidelines shows a large variety among EU Member States, while in the United States, it is harmonized through the Code of Federal Regulations.ConclusionVarious requirements must be considered when implementing eIC in clinical research. Nevertheless, requirements across the EU Member States may differ significantly, whereas, in the United States, efforts have already been made to achieve a harmonized approach.