Oversight & Clinical Management

Privacy & data protection

The successful and sustainable adoption of DCTs hinges on robust data privacy and protection measures. Moving trial activities outside traditional research sites significantly increases the complexity of data flows and amplifies privacy and data protection challenges, such as participant personal data being shared to third party service providers. Unlike conventional trials, DCTs often involve multiple stakeholders across jurisdictions, complicating the delineation of roles and responsibilities in data processing. This poses challenges that need to be identified, evaluated, and addressed.

Recommendations

DCTs amplify existing privacy risks and introduce added complexity. There is a lack of standardisation, data flows are complex, and the distinction between sponsors/sites and controllers/processors can become muddled.

Participants must receive clear, accessible information about data flows and the involvement of various vendors. Participant information should be written in simplified language, adapted to the needs of a diverse participant base. Explaining new technologies used in DCTs may be particularly challenging and requires careful consideration to ensure comprehension.

In DCTs, data sharing across multiple remote parties and platforms increases the risk of inadequate data minimisation and pseudonymisation practices. Clearly assess which decentralised vendors and remote staff require access to identifiable participant data. Standard pseudonymisation techniques should be consistently applied, with reinforced protocols during deviations from normal procedures.

Data processing agreements with vendors and sub-processors handling data outside the EEA must include adequate protections. For transfers to the U.S., this includes using the EU Standard Contractual Clauses and applying additional safeguards, such as pseudonymisation.

How Trials@Home reached these recommendations

We executed a data protection impact assessment for RADIAL, which covered data processing in the three arms of the trial. Then, we established a working group to execute the DPIA, consisting of consortium members representing the study sponsor, the CRO, and the provider of the central platform. Besides execution of the DPIA, the working group focused on legal affairs and data protection within the RADIAL study, and data protection and privacy aspects of DCTs more generally. We based these recommendations off findings during the set-up and conduct of RADIAL.

Further reading

Publications

Which decentralised trial activities are reported in clinical trial protocols of drug trials initiated in 2019-2020? A cross-sectional study in ClinicalTrials.gov.

de Jong, et al
BMJ Open
2022
Read now
View poster version

The Ethics of Decentralized Clinical Trials and Informed Consent: Taking Technologies’ Soft Impacts into Account.

van Rijssel, et al
Health Care Analysis
2024
Read now

The Digital Platform and its Emerging Role in Decentralized Clinical Trials.

Copland, et al
Journal of Medical Internet Research
2024
Read now