Europe’s highest court has struck down an international agreement allowing companies to move digital information such as people’s Web search histories and social media updates between the E.U. and the U.S.
The decision could have an impact on global clinical trials and on U.S. pharmaceutical companies that are expanding to use international sites for that patient population.

The Oct. 6 ruling by the European Court of Justice (ECJ) declared that the so-called Safe Harbor agreement, which was established by the European Commission in 2000, was flawed because it allowed U.S. government authorities to gain routine access to Europeans’ online information. The court noted that leaks from former National Security Agency contractor Edward Snowden made it evident that U.S. intelligence agencies had almost unrestricted access to the data, infringing on Europeans’ privacy rights.

The court also said data protection regulators in each of the E.U.’s 28 countries should have oversight over how companies gather and use online information of their nations’ citizens. The European countries have a wide variety of stances when it comes to the issue of privacy.

Among those weighing in about the potential impact on clinical trials are Linda Coleman, general counsel and director of regulatory affairs at Seattle-based Quorum Review IRB, and Phil Coran, regulatory affairs and quality senior director at New York City-based Medidata Solutions. In a joint statement, they said the court ruling’s effect could be considerable.

“The decision will impact companies that previously relied on the Safe Harbor arrangement as all transfers of data between the E.U. and U.S. that were permissible under the Safe Harbor arrangement are invalid effective [Oct. 6, 2015],” they told CWWeekly. “This includes over 530 Safe Harbor-certified biotechnology, drug and pharmaceuticals, and medical equipment entities. In addition, as many of these entities have extensively relied on external partners through outsourcing and delegation, the impact of the decision is compounded across multiple sectors that touch upon clinical research in one way or another.”

While the court’s ruling could have several negative ramifications, they wrote, there also could be a silver lining.

“Mitigating the effects of the Safe Harbor decision will be costly and burdensome to implement. As most trials are global in nature, it is difficult to imagine clinical data on E.U. subjects that is not submitted to multiple regulatory agencies, in addition to the data being analyzed by employees of multinational life science companies spanning both sides of the Atlantic.

“At its extreme, it may discourage non-E.U. sponsors from conducting trials in the E.U. or having E.U. subject data used for non-E.U. submissions. If not resolved, this would be bad for trial conduct and research generally.

“Even the alternative approaches can be problematic in practice. For example, the ‘standard contract clauses’ provide data subjects the right to delete their data. This possibility runs contrary to regulatory guidance (such as when study subjects withdraw consent—data collected to that point should remain in the clinical record).

“The impact of the ECJ ruling, however, does present some opportunities—for example, investigators gaining ‘explicit’ consent from subjects regarding clinical data moving across national borders, including to the U.S. This is consistent with ICH GCP Section 4.8, which states that confidentiality should be discussed with the subject, including the ability of regulators and agents of sponsors to have direct access to patients’ data.”

While all data transfers made per the Safe Harbor agreement are invalid effective Oct. 6, Coleman and Coran explained that the decision does not address data that was transferred prior to that date. That decision was made by the European data protection authorities making up the Article 29 Working Party.

Regarding the effect on American pharma companies, Coleman and Coran wrote, “Until the U.S. and E.U. can negotiate a possible new Safe Harbor arrangement, U.S. companies should consider alternative approaches (e.g., E.U. Model Clauses, Binding Corporate Rules, or ‘explicit’ or ‘freely given’ consent) so that data can be transferred.”

The data-transfer ruling does not apply solely to clinical trials, pharma and tech companies—it impacts any organization with international operations. While data protection advocates lauded the ruling, according to The New York Times, industry executives and trade groups believe the decision left tremendous uncertainty for larger companies, many of which rely on the easy data flow for profitable businesses such as online advertising. Those groups called on the European Commission to complete a new Safe Harbor agreement with the U.S.—a deal that has been in the works for more than two years and could limit the fallout from this month’s court decision.

More significantly, on Oct. 16, the Article 29 Working Party gave the commission and national governments three months to come up with an alternative to the Safe Harbor agreement. Negotiations between the E.U. and U.S. to reach a solution regarding the matter are ongoing.

Mark Barnes, a partner at Boston-based law firm Ropes & Gray whose expertise includes the medical industry, conceded that the ECJ’s ruling is “a very serious matter” but said data pertaining to consumers, banks and others will be affected a lot more than any information connected to clinical trials.

“I don’t think it lessens or increases the risk of harm to individuals involved in clinical research,” he said.

This article was reprinted from Volume 19, Issue 42, of CWWeekly, a leading clinical research industry newsletter providing expanded analysis on breaking news, study leads, trial results and more. Subscribe »