The authors actually reached out to the DPAs and polled them for the following questions. (written below as they were sent to the DPAs):
- Does the GDPR apply to a clinical trial sponsor based outside of the EEA if it is conducting clinical studies in the EEA?
- Answers were mostly YES or “Factual Analysis”
- Is patient data processed under a clinical trial considered “personal data” even if it is pseudonymized?
- Received Answers were YES
- If a clinical trial is being conducted in your jurisdiction, would the sponsor and the principal investigator be considered joint controllers of the personal data of the trial participants (data subjects)?
- Various views
-
Alternatively:
- Is the sponsor the data controller while the principal investigator acts as a processor on behalf of the sponsor?
- Is the principal investigator an independent data controller together with the sponsor?