Implications of CCPA and CPRA on Clinical Trial Data

Bryan Cave Leighton Paisner
Contact

Given the recent updates to CCPA, and the possible approval of California Privacy Rights Act (CPRA) which is on the November 3 ballot, it is increasingly likely that personal information collected in the course of clinical trials is not subject to the requirements of the CCPA or the CPRA with certain exceptions.

As originally drafted, the Section 1748.145(c)(1)(C) of the CCPA stated that “[personal] information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, pursuant to good clinical practice guidelines issued by the International Council for Harmonisation or pursuant to human subject protection requirements of the United States Food and Drug Administration” would not be subject to the CCPA. This original clinical trial carve out was ambiguous because it did not define “clinical trials,” leaving the scope of the exemption in question.

On September 25, 2020, Governor Newsom of California approved AB 713, which amends this portion of the CCPA. The amendment clarifies the scope of the clinical trial exemption, and expands the exemption. Specifically, the amendment exempts personal information from the requirements of the CCPA to the extent that personal information is “is collected, used, or disclosed in research, as defined in Section 164.501 of Title 45 of the Code of Federal Regulations, including, but not limited to, a clinical trial, and that is conducted in accordance with applicable ethics, confidentiality, privacy, and security rules of Part 164 of Title 45 of the Code of Federal Regulations, the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the United States Food and Drug Administration.”

Notably, the exemption applies to personal information collected as a part of “research” conducted in accordance with Section 164.501, which is broadly defined to mean “a systemic investigation, including research development, testing, evaluation, designed to develop or contribute to generalizable knowledge.” The definition goes on to specifically name clinical trials and other research conducted in accordance with the Common Rule as a part of the definition of “research.”  Most commentators agree that this amendment has resolved the principle ambiguity regarding the scope of the exemption.

In addition to the CCPA, the CPRA is presently on the November 2020 ballot in California. The CPRA generally maintains the various exemptions related to personal information that is already governed by other regulatory regimes (e.g., GLBA and HIPAA), but does make some modifications. Under Section 1798.145(c)(1)(C) the CPRA, personal information “collected as part of a clinical trial or other biomedical research study subject to or conducted in accordance with the Federal Policy for the Protection of Human Subjects, also known at the Common Rule, pursuant to good clinical practice guidelines issued by the International Council for Harmonisation or pursuant to human subject protection requirements of the United States Food and Drug Administration, provided that such information is not sold or shared in a manner no permitted by this subparagraph, and if it is inconsistent, that participants be informed of such use and provide consent.” (emphasis added).

As shown by the bolded language, the exemption under the CPRA expands to include “other biomedical research studies” as well as those clinical trials that are “conducted in accordance with” the Common Rule, while also limiting the collecting entity’s ability to sell or share said information without first disclosing the sharing to the individual data subject and obtaining their consent. But the CPRA, which was first introduced prior to AB 713, fails to include the revisions in the amendment recently signed by the Governor.  Because the CPRA text has the old language, “clinical trial” and “biomedical research study” remain undefined i, and arguably the ambiguities above are reintroduced.

Although this is not certain, it is likely the CPRA will exempt personal information collected as a result of a clinical trials in the same way the updated CCPA does.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Bryan Cave Leighton Paisner | Attorney Advertising

Written by:

Bryan Cave Leighton Paisner
Contact
more
less

Bryan Cave Leighton Paisner on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.