Medical facilities and clinical trial sponsors – joint data controllers


The Commission for Personal Data Protection (CPDP) announced a resolution on processing of personal data for the purposes of conducting clinical trials (available here).

The resolution was requested by a clinical trial sponsor operating in Bulgaria asking for the Commission’s position on the following matters:

  1. Do medical institutions process personal data in the course of ongoing clinical trials, considering that their obligations include provision of qualified and instructed personnel, appropriate equipment, as well as to allow monitoring and audit of the trials by healthcare professionals, who are employees of these medical institutions;
  2. If medical institutions process personal data, do they have a capacity of a data controller or a data processor?

The regulator established that medical institutions process personal data in the course of clinical trials.

CPDP states that medical institutions and sponsors of clinical trials are joint personal data controllers. As such, they both jointly determine purposes and manners for processing of patients’ personal data.

Practically this means that sponsors of clinical trials must include in their contracts with the medical institutions explicit clauses on personal data processing in relation to the conducting of clinical trials, arranging the following:

  • How will data subjects exercise their rights under the GDPR;
  • How will the joint data controllers provide information regarding the processing of the subject’s personal data;
  • How will other personal data protection obligations be distributed amongst the joint data controllers.

The interpretation made by the Bulgarian regulator is in line with Article 29 Working Group’s (currently European Data Protection Board) established practice.

Additionally, it reconfirms that the sponsor – researcher relationships do not always establish a data controller – data processor relationship in the context of personal data protection. Thus, personal data protection should be examined on a case-by-case basis considering all the specifics of the situation.

For further information contact:

Ilya Komarevski, Partner

Mileslava Bogdanova-Misheva, Senior Legal Advisor

This article has an informative purpose and is not representative of detailed legal advice. If you are interested in receiving advice in the context of a certain situation, we can happily assist you. The law firm is not responsible for any harm caused by acts or omissions undertaken due to this text.