DPA case 07126-1 / 2020/29 – Violation Found (Slovenia, 2020)

The Information Commissioner had been asked on the data protection roles of the the sponsor of a clinical trial and the principal investigator (i.e. the entity conducting the trial) with regards to the data processed in the trial: *Do sponsor and principal investigator qualify as joint controllers or *do they qualify as idependent controllers or *does the sponsor qualify as controller and the investigator qualify as the sponsor's processor? The Information Commissioner held that national Slovenian law regulating clinical trials does not define the data protection roles of sponsor and principal investigator. [https://edpb.europa.eu/our-work-tools/our-documents/dictamen-art-70/opinion-32019-concerning-questions-and-answers_en EDPB Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR)] also does not provide an answer on that question. According to the Information Commissioner, the sponsor typically acts as a controller of personal data processed in the course of the trial. The principal investigator does not always have a role of a joint controller or a processor, as this depends on its tasks, assignments and level of autonomy in the particular clinical study. he Information Commissioner emphasised that a case-by-case analysis is neccessary, looking at the specific processing operations. Therefore, the principal investigator may qualify as (joint) controller for certain processing operations and as a processor for others. Finally, the Information Commissioner mentioned that the EPDB will soon adopt guidelines on the concepts of controller and processor in the GDPR.