EU Regulations on Clinical Trials number 536/2014 will enter into force 6 months after the publication of a notice by the EU Commission confirming that the clinical trial portal and databases have achieved full functionality in accordance with the required specifications.
Such clinical trial portal and database, where all information submitted through the portal will be stored, supposedly one of the high points of the Regulation, is probably its worst enemy so far. In fact, due to technical difficulties with the development of the IT systems (aka “CTIS”), the portal’s go-live date had to be postponed for years. Therefore, so far, the Directive continues to apply, while some argue that the Regulation – that appeared cutting edge in 2014 – already shows the signs of age.
Now things are finally moving ahead.
On April 21, 2021 the European Medicines Agency’s Extraordinary Management Board confirmed that “CTIS is fully functional and meets the functional specifications, following an independent, successful audit“.
The ball is now in the European Commission’s court: once the Commission confirms the same conclusions on CTIS, a notice will be published in the Official Journal of the European Union. “Six months after this notice, the Regulation will start to apply and CTIS will go live. The aim is that CTIS goes live on 31 January 2022.” says the EMA.
Access to personal data concerning deceased people may represent an issue and a necessity, especially for their heirs. How is such kind of access to personal data currently regulated under the Italian Law (Legislative Decree n. 196/2003), as amended after GDPR?
The Italian Data Protection Authority, in its efforts to combine data protection legislation and clarity, recently issued an outline of article 2-terdecies of the Legislative Decree n. 196/2003.
- Who is entitled to such right to access? Whoever (i) has a vested interest; (ii) acts in the interest of the deceased person (who is the “interested party” pursuant to data protection laws); (iii) acts as mandatary; or (iv) acts for worthwhile reasons of family protection.
- To whom should the request to access data be addressed? The request should be addressed to the relevant Data Controller (i.e., the natural or legal person, public authority, agency or other body, either private or public, which determines the purposes and means of the processing of personal data), also through the Data Processor (i.e., the natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller), where appointed.
- Which information may be requested? (i) Access to personal data of the deceased person; (ii) the purpose of processing data; (iii) which data have been communicated and the related addressees; (iv) the retention period; (v) the origin of such data and (vi) whether data are subject to an automatic decisional processing (Sections 15-22 of GDPR).
- Do you have to pay to access data? No, it is free (unless the request is manifestly unfounded or excessive).
- Are there any exceptions or limits? Yes, it is not possible to access data in the event it is forbidden (i) by the law or (ii) by the interested party, who released an express and unequivocal declaration addressed to the Data Controller. However, even in the latter hypothesis, third parties exercising their patrimonial rights originating from the death of the interested party cannot be prejudiced in their rights.
- Do you have to motivate your request? No.
- How long does it take to get a feedback on your request? Maximum one monthsince your request, except in some particular cases, as provided by GDPR.
- What can you do if your request is refused or in lack of any feedback? You may address the Italian Data Protection Authority or the relevant court.
Access to data concerning deceased people seems to be quite easy in theory. However, balancing patrimonial rights of heirs and assessing “express and unequivocal” declarations of the deceased may prove to be more complex in practice.
With a law decree decided yesterday, the Italian Government enacted two interesting new rules aimed at health care professionals (“HCPs“):
- Criminal liability of HCPs administering vaccines for the crimes of manslaughter and personal injuries is excluded, provided that the vaccinations follow the indications of the authorization of the specific vaccine and the decisions of the Ministry of Health;
- The obligation of HCPs to be vaccinated is introduced: HCPs refusing to undergo vaccination may be assigned to different duties or her/his remuneration may be suspended. The constitutionality of this obligation has been often discussed, but most scholars believe that – on the basis of the Constitutional Court jurisprudence (especially decision no. 5 of 2018, drafted by Ms. Cartabia, who is now part of the government) – there is no doubt about compliance of this provision with the Italian Constitution. Vaccination is in fact aimed at not only preserving health for the individual who is vaccinated, but also other people’s health, and consequences of vaccination are tolerable.
Hopefully the above provisions will help the vaccination campaign move faster. I certainly cannot wait to roll up my sleeve!