France – Health Research and Data Protection: Lawmakers Revise Research Standard MR-003 “Research in the Field of Health Without Collection of Consent”

By Mark Heinemann, Principal Consultant, Real World Clinical Consulting, Syneos Health

The French Data Protection Agency CNIL recently published a revised version of the French Research Standard MR-003 “Research in the Field of Health Without Collection of Consent”.

CNIL describes the updated Reference Methodology MR-003 as applicable for

  • processing of data that include health data
  • and that are of a public interest,
  • carried out in the context of research involving the human person,
  • for which the person concerned does not object to participate after having been informed.

It applies in particular to non-interventional research and cluster clinical trials. Individual patient information is mandatory. The data controller undertakes to collect only those data that are strictly necessary and relevant to the objectives of the research.

New in MR-003 is the explicit mentioning of “public interest” that is linked to the data processing purposes. Indeed, the French introductory text to MR-003 says:

“La méthodologie de référence MR-003 encadre les traitements comprenant des données de santé et présentant un caractère d’intérêt public, réalisés dans le cadre de recherches impliquant la personne humaine… »

There is no further explanation of the term « public interest » in the CNIL guidance document.

For more details, one must refer to ruling no. 2018-154 of May 3rd, 2018 that links the term ‘public interest’ to the types of data processing described in section 1.2 of the same document:

  • research involving the human person as defined in 3° of article L. 1121-1 of the Public Health Code (CSP), i.e. non-interventional research that does not involve any risk or constraint in which all acts are performed and products used in the usual way;
  • research involving the human person mentioned in 2 ° of article L. 1121-1 CSP, with the characteristics and conditions of which are provided for in article L. 11221-4 CSP;
  • research aimed at evaluating routine care subject to legislative and regulatory provisions prior to the entry into force of Act No. 2012-300 of 5 March 2012 on research involving the human person;
  • clinical trials for which the person does not object to his participation, in accordance with the conditions laid down in Article 30 of Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials of medicinal products for human use and repealing Directive 2001/20 / EC (cluster clinical trials).

The description of the different research types none withstanding, no definition of the term ‘public interest’ is given in ruling no. 2018-154.

One may come to the conclusion that an element of uncertainty has been introduced with the 2018 version of MR-003:

“Do research projects have a public interest, even if privately sponsored, and for what types of industry-sponsored research may a MR-003 compliance declaration be filed”?

Considering that research with health data in France is ‘nothing else’ than the data processing of health-related data from human beings, French data protection law will provide an answer to what ‘public interest’ is in the field of research.

The French Act on Information Technology, Data Files and Civil Liberties prohibits in principle the processing of certain types of personal data, in particular data related to the health of a person.

As with rules in general, exceptions are justified under certain circumstances; here it is the case when health-related data processing is justified by public interest and is in conformity with chapter 9 of the above-mentioned law.

In chapter 9, article 54 of the law, the term ‘public interest’ is eventually disclosed:

(Data) processing under this Chapter may be implemented only in consideration of the purpose of the public interest they present:

Ensuring high standards of quality and safety of health care and medicines or medical devices is of public interest.”

This definition allows to circle back to ruling no. 2018-154 concerning the revision of MR-003 and the research types described there in section 1.2.

Under the condition that the intended research project has the objective of ensuring the safety of medicinal products, medical devices or the safety of health care in general, the condition of ‘public interest’ is fulfilled.

A research enters the scope of the MR-003, provided that all other applicable conditions of the research standard are fulfilled for the project in question.