Implications of CCPA and CPRA on Clinical Trial Data

Given the recent updates to CCPA, and the possible approval of California Privacy Rights Act (CPRA) which is on the November 3 ballot, it is increasingly likely that personal information collected in the course of clinical trials is not subject to the requirements of the CCPA or the CPRA with certain exceptions.

As originally drafted, the Section 1798.145(c)(1)(C) of the CCPA stated that “[personal] information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, pursuant to good clinical practice guidelines issued by the International Council for Harmonisation or pursuant to human subject protection requirements of the United States Food and Drug Administration” would not be subject to the CCPA. This original clinical trial carve out was ambiguous because it did not define “clinical trials,” leaving the scope of the exemption in question.

On September 25, 2020, Governor Newsom of California approved AB 713, which amends this portion of the CCPA. The amendment clarifies the scope of the clinical trial exemption, and expands the exemption. Specifically, the amendment exempts personal information from the requirements of the CCPA to the extent that personal information is “is collected, used, or disclosed in research, as defined in Section 164.501 of Title 45 of the Code of Federal Regulations, including, but not limited to, a clinical trial, and that is conducted in accordance with applicable ethics, confidentiality, privacy, and security rules of Part 164 of Title 45 of the Code of Federal Regulations, the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the United States Food and Drug Administration.”

Notably, the exemption applies to personal information collected as a part of “research” conducted in accordance with Section 164.501, which is broadly defined to mean “a systemic investigation, including research development, testing, evaluation, designed to develop or contribute to generalizable knowledge.” The definition goes on to specifically name clinical trials and other research conducted in accordance with the Common Rule as a part of the definition of “research.”  Most commentators agree that this amendment has resolved the principle ambiguity regarding the scope of the exemption.

In addition to the CCPA, the CPRA will become fully effective on January 1, 2023. The CPRA generally maintains the various exemptions related to personal information that is already governed by other regulatory regimes (e.g., GLBA and HIPAA), but does make some modifications. Under Section 1798.145(c)(1)(C) the CPRA, personal information “collected as part of a clinical trial or other biomedical research study subject to or conducted in accordance with the Federal Policy for the Protection of Human Subjects, also known at the Common Rule, pursuant to good clinical practice guidelines issued by the International Council for Harmonisation or pursuant to human subject protection requirements of the United States Food and Drug Administration, provided that such information is not sold or shared in a manner no permitted by this subparagraph, and if it is inconsistent, that participants be informed of such use and provide consent.” (emphasis added).

As shown by the bolded language, the exemption under the CPRA expands to include “other biomedical research studies” as well as those clinical trials that are “conducted in accordance with” the Common Rule, while also limiting the collecting entity’s ability to sell or share said information without first disclosing the sharing to the individual data subject and obtaining their consent. But the CPRA, which was first introduced prior to AB 713, fails to include the revisions in the amendment recently signed by the Governor.  Because the CPRA text has the old language, “clinical trial” and “biomedical research study” remain undefined i, and arguably the ambiguities above are reintroduced.

Although this is not certain, it is likely the CPRA will exempt personal information collected as a result of a clinical trials in the same way the updated CCPA does.