Privireal Home Page Privacy in Research, Ethics and Law
"examining the implementation of the Data Protection Directive 95/46/EC
in relation to medical research and the role of ethics committees"

Research Ethics Committees and Data Protection - An Outline of International Provisions

Deryck Beyleveld - PRIVIREAL Co-ordinator

If the data protection rights of research subjects are to be protected then committees conducting ethical review of research (which will be referred to as "Research Ethics Committees" or "RECs" whether or not they specialise in the ethical review of research) have an important role to play. This is because research subjects might not know that their rights are being violated, one of the most important rights being the right to be provided with information about intended processing of personal data and the identity of the data controller. Even if research subjects manage to discover that their rights are being violated they are, characteristically, not in a good position to defend these rights: to do so they will often to have to make complaints, or take legal action, against their doctors. Many patients are reluctant to contemplate this because they feel that they are in a vulnerable position in the hands of their doctors. Apart from this, they might simply lack the knowledge, or the financial resources, to do proceed. While researchers might also be able to conceal violations of data protection rights from RECs, RECs will often be in a position to reject protocols on the grounds that what they propose violates these rights. In any event, regardless of whether RECs are permitted or required to reject protocols that violate data protection rights, regardless of whether their opinions are advice only or the positive opinion of an REC constitutes at least a necessary condition for research to proceed, regardless of whether RECs are legally empowered to conduct their reviews or do so merely as administrative, regulatory, or professional requirements, and regardless of the force (legal or other wise) of an REC's decision/opinion, if RECs reject/advise against protocols that involve breaches of data protection rights then it is reasonable to assume, everything else being equal, that the data protection rights of research subjects will be better protected if RECs reject protocols that involve breaches of data protection rights than if they do not. Of course, it is possible that research protocols might receive other independent scrutiny in relation to data protection rights. However, even if this is so, it is reasonable to assume that scrutiny of these matters by RECs as well will give better protection than scrutiny by other bodies alone.

In the second part of PRIVIREAL, partners will report on the remit and practice of RECs in their countries in relation to protecting research subjects' data protection rights (to assist with which there was a questionnaire on this site for RECs to fill in on-line). Strictly national requirements for prior ethical review of medical research vary from country to country within the EU and the NAS (see web-pages for individual countries on this site when compiled). There are, however, international guidelines and legal instruments that also have relevant things to say about RECs and their role and remit (including the attention they must or may pay to the law generally and to data protection matters specifically). The legal standing or other force of some of these instruments does, however, also vary from country to country (see web-pages for individual countries on this site when compiled).. However, these international provisions nevertheless constitute important background or contextual information in relation to national situations.

Sometimes these instruments are explicit and unambiguous about the responsibilities of RECs in relation to the law and regulatory requirements generally and data protection rights specifically. However, at other times, what is said is only implicit, hence open to interpretation. Unless the implication is straightforward, no attempt is made to present a view on these matters on this page. The aim of this page is primarily to present the relevant materials in a way that facilitates such interpretative analysis (which is necessary for analysing and evaluating national situations). Doing this, no doubt, unavoidably involves a degree of interpretation. When this occurs, whether explicitly or implicitly, it represents the personal view of the co-ordinator of PRIVIREAL and has no official standing.

The World Medical Association Declaration of Helsinki (October 2000)

This provides a statement of ethical principles for medical research on human subjects, which "includes research on identifiable human material or identifiable data" (A.1)

Related to this, the Declaration asserts that it "is the duty of the physician in medical research to protect the life, health, privacy, and dignity of the human subject" (B.10) and that

[e]very precaution should be taken to respect the privacy of the subject, the confidentiality of the patient's information and to minimize the impact of the study on the subject's physical and mental integrity and on the personality of the subject. (B.21)

Specifically in relation to RECs, it is recommended that

[t]he design and performance of each experimental procedure involving human subjects should be clearly formulated in an experimental protocol. This protocol should be submitted for consideration, comment, guidance, and where appropriate, approval to a specially appointed ethical review committee, which must be independent of the investigator, the sponsor or any other kind of undue influence. This independent committee should be in conformity with the laws and regulations of the country in which the research experiment is performed. (B.13)

Although the statement that

[r]esearch Investigators should be aware of the ethical, legal and regulatory requirements for research on human subjects in their own countries as well as applicable international requirements (A.9)

is not addressed directly to RECs, the assertion that

[t]he research protocol should always contain a statement of the ethical considerations involved and should indicate that there is compliance with the principles enunciated in this Declaration. (B.14)

makes the statement relevant to the remit of RECs, because the protocol must be submitted to an REC for comment, etc.


Although the Declaration of Helsinki is not a legally binding instrument in its own right, it is of central importance because various other documents (both international and national, some of which have a legally binding status) and various funding and professional bodies require its principles to be taken into account or even complied with. For example, at the international/EU level, see ICH GCP 2.1 and Directive 2001/20/EC Recital 2 . Furthermore, the European Commission requires all research it funds under the EC 5th Framework Programme Quality of Life Programme to comply with the Declaration. (See Ethical Review under the Quality of Life Programme, p.3) and there is no reason to think that this will not be carried forward to future Framework Programmes.

Council of Europe Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine

Bearing in mind the importance of obtaining informed consent in review by an REC, Article 16 of the Convention is relevant. This specifies that research on persons may only be undertaken if all of a number of requirements are met, which include

iii. the research project has been approved by the competent body after independent examination of its scientific merit, including assessment of the importance of the aim of the research, and multidisciplinary review of its ethical acceptability;
iv. the persons undergoing research have been informed of their rights and the safeguards prescribed by law for their protection.

In relation to this, Article 10 recognises a right to respect for private life in relation to information about a person's health (which is a function of the link between the Convention on Human Rights and Biomedicine and the European Convention on Human Rights [see Article 8 of the ECHR] as Conventions of the Council of Europe) Restrictions may be placed on this right only if they are

prescribed by law and are necessary in a democratic society in the interest of public safety, for the prevention of crime, for the protection of public health or for the protection of the rights and freedoms of others. (Article 26; and see Article 8(2) of the ECHR)

Of significance in relation to the right privacy in relation to genetic material, Article 22 states,

When in the course of an intervention any part of a human body is removed, it may be stored and used for a purpose other than that for which it was removed, only if this is done in conformity with appropriate information and consent procedures.

Of interest in relation to this, Recital 26 of Directive 98/44/EC on the Legal Protection of Biotechnological Material states,

Whereas if an invention is based on biological material of human origin or if it uses such material, where a patent application is filed, the person from whose body the material is taken must have had an opportunity of expressing free and informed consent thereto, in accordance with national law.

In Kingdom of the Netherlands v European Parliament and Council of the European Union (Case C-377/98), the European Court of Justice endorsed the view that not to obtain free and informed consent from the donor for all potential uses of human biological material is to violate fundamental rights and took the view that the duty to enforce this requirement lies outside the patent system, being the responsibility of those whose responsibility it is to ensure free and informed consent when human biological material is obtained (see paragraphs 79-80 of the judgment and paragraphs 209-214 & 228 of Advocate General Jacob's Opinion).


The force of the Convention at national level depends on whether or not a particular country has signed and ratified the Convention (see signature and ratification for each state) and, if so, on whether it has made any declarations or reservations (see declarations and reservations)

Even if a country has signed and ratified the Convention, and made no declarations or reservations, the effect of this will depend on whether or not the country in question adheres to "monism", according to which international treaties that have been ratified automatically become part of the domestic law of the country, or to "dualism", according to which the Convention (and other international treaties) that have been ratified by the country must be incorporated into domestic law by a domestic legislative act before they must be enforced by the domestic courts.

The European Commission also requires all research it funds under the EC 5th Framework Programme Quality of Life Programme to comply with the Convention. (See Ethical Review under the Quality of Life Programme, p.3).

UNESCO's Declaration on the Human Genome and Human Rights of 11 November 1997

This Declaration was endorsed by the United Nations' General Assembly on 9 December 1998. According to Article 5(d), research protocols "shall"

be submitted for prior review in accordance with relevant national and international research standards or guidelines,

and Article 16 declares that

States should recognize the value of promoting, at various levels as appropriate, the establishment of independent, multidisciplinary and pluralist ethics committees to assess the ethical, legal and social issues raised by research on the human genome and its applications.

According to Article 7,

Genetic data associated with an identifiable person and stored or processed for the purposes of research or any other purpose must be held confidential in the conditions foreseen set by law

while Article 9 provides that

[i]n order to protect human rights and fundamental freedoms, limitations to the principles of consent and confidentiality may only be prescribed by law, for compelling reasons within the bounds of public international law and the international law of human rights.


Being a Declaration, not a Convention, the Declaration has the standing of a guideline only. Member States are recommended to implement it, but there is no formal process for this.

However, the European Commission requires all research it funds under the EC 5th Framework Programme Quality of Life Programme to comply with the Declaration. (See Ethical Review under the Quality of Life Programme, p.3).

International Conference on Harmonisation Harmonised Tripartite Guideline on Good Clinical Practice ("ICH GCP")

As the Introduction to the Guideline (which was finalised in July 1997) states, it was adopted to provide a unified standard for the EU, Japan, and the United States to facilitate the mutual acceptance of clinical data by the regulatory authorities in these three regions (ICH Main page).


Compliance with the Guideline is necessary for clinical data to be accepted by the relevant regulatory authorities; and the Guideline has now been given legal force in the EU by Directive 2001/20/EC.

Relevant Definitions

An "Independent Ethics Committee (IEC)" is

[a]n independent body (a review board or a committee, institutional, regional, national, or supranational), constituted of medical/scientific professionals and non-medical/nonscientific members, whose responsibility it is to ensure the protection of the rights, safety and well-being of human subjects involved in a trial and to provide public assurance of that protection, by, among other things, reviewing and approving/providing favourable opinion on, the trial protocol, the suitability of the investigator(s), facilities, and the methods and material to be used in obtaining and documenting informed consent of the trial subjects.

The legal status, composition, function, operations and regulatory requirements pertaining to Independent Ethics Committees may differ among countries, but should allow the Independent Ethics Committee to act in agreement with GCP as described in this guideline. (1.27)

RECs in the United States, which are called "Institutional Review Boards" ("IRBs"), give "approvals", which are defined as affirmative decisions

of the IRB that the clinical trial has been reviewed and may be conducted at the institution site within the constraints set forth by the IRB, the institution, Good Clinical Practice (GCP), and the applicable regulatory requirements. (1.5)

An "opinion" is

[t]he judgement and/or the advice provided by an Independent Ethics Committee (IEC). (1.42)

The difference between an "approval" and a "favourable opinion" is not further explained, but is arguably that an "approval" is sufficient to authorise the trial; whereas a mere "favourable opinion" is necessary but not sufficient to do so.

"Compliance (in relation to trials)" means

[a]dherence to all the trial-related requirements, Good Clinical Practice (GCP) requirements, and the applicable regulatory requirements. (1.15)

"GCP" is

[a] standard for the design, conduct, performance, monitoring, auditing, recording, analyses, and reporting of clinical trials that provides assurance that the data and reported results are credible and accurate, and that the rights, integrity, and confidentiality [which is "prevention of disclosure to other than authorized individuals of a sponsor's proprietary information or of a subject's identity" (1.16)] of trial subjects are protected. (1.24)

Principles of ICH GCP

These are listed in Part 2, and include

2.1 - Clinical trials should be conducted in accordance with the ethical principles that have their origin in the Declaration of Helsinki, and that are consistent with GCP and the applicable regulatory requirement(s).

2.6 - A trial should be conducted in compliance with the protocol that has received prior institutional review board (IRB)/independent ethics committee (IEC) approval/favourable opinion.

2.11 - The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with the applicable regulatory requirement(s).

Responsibilities, Roles and Procedures of RECs

Some statements relevant to the remit of RECs are contained in the definition of IECs in 1.27 and some of the other definitions to which attention has been drawn above. The remit of RECs is further elaborated in Part 3, of which the following paragraphs are of particular importance in relation to responsibilities/roles re legal/regulatory requirements.

3.1.1 An IRB/IEC should safeguard the rights, safety, and well-being of all trial subjects. Special attention should be paid to trials that may include vulnerable subjects

3.1.6 When a non-therapeutic trial is to be carried out with the consent of the subject's legally acceptable representative (see 4.8.12, 4.8.14), the IRB/IEC should determine that the proposed protocol and/or other document(s) adequately addresses relevant ethical concerns and meets applicable regulatory requirements for such trials.

3.1.7 Where the protocol indicates that prior consent of the trial subject or the subject's legally acceptable representative is not possible (see 4.8.15), the IRB/IEC should determine that the proposed protocol and/or other document(s) adequately addresses relevant ethical concerns and meets applicable regulatory requirements for such trials (i.e., in emergency situations).

3.2.2 The IRB/IEC should perform its functions according to written operating procedures, should maintain written records of its activities and minutes of its meetings, and should comply with GCP and with the applicable regulatory requirement(s).

3.3.5 Providing, according to the applicable regulatory requirements, expedited review and approval/favourable opinion of minor change(s) in ongoing trials that have the approval/favourable opinion of the IRB/IEC.

In relation to 3.1.1, it is important to note that 2.3 asserts (reflecting, in part, the Declaration of Helsinki A.5) that

The rights, safety and well-being of the trial subjects are the most important considerations and should prevail over interests of science and society


5.11.1 The sponsor should obtain from the investigator/institution:
b A statement obtained from the IRB/IEC that it is organized and operates according to GCP and the applicable laws and regulations

implies that RECs are required to provide assurances in writing that they are organised and operate according to GCP and the applicable laws and regulations.

Directive 2001/20/EC

This gives legal effect to ICH GCP in the EU. It is the most authoritative document in the EU on the role and remit of RECs. At the same time, it must be noted that the it only covers research that involves clinical trials of medicinal products for human use. Thus, if only in principle, it will be open to Member States to operate two systems of review (one under the Directive, and one not under the Directive). EU Member States must submit their national implementing measures to the European Commission by 1 May 2003, and must, thereby, bring the Directive into effect by 1 May 2004 (Article 22). (Note on Directives on Outline of 95/46/EC page)

Definition of an REC

An "ethics committee" is

an independent body in a Member State, consisting of healthcare professionals and non-medical members, whose responsibility it is to protect the rights, safety and wellbeing of human subjects [see also Recital 2] involved in a trial and to provide public assurance of that protection, by, among other things, expressing an opinion on the trial protocol, the suitability of the investigators and the adequacy of facilities, and on the methods and documents to be used to inform trial subjects and obtain their informed consent. (Article 2(k))

Duties, Responsibilities, Roles and Powers of RECs

These are further elaborated in

Article 3(2)(a), according to which

A clinical trial may be initiated only if the Ethics Committee and/or the competent authority comes to the conclusion that the anticipated therapeutic and public health benefits justify the risks and may be continued only if compliance with this requirement is permanently monitored.

Article 4(h), which provides that clinical trials on minors may not proceed without the endorsement of a specialist REC or one that has obtained specialist advice;

Article 5(g), which provides that clinical trials on adults incapable of giving their consent may not proceed without the endorsement of a specialist REC or one that has obtained specialist advice;

Article 6, which

(1) requires Member States to establish and operate RECs "for the purposes of implementation of clinical trials";
(2) requires Member States to provide for the opinion of an REC to be given before a clinical trial commences on any issue requested;
(3) provides a list of matters that RECs must, in particular, consider when formulating their opinions;
(4) permits Member States to devolve consideration of some of these things to the competent authority that each State must set up under Article 9;
(5) sets a time limit for the REC to deliver its opinion;
(6) permits the REC to make one request for supplementary information when examining an application; and
(7) permits extensions to the time limit set for authorisation of trials "involving medicinal products for gene therapy or somatic cell therapy or medicinal products containing genetically modified organisms", and exempts authorisation of trials of "xenogenic cell therapy" altogether from the time limit;

Article 7, which requires Member States to provide for there to be only one REC opinion in each Member State;

Article 9(1), which requires Member States to prohibit sponsors from beginning trials without the favourable opinion of an REC; but authorisation may be implicit as well as explicit (Recital 11);

Article 10(a), which requires sponsors of clinical trials to submit "substantial" amendments to protocols to the REC and sets time limits for the REC to consider these;

Article 10(b), which permits sponsors to undertake urgent safety measures in emergency situations without informing the REC, which must subsequently be informed;

Article 10(c), which requires the sponsor to inform the REC when a clinical trial has ended;

Article 11(1)(d), which requires the favourable opinion of an REC to be communicated to all the Member States on a European database to which access is restricted, and which is to be treated as confidential (Article 11(3));

Article 12(1) & (2), which requires the competent authority to inform the REC when it suspends or prohibits a clinical trial;

Article 15(2), which provides that inspection reports for the purposes of verifying compliance with GCP may be made available to the REC;

Article 16(3), which grants RECs the power to obtain from the investigator additional information on any reported deaths of subjects;

Article 17(1)(a) & (b), which requires serious adverse reactions to be notified to the REC.

Rights that RECs must Safeguard

Recital 2 makes reference to the 1996 version of the World Medical Association Declaration of Helsinki (which has now been superseded by the 2000 version).

Article 3(2) specifies that a clinical trial may be undertaken only if (amongst other things)

(c) the rights of the subject to physical and mental integrity, to privacy and to the protection of the data concerning him in accordance with Directive 95/46/EC are safeguarded [see also Recitals 2 & 17];

Regarding this, Article 6(3) states that when RECs prepare their opinions they must (amongst other things) in particular consider

(g) the adequacy and completeness of the written information to be given and the procedure to be followed for the purpose of obtaining informed consent and the justification for the research on persons incapable of giving informed consent as regards the specific restrictions laid down in Article 3.

Article 6(4) specifies that Member States may devolve consideration of matters listed under Article 6(3)(h), (i) & (j) to the competent authority under Article 9. But this does not apply to the matters RECs must consider that are listed in Article 6(3)(a)-(g) & (k). Thus, reading Article 3(2)(c) with Article 6(3)(g) & 6(4) implies that RECs have a responsibility to safeguard subjects' data protection rights under Directive 95/46/EC that may not be devolved elsewhere. To assist RECs in carrying out this responsibility, Article 8 requires the Commission to provide detailed guidance on

the application format and documentation to be submitted in an application for an ethics committee opinion, in particular regarding the information that is given to subjects, and on the appropriate safeguards for the protection of personal data.

Penalties and Liabilities

Trials conducted in breach of the provisions of the Directive will not be able to obtain regulatory approval in the EU for the products being tested. The Directive does not, however, prescribe any penalties or liabilities for breach of the national laws implementing the Directive, which are left at the discretion of Member States. Thus, while it seems clear that Member States will have to make provision for REC review by law, there is no requirement for them to, e.g., make it a criminal offence not to submit trials to REC review.

Ethical Review Under the Quality of Life ("QoL") Programme

The EC (in response to Opinion No. 10 on The Fifth Research Framework Programme of the European Group on Ethics in Science and New Technologies []) requires all proposals it funds under the 5th Framework Quality of Life Programme that raise ethical/legal issues to receive ethical review (p.5) by a panel (in effect, an EC REC)

composed of 12-15 independent experts from the Member States or associated countries and representing a variety of different disciplines (biology, genetic, neurosciences, medicine, psychology, law, philosophy, theology, sociology, animal welfare groups). . . . (p.6)

The objectives of the review include

to ensure that the proposers:

have identified all ethical issues which the proposed research may raise;
have taken into account such issues in setting the experimental framework and protocols;
have taken the appropriate measures to fulfil all ethical and/or legal requirements at national level;
have respected the ethical framework for the QoL programme. (p.5)

Proposers should, amongst other things, (as regards the use of human tissue)

specify and justify the type, amount and source of tissue to be used; describe the procedure for obtaining informed consent of the person(s) from whom the material is obtained; and describe the arrangements for protecting the confidentiality of personal data of the individuals concerned (p.4)

and (as regards the use of personal data or genetic information)

describe the procedure for obtaining informed consent of persons to whom the information relates and describe the arrangements for protecting the confidentiality of personal data of the individuals concerned. (p.4)

Documents relevant to the review are listed in Annex 3 (p.9) and include Directive 95/46/EC as well as other international Declarations and Conventions, and EC Directives and Regulations relevant to medical research and bioethics generally

Opinion No. 13 on Ethical Issues of Healthcare in the Information Society of the European Group on Ethics in Science and New Technologies

Although this Opinion makes no reference to the role of RECs directly, paragraph 2 (at p.9) is relevant to the remit of RECs in relation to the law and data protection rights, as it states,

The Principles of the European Convention on Human Rights, the rules of the Convention of the Council of Europe for the protection of individuals with regard to automatic processing of personal data and especially the European Directive 95/46/EC, for the protection of personal data, are an essential source for addressing the ethical questions of healthcare in the Information Society.

Additional Protocol to the Convention on Human Rights and Biomedicine, concerning Biomedical Research

The Additional Protocol to the Convention on Human Rights and Biomedicine on Biomedical Research is an initiative by the Council of Europe to build on the principles embodied in the Biomedicine Convention, with a view to protecting human rights and dignity in the specific field of biomedical research. It defines fundamental rights in biomedical research, in particular of those participating in research.

It directly mentions Ethics Committees in Chapter III, where it states

Article 9 Independent examination by an ethics committee

1. Every research project shall be submitted for independent examination of its ethical acceptability to an ethics committee. Such projects shall be submitted to independent examination in each State in which any research activity is to take place.

2. The purpose of the multidisciplinary examination of the ethical acceptability of the research project shall be to protect the dignity, rights, safety and well-being of research participants. The assessment of the ethical acceptability shall draw on an appropriate range of expertise and experience adequately reflecting professional and lay views.

3. The ethics committee shall produce an opinion containing reasons for its conclusion.

Article 10 continues to stress that research ethics committees should be independent, and not subject to undue influence or conflict of interest. Article 11 refers to information to be presented to the REC, and the appendix to the protocol outlines exactly which information should be provided, under three main headings: A Description of the Project; Participants, Consent and Information; Other Information. Article 12 states that an ethics committee should be sure that no undue influence exists on a research participant.

The Protocol contains many other principles which could be relevant when undertaking an ethical assessment, including those relating to consent and confidentiality.

This Protocol enters into force when five countries have ratified it: List of signatories