Taking the lead from Europe’s General Data Protection Regulation (GDPR), the California Consumer Protection Act (CCPA) goes into effect January 1, 2020, after being passed by the California State Legislature and signed into law in June 2018.
The law applies to companies conducting business in the state. Specifically, companies with more than $25m in revenue buying or selling personal information of 50,000 or more consumers or deriving 50% or more of its annual revenue from selling consumers’ information.
Under the legislation, consumers have the right to know what personal information is collected, used, shared, or sold. Additionally, it necessitates that businesses and associated service providers delete any personal information if asked, also providing consumers with the ability to opt-out of the sale of their data.
Financial incentives for retaining or selling a consumer’s information also must be disclosed, according to the regulations, which correspondingly require companies to outline how the value of data is calculated.
As for the implication in drug development, Norma Rodriguez, vice president, QA and regulatory, Greenphire, said the CCPA will provide further confidence to clinical trial participants that their data will not be inappropriately shared.
“In fact, the law excludes from its scope the processing of some categories of personal information altogether, such as medical data covered by other US legal frameworks, including processing of personal information for clinical trials,” she told us.
To be compliant with the EU’s GDPR regulations – which came into effect May 2018 – Rodriguez noted that many clinical trial sponsors have already invested time and resources to ensure compliance.
Still, while the CCPA is similar to GDPR in many ways, there are still some differences. “This means that sponsors need to understand and prepare for the distinctions when responding to request from a data subjects exercising their rights,” added Rodriguez.
As currently written, clinical trials are exempt from the law, but additional clarity is needed.
Said Rodriguez, “There are still some questions being raised regarding the extent to which clinical research – including secondary research which is not specifically addressed in the CCPA – will be affected by this law."