General data protection regulations (2018) and clinical research: perspectives of patients and doctors in an Irish university teaching hospital

BACKGROUND: Europe’s General Data Protection Regulation, or GDPR, is a set of data protection rules on the acquisition, storage, use, and access of personal data. GDPR came into effect in May 2018 when it was introduced across all 27 European Union (EU) member states and the European Economic Area (EEA). Maintaining compliance with this legislation has presented significant new challenges for ongoing clinical research. AIMS: To evaluate the knowledge and expectations of patients and doctors regarding GDPR and implications for future clinical research. METHODS: An anonymous 12-item questionnaire was circulated to patients and doctors at a University Teaching Hospital. Data analysis included descriptive statistics. RESULTS: Five hundred nine participants were included: 261 females (51.3%) and 248 males (48.7%). Three hundred fifty were patients (68.8%) and 159 were doctors (31.2%). Three hundred thirty-four participants were aware of GDPR (65.7%): 116 doctors (73.0%) and 218 patients (62.3%, P = 0.018). 71.1% of doctors were willing to allow their personal data to be processed anonymously as part of a clinical research project compared to 43.4% of patients (P < 0.001). 80.2% of patients believed explicit consent is needed before using personal data in clinical research in comparison to 60.4% of doctors (P < 0.001). Level of education impacted awareness of GDPR (P < 0.001); a higher level of education among patients increased GDPR familiarity (P < 0.001), however failed to impact doctor familiarity (P = 0.117). CONCLUSION: GDPR has introduced complexity to the processing and sharing of personal data among researchers. This study has identified differences in the perception of GDPR and willingness to consent to data being used in clinical research between doctors and patients. Measures to adequately inform prospective research participants on data processing and the evolving landscape of data protection regulation should be prioritised.