Participant information V503

The General Data Protection Regulation (GDPR 2016/679) came into force in Norway on July 20, 2018. The regulation imposes specific requirements for safeguarding the fundamental rights and freedoms of individuals, particularly their right to the protection of personal data.

Under the GDPR, personal data can be transferred to other countries within the EEA as well as to countries where there is an adequacy decision from the EU Commission regarding the level of protection. The United States does not have such an adequacy decision from the EU Commission. In cases where there is no adequacy decision, data can still be transferred if there are necessary safeguards as per Article 46 of the GDPR. We assess that currently there is no basis for data transfers under Article 46 from Norway to Merck's clinical study database in the US or for personal data transferred from Merck to the US Food and Drug Administration (FDA) that can be used within the timeframe required for the study. The reason includes legal conflicts between European and American law, which authorities are working to resolve, and this will take time. Therefore, for these transfers, we must use an exception, namely Article 49(1) second paragraph of the GDPR.

In the study, pseudonymized health information about participants and biological material from biopsies is transferred to Merck in the USA for analysis and further storage. The information may be shared with regulatory authorities such as the European Medicines Agency (EMA), FDA, and Japan's Pharmaceuticals and Medical Devices Agency (PMDA) for reliability, safety, and effectiveness purposes.

The Data Protection Authority was notified on June 8, 2021, and has given its approval for the transfers in this case based on the exception. Additionally, the Cancer Registry is obliged to inform study participants about the transfers and the compelling legitimate interests that justify the use of the exception. These are described in more detail below.

For the approval of Merck's first HPV vaccine (Gardasil-4), FDA required the long-term effects of the vaccine to be monitored in the Nordic countries. Without such monitoring, the vaccine could not have been offered to young girls (and later boys). Long-term follow-up in the Nordic countries was continued for Merck's second HPV vaccine (Gardasil-9). The HPV vaccine study is grounded in public health considerations and society's legitimate expectations for increased knowledge about health and disease. Norway is among the very few countries in the world where this type of study can be conducted due to our robust health registries that can be linked. Furthermore, LTFU cannot be replaced by other studies, as no one other than this study's participants can provide early knowledge about the long-term effects and safety of Gardasil-9. The transfer of information will be beneficial both for you as a study participant and for women/men who will later be offered the HPV vaccine, as increased knowledge about the vaccine's effects is important for assessing the extent to which it prevents the development of HPV-related cancer. The Cancer Registry has reason to believe that you and others who have previously consented to participate in the follow-up study are also positive about the continued transfer and processing of personal data for the purpose, provided that data protection is adequately ensured.

The processing of personal data in the study is based on legal grounds under Article 6(1)(c) and Article 9(2)(i) of the GDPR. The processing is necessary for fulfilling legal requirements for reliability and safety that clinical studies are subject to. The Medicines Act, the regulation on clinical trials of medicinal products for human use, section 15-6a of the Medicines Regulations, and Annex II, Chapter XIII, No. 18 of the EEA Agreement (Regulation (EU) No. 536/2014) provide supplementary legal bases in national law for processing health data for this purpose. Other processing of personal data in the study is based on Article 6(1)(e) and Article 9(2)(j) of the GDPR, as well as Sections 8 and 9 of the Personal Data Act. This processing is necessary for scientific research purposes.

In addition to pseudonymization, additional measures have been implemented to enhance data protection by ensuring encrypted data transfers, and transferring only the necessary data to achieve the study's objectives. Additionally, an agreement with Merck regarding joint data responsibility has been established to safeguard participants' rights under the GDPR. Given the above-mentioned measures, we assess that the processing is in line with the principles and requirements of the GDPR.

You can withdraw from the study at any time. In that case, we will not collect any new information about you, but the data and biological material that have already been collected and transferred to the USA will still be part of the study. The study's data will be archived for auditing purposes for 15 years after the project's completion. These procedures are legally required in drug trials and ensure that the drug's documentation can be reviewed by authorities if necessary. The archiving period can be extended if required by legal obligations. Biological material transferred to the USA will be kept for two years after the project's completion for audit purposes and will then be destroyed.

You have the right to request access to, rectification, or restriction of the processing of your information. Section 17 of the Personal Data Act provides for certain exceptions to these rights, in line with Article 89(1) of the General Data Protection Regulation, to the extent that providing access would require a disproportionately large effort or the exercise of these rights would likely render it impossible or seriously impede the achievement of the purposes of processing the information.

You can find more information about your rights, privacy, and information security on the Norwegian Cancer Registry's website: https://www.kreftregisteret.no/en/General/About-the-Cancer-Registry/Privacy/