Click here to open the filter panel
B
Biotechnology
B
Broad consent
B
Business associate agreement (BAA)
C
Central imaging
C
Central laboratory
C
Chemistry, Manufacturing and Controls (CMC)
C
Clinical outcome assessment (COA)
C
Clinical research
C
Clinical study
C
Clinical trial
C
Clinical trial agreement (CTA)
C
Clinical trial phases
C
Clinical Trials Information System (CTIS)
C
Clinical trial site
C
Clinical Trials Regulation (CTR) 536/2014
C
Clinician-reported outcome (ClinRO)
C
CNIL (Commission nationale de l'informatique et des libertés)
C
Codes of conduct
C
Consent
C
Contract research organisation (CRO)
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

J

Joint controllers

Joint controllers are two or more controllers that jointly determine the purposes and means of processing (Art. 26(1) GDPR). Joint controllership arises from a common decision, or from converging decisions that complement each other and are necessary for the processing to take place, as the Court of Justice explained in Wirtschaftsakademie (C-210/16), Jehovan todistajat (C-25/17) and Fashion ID (C-40/17) and the EDPB developed in Guidelines 07/2020. Participation in the same processing chain is not enough: each party must exercise decisive influence over why and how the data is processed, although they need not have equal roles or access to the data.

Joint controllers must determine their respective responsibilities for compliance, in particular for data subject rights and for the information duties, by means of a transparent arrangement, the essence of which must be made available to data subjects (Art. 26(1) and (2)). Regardless of the arrangement, data subjects may exercise their rights against each joint controller (Art. 26(3)), and each may be held liable for the entire damage (Art. 82(4)). The arrangement is typically a joint controller agreement covering purposes, roles, legal bases, information, rights handling, security, breach notification, processors, transfers and retention.

In life sciences, joint controllership is frequently discussed for sponsor and investigator site relationships, although the prevailing view in most Member States is that they are separate controllers for distinct processing; some ethics committees and authorities take a different position, and the DPIA should state the analysis adopted per country. Clearer cases are research consortia and public-private partnerships (IMI/IHI projects), disease registries run by several organisations, health data warehouses governed by multiple hospitals, and co-development partnerships in which two companies define a shared protocol. Wrongly labelling a CRO as joint controller, or a genuine joint controller as processor, distorts liability and rights handling.