Informed Consent Form (ICF) and Ethnicity Data: Justification Requirements Under GDPR and MR-001

What is ethnicity data and why does it attract special-category protection?

Ethnicity data is special-category personal data under GDPR Article 9(1), meaning its processing is prohibited by default unless a specific derogation applies. In the clinical research context, this classification has direct consequences for how sponsors structure their study protocol, their data processing agreement and their informed consent documentation.

GDPR Article 9(1) of Regulation (EU) 2016/679 (the General Data Protection Regulation) lists "racial or ethnic origin" among nine categories of personal data whose processing is subject to a heightened prohibition. The rationale is that such data carries an elevated risk of discrimination or stigmatisation for the individuals concerned.

In a clinical trial setting, ethnicity is sometimes collected because certain diseases present differently across population groups, or because pharmacokinetic profiles vary with genetic ancestry. Those scientific reasons are legitimate, but they must be articulated formally, not assumed. The data minimisation principle under GDPR Article 5(1)(c) requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." Collecting ethnicity without documented necessity fails that test.

Focus: The French Framework (CNIL and MR-001)

The CNIL (Commission Nationale de l'Informatique et des Libertés) is the French national data protection authority responsible for supervising compliance with GDPR and national implementing legislation in France. The CNIL publishes a series of reference methodologies, known as Méthodologies de Référence, that provide pre-approved frameworks for processing health data in research. MR-001 (Méthodologie de Référence 001) is the specific reference methodology issued by the CNIL for clinical trials and biomedical research; it sets out the conditions under which sponsors may process health data without seeking individual CNIL authorisation, provided the study complies with the methodology in full.

Page 2 of MR-001 explicitly states that the collection of data relating to ethnic or racial origin must be scientifically justified within the study protocol. This is not a soft recommendation; non-compliance removes the study from the MR-001 safe harbour and requires the sponsor to seek a specific CNIL authorisation, which adds significant time and administrative burden to trial start-up.

What happened: the ethics committee feedback and why it matters

An ethics committee reviewing the ICF of a clinical study identified that ethnicity data was listed among the categories of personal data to be processed, but the document contained no statement explaining the scientific rationale for that collection. The committee accepted the deviation conditionally rather than rejecting the submission outright, but this outcome should not be read as regulatory tolerance. A conditional acceptance still constitutes a recorded deviation, which carries audit and inspection risk under EU Clinical Trials Regulation 536/2014 (the EU CTR).

The EU CTR 536/2014 governs the conduct of clinical trials on medicinal products for human use across the European Union. Article 29 of the EU CTR requires that the informed consent process provide participants with comprehensive information about the nature and purpose of the data collected. An ICF that lists ethnicity as a data category without justification undermines the transparency obligation that underpins meaningful consent.

The practical consequence of this feedback is clear: even where an ethics committee does not issue an outright rejection, an unjustified reference to ethnicity data in an ICF creates a compliance gap that can resurface during a regulatory inspection, a DPIA (Data Protection Impact Assessment) review or a post-study audit. A DPIA is a systematic process required under GDPR Article 35 to identify and mitigate high risks associated with data processing, and special-category data in research almost always triggers this obligation.

Which rules govern ethnicity data collection in clinical trials?

Four principal instruments govern this area: GDPR (Regulation (EU) 2016/679), the EU CTR 536/2014, MR-001 for studies conducted in France, and the ethical framework established by the ICH E6(R2) Good Clinical Practice guideline. Together they create overlapping obligations that reinforce a single conclusion: collection must be justified, documented and disclosed.

InstrumentRelevant ProvisionCore ObligationGDPR 2016/679Article 9(1)Prohibits processing of ethnic origin data unless a derogation appliesGDPR 2016/679Article 9(2)(j)Permits processing for scientific research, subject to Article 89 safeguardsGDPR 2016/679Article 5(1)(c)Data minimisation: collection limited to what is necessaryGDPR 2016/679Article 13/14Transparency: data subjects must be informed of categories and purposesEU CTR 536/2014Article 29ICF must contain clear information about personal data processingMR-001 (CNIL)Page 2Scientific justification for ethnic origin data required in the protocolICH E6(R2) GCPSection 4.8Informed consent must cover all relevant aspects of the trial

GDPR Article 9(2)(j) provides the most commonly relied-upon derogation for clinical research: processing of special-category data is permissible when it is necessary for scientific research purposes, carried out in accordance with Article 89(1), and based on Union or Member State law that provides appropriate safeguards. The Article 89(1) safeguards include technical and organisational measures such as pseudonymisation and data minimisation, precisely the measures that an unjustified collection of ethnicity data would undermine.

ICH E6(R2) Good Clinical Practice (GCP) is the international standard that defines the responsibilities of sponsors, investigators and ethics committees in the conduct of clinical trials; it is referenced by the European Medicines Agency and incorporated into EU CTR expectations for trial quality. Section 4.8 of ICH E6(R2) requires that the informed consent form communicate all information necessary for a participant to make an informed decision, which extends to explaining why particular categories of data are collected.

How should sponsors draft the ICF to satisfy regulators?

Sponsors should include a dedicated justification statement within the data processing section of the ICF whenever ethnicity is a collected variable. This statement must connect the collection of ethnicity data to a specific scientific or clinical rationale articulated in the study protocol, so that the two documents are consistent and mutually reinforcing.

Recommended ICF Drafting Practice

The data processing section of the ICF (sometimes labelled "Categories of data processed" or "Personal data we will collect about you") should contain a paragraph along the following lines, adapted to the specific study:

"Ethnic or racial origin is collected in this study because [state specific scientific reason, for example: evidence suggests that the pharmacokinetic profile of the investigational medicinal product varies across population groups, and the study protocol requires subgroup analyses stratified by ethnic origin to ensure the safety and efficacy findings are generalisable]. The collection of this information is therefore necessary for the scientific objectives of the study as set out in the protocol."

This approach satisfies four requirements simultaneously:

1. It fulfils the GDPR Article 13 transparency obligation by explaining why the data is collected.
2. It demonstrates consistency with the MR-001 requirement that scientific justification appear in the protocol, because the ICF statement references the protocol rationale.
3. It supports the GDPR Article 5(1)(c) data minimisation analysis by showing the collection is not gratuitous.
4. It provides ethics committees and data protection authorities with a clear audit trail linking the data category to a documented scientific need.

Protocol Alignment Is Non-Negotiable

The ICF justification must mirror what the study protocol states. If the protocol does not contain a scientific rationale for ethnicity collection, the ICF cannot create one independently. The correct sequence is: (a) establish the scientific rationale in the protocol, (b) confirm that MR-001 page 2 requirements are satisfied if the study is conducted in France or relies on the MR-001 framework, (c) draft the corresponding ICF paragraph, and (d) ensure both documents are reviewed together during the DPIA and ethics committee submission.

Focus: Broader European Ethics Committee Practice

Although MR-001 is a CNIL instrument specific to France, the underlying principle reflects a pan-European consensus. Ethics committees in Germany (operating under the Arzneimittelgesetz and the Federal Data Protection Act, BDSG), in the Netherlands (under the WMO, Wet medisch-wetenschappelijk onderzoek met mensen) and in Italy (under Legislative Decree 101/2018 implementing GDPR) have similarly required sponsors to justify the collection of sensitive demographic variables including ethnicity. The ICO (Information Commissioner's Office), the UK data protection authority, has published guidance confirming that special-category data in research requires explicit necessity and proportionality reasoning, even post-Brexit under the UK GDPR. Sponsors operating multi-country trials should therefore treat the MR-001 requirement as a baseline minimum rather than a France-specific obligation.

‍