The rules on de-identification and research exemptions in the GDPR help companies to use personal data for scientific research with fewer restrictions compared to data collections for other purposes. Under these exemptions, companies in the EU might collect and process data for a secondary purpose without consent. However, the requirements and exemptions for scientific research vary among EU Member States, which might result in forum shopping. They might also hinder the review of the input data in medical devices since the new regulations on medical devices in the EU (Regulations 2017/745 and 2017/746) require compliance with the GDPR. These combined implications might result in safety risks. Focusing on the research exemption and de-identification rules of the GDPR in a medical device setting, the authors discuss to what extent scientific research with public interest should benefit from the research exemption of the GDPR. Harmonized rules would also be necessary on the expected level of de-identification, to balance the data subjects’ rights and safety of medical devices. This chapter will examine how the input data is reviewed by medical device authorities and notified bodies in the EU and how this may affect the US, following recently released guidelines and discussion papers.

Not all clinical trials of in-dwelling Class III medical devices (e.g., DBS) will successfully demonstrate safety and efficacy, conditions necessary for FDA approval. Other trials may be successful, but the study sponsor and investigators may decide not to bring the device to market. There is scant regulatory guidance about sponsor or investigator posttrial obligations and little case law. While industry norms tend to govern posttrial access to pharmaceuticals, and industry sponsors routinely offer some degree of access, these norms are neither established nor directly analogous to questions of posttrial access to in-dwelling Class III medical devices. Legal clarity is important, given that such devices remain in a participant’s body and may require ongoing maintenance, surveillance, replacement, or explanation, and uncertainty about posttrial access may dissuade prospective participants from trial enrollment, potentially thwarting the development of innovative devices.