The right to be forgotten
Under GDPR, all individuals have a right to request the deletion of their data or require an organisation to stop processing it. There is an exemption for data that is held for scientific research, but for that exemption to apply, your organisation would have to be able to demonstrate that the continued processing of a set of data is essential to a particular trial.
Under Article 17 of the GDPR, a trial participant can at any time request that all of their data be removed “without undue delay”.
This requirement on the sponsor as data controller would require the identification and deletion of any data, whether stored by the sponsor, CRO, hospital or any other third party.
The right to be “forgotten” cannot be waived in the consent form. Article 89 of the GDPR allows the EU or Member States to limit certain individual rights, when necessary, to enable scientific research. However, this is not intended as a loophole to collect data for other purposes.