Continuous Monitoring, Consent and Participant Burden
Why always-on data collection reshapes consent, withdrawal and data minimisation — and why convenience is not the same as proportionality
REGULATORY OPERATIONSAlways-on sensing cannot be discharged by a signature on a widely drafted consent form: it requires four separate records, each made before the first recording.
A lawful basis that is not the trial consent; a written justification for every stream; a stop mechanism built and tested; a plan for abnormal findings. A study that cannot produce those four records is exposed to a refused or conditioned ethics approval, unlawful processing of health data, and an inspection finding on consent.
Each concern has an article — lawful basis is the one most misread
| Concern | Regulatory anchor | What the design must do |
|---|---|---|
| Specific, informed consent | CTR Arts 29, 28(1)(c); E6(R3) s.2.8.10; FDA DHT guidance IV.F.3 | State the always-on reality and any secondary use in the consent text |
| Right to withdraw | CTR Art. 28(3); E6(R3) s.2.9.1; FDA 2008 guidance; GDPR 7(3), 17(3) | Build and test a stop; state the retention position in consent |
| Data minimization | GDPR Arts 5(1)(b)–(c) and 25 | Justify each stream against purpose; drop streams without one |
| Lawful basis and special-category data | GDPR Arts 6(1), 9(1)–(2), 35; EDPB Opinion 3/2019 | Record Art. 6 basis, Art. 9(2) condition and DPIA before collection |
| Ethics oversight | 21 CFR Part 56 or CTR Chapter III; FDA DHT guidance s.IV.H.1 | Submit necessity, burden and the incidental-findings plan for review |
'They consented' answers the wrong question
The EDPB has said CTR consent 'must not be confused' with GDPR consent and is rarely the right basis; sponsors rely on Art. 6(1)(c), (e) or (f) with an Art. 9(2)(i) or (j) condition.
CTR Art. 28(3), FDA's 2008 retention guidance and GDPR Art. 17(3) all retain lawfully collected data. Offering deletion as a free choice promises what a regulated trial cannot deliver.
That a stream is easy to collect passively says nothing about whether it is necessary. Collecting more than the purpose needs breaches GDPR Art. 5(1)(c) — it is not a richer dataset.
FDA expects the safety monitoring plan to address abnormal measurements and when participants are told; neither ICH E6(R3) nor the Declaration of Helsinki covers incidental findings.
Five decisions, each made before the first recording
- 1Define what is collected — exactly which streams run continuously, at what granularity, and for what stated purpose; drop the rest.
- 2Fix the legal basis — record the Art. 6 basis and Art. 9(2) condition, with a DPIA, before collection starts.
- 3Make consent meaningful — state what runs continuously, the uses and the retention position in the consent form.
- 4Design real withdrawal — a stop the participant triggers without the recruiter, that reaches the device, and logs when collection ended.
- 5Plan incidental findings — agree in advance how clinically significant signals are handled and returned, and disclose it in consent.
CTR Arts 28, 29, Chapter III · ICH E6(R3) s.2.8.10, 2.9.1 · GDPR Arts 4(11), 5, 6, 7(3), 9, 17(3), 25, 35 · EDPB Opinion 3/2019 · FDA DHT guidance s.IV.F.3, IV.H.1 · FDA retention guidance (2008) · 21 CFR Parts 50, 56
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call