Under Article 9.0 of the Agreement a wide range of documents and data pertaining to the clinical trials “will be” DiaMedica’s property. Applying New York State law, the NCC ruled that the definition of “Data” includes the raw data generated during the clinical trials (the source data) as well as PRA’s investigator file. The use of the future tense in this provision does not indicate that ownership requires actual delivery in the future. Under Dutch law, there was instant transferral of ownership to DiaMedica. 

Whereas the contractual relationship between the parties is governed by the laws of the State of New York, Dutch law governs the question whether a property right can be created on documents and data situated in the Netherlands. Ownership can only be vested in ‘corporeal objects that are subject to human control’ (articles 5:1 and 3:2 Dutch civil code). Digital data do not qualify as such. Analogous application of the legal concept of ownership to digital data would be contrary to the “closed” system of Dutch property law and encroach on the domain and prerogatives of the legislative branch.

Under New York State law PRA does not have a lien on the physical documents nor a right to suspend its obligation to surrender the documents, as DiaMedica is not in breach of any obligation under the Agreement.

Some of the documents and data contain personal data, including health data, of the persons who participated in the clinical trials. Surrendering these documents to DiaMedica would qualify as a data transfer between joint data controllers under the General Data Protection Regulation (GDPR). DiaMedica has a legimite interest in obtaining documents containing this personal data, but a transfer of personal data to a third country (Diamedica is based outside the European Union) is only allowed where the European Commission has decided that the third country in question ensures an adequate level of protection (Article 45 of the GDPR) or where the controller or processor has provided appropriate safeguards (Article 46 of the GDPR). Currently, there is no EC Decision regarding transfer of personal data to the US and the NCC is not satisfied that protection of the participants’ health data can be guaranteed by providing safeguards. As a consequence the relevant personal data are to remain within the European Union for the time being. Therefore, the NCC orders DiaMedica to designate a representative within the European Union under Article 27 GDPR, where the documents containing the participant’s personal and health data are to be sent.

The claims for revindication of documents are awarded under certain restrictions and conditions.