How to Approach the Protection of Personal Data and Commercially Confidential Information of EU Clinical Trial Applications: Practical Considerations
Authored by Pierre-Frédéric Omnes, Executive Director
The publication of clinical data has been a focus of public policies and regulations in the European Union (EU) in recent years to avoid duplication of clinical trials, foster innovation, and encourage the development of new medicines. It also serves to build public trust and confidence in regulators' scientific and decision-making processes.
Two main frameworks currently coexist to foster such transparency:
- European Medicines Agency’s Policy 70[i] covering clinical data submitted by pharmaceutical companies to support their regulatory applications for human medicines under the centralized procedure was launched in 2016 and started again in September 2023 (following a suspension linked to EMA relocation to Amsterdam).
- Regulation (EU) No. 536/2014[ii] on clinical trials on human medicines (EUCTR) provides a legal basis for the release of clinical trial results conducted in the EU and authorized under the regulation, which entered application on January 31, 2022. This covers clinical trial proceedings through their lifecycles, a summary of trial results including a lay summary, and clinical study reports (CSR) for those trials in the system subsequently included in a marketing authorization submission in the EU (not limited to centralized procedure).
Guidance has been developed concerning redaction and anonymization activities in the EU. These are designed to protect the identities of patients and professionals who participated in clinical trials in compliance with European legislation on personal data (PD) protection and commercially confidential information (CCI). Nevertheless, it is essential to differentiate the publication of clinical trial-related information generated during the clinical trial lifecycle (EUCTR Article 81.4) from the broader clinical results and full clinical study report disclosure (EMA Policy 70 and EUCTR). This is due to differing operational implementation, timing, and interplay with clinical trial operations.
In October 2023, new transparency rules[iii] were endorsed by the EMA to implement purposeful transparency, ensuring early publication of vital trial data while simplifying processes for sponsors. Effectively, the number of documents to be publicized significantly decreased. These new rules should be implemented in CTIS by the end of Q2, 2024, and will require adjustments regarding how documents previously within the scope of the transparency rules are to be uploaded in CTIS for new and transitioning clinical trial applications.
General Principles
The EUCTR brings unprecedented standards for transparency and publication of clinical trial data in the European Union, as it expands the scope of EMA Policy 70 to the CSRs of all trials conducted under EUCTR included in EU marketing authorizations. It also extends clinical trial disclosure beyond results to include a wider set of proceedings pertaining to the submission, assessment, and conduct of clinical trials submitted in the EU Portal and database, the Clinical Trial Information System (CTIS).
EUCTR Article 81.4 makes the EU database publicly available with a few exceptions: PD, CCI, and communication between member states during assessment report preparation and clinical trial supervision activities. Documents, such as the quality section of the Investigational Medicinal Product Dossier (IMPD), and financial arrangements with the site are also considered confidential. All others were made public, as described in the disclosure rules derived from the EUCTR[iv]. These extensive requirements have been significantly reduced as of October 2023 with the implementation of new transparency rules, effectively reducing the scope of publication to the clinical trial protocol, its synopsis, recruitment arrangements, informed consent, and other patient documents exclusively.
The immediate impact of EUCTR on clinical trial disclosure activities lies in clinical trial application disclosure requirements, where publication rules affect documents posted in CTIS once the trial begins and throughout its lifecycle. The latter impact is a minor extension of EMA Policy 70 to a larger set of procedures. Consequently, this mandates two critical components to be known to clinical data disclosure teams, namely PD and CCI. These are to be managed during the planning and conduct of clinical trials to protect the information. They must also be maintained when submitting applications and notifications in CTIS. Safeguarding this data should include:
- Establishment of a data minimization strategy to be applied from clinical trial inception. This extends to the oversight of published clinical data, document/information authoring, and process deployment to limit the initial amount of PD/CCI.
- Embedding the preparation of redacted document versions “for publication” and unredacted document versions “not for publication” in operations activities throughout the lifecycle of the clinical trial.
With the implementation of the new rules, these activities need to be majorly focused on protocol/protocol-derived documents (synopsis, informed consent) as well as other patient documents. EMA guidance (version 1.1 dated July 10, 2023)[v] indicates how to approach the protection of PD and CCI in the context of EUCTR, and provides significant insight and examples that may support setting up practical measures for integrated implementation of PD/CCI protection measures in daily trial conduct. This guidance is expected to align with the new transparency rules (i.e., the deferral section will be removed from the updated guidance). A Transparency Q&A document is also available, particularly related to the transition period between those two rulesets.
The impact on clinical summary reports is yet to be determined, as the interaction between EMA Policy 70 and CSR publication requirements from CTR is still pending clarification. Further information is anticipated on this topic, particularly concerning the overlap and specificities of each scheme, as well as which platform to use for publication purposes. Most of the principles detailed in EMA Policy 70 guidance should remain valid and may still be considered[vi].
Data Minimization Considerations
When considering the impact of managing PD/CCI information, it is critical that data minimization strategies be implemented to limit the amount of information in documents submitted in CTIS, as well as within the scope of the new transparency rules. Ensuring adequate mapping of such information throughout the document lifecycle is also beneficial to manage impact when these sections require updates (and later re-redaction of documents “for publication”).
PD, in particular, may evolve as the trial progresses, considering that initial PD information may be limited to sponsors, vendors, and clinical trial site names/details. However, it may expand to study participant data once recruitment has started (i.e., prior trial descriptions in the protocol). Similarly, the nature of the document will influence the PD/CCI and implementation mechanisms to control added information, as well as subsequent redaction. Signatures should be reduced to what is legally required in the “not for publication” document and will always constitute PD in the document “for publication.” Finally, document screening must also extend to file metadata, as all submissions are made electronically, and PD may be located in this metadata.
There are concerns that CCI disclosure will undermine the legitimate economic interest or competitive position of the concerned entities, for example, clinical trial sponsors, marketing authorization applicants/holders, or service providers. The first criterion in defining CCI is whether the information is already in the public domain. If so, oversight of data publication (stakeholders’ financial information, corporate website, scientific literature, etc.) will be essential to prequalify potentially confidential information for flagging when included in documents. Robust processes and adequate staff training will also be required to ensure that redaction is successfully implemented for such data during submission preparations. This is because both versions (“for publication” and “not for publication”) must be uploaded in tandem within the same application (whether initial, modified, notified, or as an answer to a request for information).
What may qualify as CCI?
Information not available in the public domain
Information whose disclosure may undermine the legitimate economic interest or competitive position of the concerned entities, including:
- Product-Related Information, such as dosage, pharmaceutical form, mechanism of action, any other information pertaining to the development or manufacture of the product, etc., deemed confidential by the sponsor
- Trial-Related Information, such as trial design, main characteristics (inclusion/exclusion criteria, endpoints), specific features of the trial (proprietary tools, COA, medical devices or in-vitro diagnostic medical devices, innovative analytical methods, etc.), specific statistical method, etc., deemed confidential by the sponsor
Redaction considerations
PD/CCI redaction initially generated significant workloads and time commitments for clinical trial applicants. This was due to a drastic increase in transparency requirements (compared to the previous Clinical Trial Directive 2001/20/EC) following the implementation of EUCTR. The reduction of in-scope documents under new transparency rules has significantly minimized this burden. Nonetheless, upfront planning in the management of PD/CCI in documents and structured data pending publication remains essential. While PD management has well-defined rules and principles, CCI proves to be more challenging due to the subjective and circumstantial nature of what qualifies as confidential at a given time for a specific product or trial. Referencing experience from recently transitioned trials, or those currently awaiting transition, will help to establish more streamlined approaches to balance compliance with transparency and mitigate the administrative burden in trial conduct.
With the implementation of a robust data minimization strategy, the amount of information requiring redaction due to PD/CCI considerations should be clearly mapped and limited exclusively to essential, required information. However, study teams’ awareness must be raised to maintain compliance on PD/CCI disclosure throughout the trial duration and not exclusively at the time of study results or CSR postings. As mentioned earlier, the extent and nature of redacted information will also vary depending on the trial stage, as this will directly influence whether PD is limited to sponsors, vendors, or site staff as well as extending to study participants. Similarly, CCI information should be more prominent earlier in the development phase, with less information available in the public domain, and more scrutiny to limit the unintended disclosure of CCI via inadequate procedures.
For trial application-related documents, redaction by masking as the sole anonymization technique should be sufficient. Other techniques (including several in CSRs) may be required for results or CSR postings, including pseudonymization, particularly for participants’ data. Examples of such redaction are provided in a recent Q&A on transparency[i] available on the EMA website. For structured data to be populated in CTIS, there is no option to enter information “not for publication;” therefore, editing the text prior to its upload will be required to prevent PD/CCI disclosure via that option. As such, it is important to ensure the adequate delegation of responsibilities around PD/CCI disclosure with vendors and sites, as those parties may also produce documentation that will end up being submitted in CTIS.
The EMA PD/CCI guidance provides extensive considerations on the type of information that should remain in the documents “not for publication” or, for PD specifically, those to be removed (or retained as exceptions) in the documents “for publication.” The considerations pertaining to identification, tagging, and management of information qualified as CCI within sponsor organizations should also assist in establishing adequate procedures to map and control CCI during the trial lifecycle.
The transition from functional specifications to new rules in CTIS
Several impacts to CTIS are anticipated following the implementation of new transparency rules:
- Publication Engine: This shows when adjustments to each field/document will appear and will be implemented in CTIS ensuring compliance with the new rules. Specific transition considerations are available in the transparency Q&A, allowing the use of placeholder documents to replace the “for publication” documents no longer in scope of transparency. This also applies to trials transitioning from the clinical trial directive to the clinical trial regulation (with some flexibility as to when those documents for publication still in scope should be provided).
- Deferral: Deferral settings included in initial trial applications in CTIS enabled sponsors to protect CCI without redaction in their documents. This means that for CCI protection purposes, either redaction or deferral could be used, but the use of both was discouraged and limited to justified cases only. This functionality will be decommissioned upon implementation of the new rules in CTIS.
- For-Publication/Not-for-Publication Documents: The required upload of both versions will be limited to the scope of the new transparency rules, using the document placeholder location in CTIS (sections limited to “protocol” and “synopsis of the protocol” in Part I, and “recruitment arrangements” and “subject information and informed consent form” in Part II.)
Which structured data will be published in CTIS at the first country decision
upon implementation of the new transparency rules?
- Public title (= title in lay terms)
- Trial identifiers in registers, protocol code
- Phase, medical condition, rare disease, therapeutic area
- Population age, gender
- Sponsor details
- Details of clinical investigator sites in MSC(s)
Remaining CTA fields populated by the sponsor (including product/active substance details) will be published 30 months after the EU/EEA End of Trial (except for pediatrics trials or trials listed in a pediatric investigation plan [PIP]).
Which documents will be published in CTIS
upon implementation of the new transparency rules?
- Protocols (upon the results submission for pediatrics/PIP trials, 30 months after the end of a trial for Category I adult trials, and at the first country decision for Category 2 and 3 trials)
- Protocol synopses (upon the results submission for pediatrics/PIP trials, 30 months after the end of a trial for Category I adult trials, and at the first country decision for Category 2 and 3 trials)
- Patient-facing documents (upon the results submission for pediatrics/PIP trials, 30 months after the end of a trial for Category I adult trials, and at the first country decision for Category 2 and 3 trials)
- SmPCs, if available (for Category 2 and 3 trials only, at the first country decision as this is Part II)
- Subject information and informed consent forms (for Category 2 and 3 trials only, at the first country decision as this is Part II)
- Recruitment arrangements, including procedures for inclusion and copies of advertising materials (for Category 2 and 3 trials only, at the first country decision as this is Part II)
- Final summaries of results, layperson summaries of results (as soon as submitted for pediatrics/PIP trials and Category 2 and 3 trials and 30 months after the end of a trial for Category 1 adult trials)
- Clinical study reports (as soon as submitted for trials conducted under or transitioned to CTR)
Contact us at EUCTR@transperfect.com to learn more about transparency in EUCTR, and how we can support you in finetuning your processes or the execution of your trials under this new framework.
References:
[II] http://data.europa.eu/eli/reg/2014/536/2022-12-05
[III] https://www.ema.europa.eu/en/documents/other/revised-ctis-transparency-rules_en.pdf
[VI] https://www.ema.europa.eu/en/clinical-data-publication/support-industry-clinical-data-publication