Background to the complaint

1. In May 2014, the complainant, a researcher, made a request for public access[1] to 32 clinical study reports held by the European Medicines Agency (EMA) on various medicines. Clinical study reports describe the methods and results of a clinical trial aimed at determining the safety and effectiveness of medicines. The researcher wants access to the reports to verify the results.

2. EMA agreed to release redacted versions of the 32 reports identified by the complainant. As the 32 reports consist of tens of thousands of pages, EMA started to redact and release them in batches of several hundred pages each. The first release took place in September 2014.

3. In September 2016, the complainant submitted a complaint to the Ombudsman. By then, EMA had released about 22 000 pages to the complainant.

The inquiry

4. The Ombudsman opened an inquiry into the complainant’s claim that:

1) EMA’s rate of release of the requested documents is very slow.

2) EMA has made excessive redactions to the documents and failed to replace the redacted patient identifiers with fake identification numbers.

3) EMA does not make available lists of documents held by it, such as reports and other important material, on individual pharmaceutical products.

5. The Ombudsman’s inquiry team met with EMA and received comments from the complainant. The Ombudsman also received a reply from EMA on the complaint. The Ombudsman’s decision takes all of this into account.

Rate of release

Arguments presented to the Ombudsman

6. The complainant argued that EMA had been very slow in releasing the requested documents. Furthermore, the “batching” (splitting the documents into sets of several hundred pages each) made it very difficult to keep track of the released documents.

7. At the meeting with the Ombudsman’s inquiry team, EMA stated that there had been a significant increase in access to documents requests in recent years (fewer than 200 in 2011, more than 700 in 2015 and more than 800 in 2016). Requests were also increasingly complex. As a result, EMA’s response times to requests had increased and batch sizes had decreased. EMA argued that this was the only way it could comply with the legal deadline for releasing documents foreseen by the EU rules on access to documents.

8. EMA stated that the rate of release depended on the type and size of the document requested, the need to consult third parties (for example the pharmaceutical company that had submitted the document), the complexity of the consultation with the third party and the number of access to documents requests treated at the particular point in time. Its access to documents team consisted of 12.5 full-time equivalents, who handled between 110 and 120 requests at a time. EMA hoped that its new policy on the proactive publication of clinical data submitted by pharmaceutical companies to support new applications for medicines[2], would reduce the number of access to documents requests in the future.

9. The complainant replied that if EMA cannot cope with the demand for documents to be released it should take on extra staff, reorganise or even invite students or interested parties as fellows or interns.

The Ombudsman’s assessment

10. EMA’s resources are limited. In view of the zero-growth environment for EU staff, EMA’s staff numbers have not increased in recent years[3]. Taking this into account, having 12.5 full-time equivalents dealing with access to documents requests appears reasonable. At the same time, the number of access to documents requests to EMA has been increasing considerably. The Ombudsman also notes that documents held by EMA will often contain very sensitive and complex information (in particular, health data related to patients participating in clinical trials). Therefore, EMA must use experienced skilled staff to handle access to documents requests.

11. EU access to documents rules allow an EU institutions to refuse to deal with requests that constitute an undue administrative burden[4]. However, it is more citizen-friendly to release requested documents in batches over time, rather than to refuse outright to handle the access request. In this context, redacting and releasing documents to the complainant at a rate of around 900 pages per month is not unreasonably slow.

12. There was thus no maladministration by EMA on this point.

13. Nevertheless, the Ombudsman strongly encourages EMA to pursue its proactive publication policy aimed at improving access to the scientific evidence used to prove that medicines are safe and effective. It is important for the quality of, and the trust in, regulatory assessments that this evidence is, to the greatest extent possible, made public.

Redactions to the requested documents

Arguments presented to the Ombudsman

Replacement of patient identifiers

14. EMA considers it necessary to redact certain information from the reports to protect the personal data[5] of the subjects that took part in the clinical trials.

15. In particular, EMA redacted patient identifiers (clinical study reports do not contain participants’ real names), key-coded information allocated to subjects enrolled in clinical trials. Patient identifiers are made up of a sequence of numbers and letters associated with three elements: the study, the study site and the patient.

16. The complainant criticised EMA for redacting this information without assigning participants “fake” identification numbers (alternative numbers, letters, etc.). According to the complainant, unless the redacted information is replaced, it is impossible to “follow” an individual through the clinical study report. EMA’s redactions thus made it difficult or impossible to interpret the results of the studies. If a patient is mentioned in different parts of the report and the identifier is redacted, this means that it is no longer possible to tell, when reading the redacted document, that the information in the different parts of the clinical study report concerns the same individual. Essentially, according to the complainant, such redactions defeated the purpose of transparency, as it makes it impossible to draw any scientific conclusions from the reports.

17. The Ombudsman asked EMA to consider replacing (“recoding”) the patient identifiers with codes free of personal data to retain data utility (numbers, letters, etc.).

18. EMA stated that clinical study reports contain detailed information concerning patients, such as narratives of adverse events or tables of patient characteristics. According to EMA, replacing the patient identifiers in the reports with another number would certainly assist the reader. However, it would also enable the reader to link together all the information in a clinical study report relating to that specific person. Potentially, this linkage of data could allow the reader to re-identify a patient.

19. EMA argued that re-coding would therefore not eliminate the risk of a possible re-identification of the individual concerned. Public disclosure of this personal data could therefore not be justified under data protection rules[6].

20. In view of this problem, EMA is asking pharmaceutical companies, in the context of the new policy on proactive publication of clinical study reports, to explore whether there would be any alternative mechanisms for anonymising information in clinical study reports, going beyond the mere recoding of patient identifiers throughout the document. One example would be to generalise certain personal details: where the date of birth of an individual is given in a report, this information could be replaced with a high-level aggregate group/range (for example, “+70 years of age”).

Redactions of confidential commercial information

21. The complainant also questioned the need to redact other information from the documents (in particular, the numbers of the batches/lots from which the vaccines tested in the clinical study reports originated). EMA originally redacted this information from the requested documents, citing the need to protect confidential commercial information[7].

22. EMA stated that its understanding of what constitutes confidential commercial information has evolved over time. For example, while EMA used to consider lot numbers as confidential when dealing with the first parts of the complainant’s access to documents request (early 2015), it no longer redacts such information.

23. The complainant argued that EMA’s change of position is of no help to his research group as the majority of the documents in their possession were redacted as described in his complaint.

The Ombudsman’s assessment

Replacement of patient identifiers

24. The Ombudsman notes that personal data concerning health is particularly sensitive and therefore enjoys special protection under EU data protection rules^[8]. Therefore, EMA must be particularly careful in its approach to the potential disclosure of such data. Patient identifiers in clinical study reports, containing information on the study, the study site and the patient, constitute personal data, that is, “any information relating to an identified or identifiable natural person”[9].

25. The complainant argues that EMA should replace these patient identifiers with codes not containing information relating to an identified or identifiable person. The complainant argues that this way, it would still be possible to link the bits of information contained in a clinical study report regarding one single individual—which is important for a researcher to be able to verify the findings of the report.

26. However, the Ombudsman agrees with EMA that merely replacing the patient identifiers with a different type of code would not eliminate the risk of re-identification. The more information that can be linked to an individual (such as gender, age, location, medical history), the bigger the risk of re-identification. This issue is particularly pertinent in a time when computing processes have reached a level of sophistication where they are capable of collecting, linking and processing huge amounts of personal data from different types of sources.

27. To justify refusing access on this basis, it is not necessary to show that there is a strong likelihood that re-identification will occur. Rather, the rules merely require that re-identification be reasonably foreseeable. The risk would also be a valid reason for refusing access if it were reasonably foreseeable that re-identification could occur in at least some cases. The complainant has not provided convincing arguments to show that re-identification would not be possible after recoding.

28. The Ombudsman does not suggest that the complainant or any of his colleagues would attempt to re-identify patients. However, if EMA makes a document publicly available, any third party can access it. Requesters are not required to give reasons for an access request[10], so there is no distinction between “noble” reasons for requesting access (for example, a researcher such as the complainant contributing to public health by verifying the findings of a study) or more questionable ones. EMA’s protection of such sensitive personal data is thus of particular importance.

29. The Ombudsman concludes that EMA’s refusal to recode rather than to redact patient identifiers in the documents released to the complainant did not constitute maladministration.

30. This case shows that the EU access to documents rules are ill-suited to the purpose of making (large amounts of) scientific data available to researchers. Trying to apply the EU access to documents rules for that purpose will often put a significant administrative burden on EU staff while potentially leaving researchers with data that is of little scientific use to them.

31. The Ombudsman therefore welcomes EMA’s attempts at finding a solution. Through its policy on proactive publication of clinical trial data[11], EMA tries to balance the benefits of open scientific data with the obligation to protect personal data. When preparing data for publication, EMA requires pharmaceutical companies to take into consideration the impact that redactions have on the scientific usefulness of the information. The Ombudsman agrees with EMA that the goal should be to retain a maximum of scientifically useful information on medicinal products for the benefit of the public while ensuring adequate anonymisation[12]. EMA also requires users who wish to access the published data for academic or other non-commercial research purposes to disclose their identity to EMA and to commit to refrain from attempts to re-identify trial participants[13].

Redactions of confidential commercial information

32. Concerning the confidential commercial information originally redacted from the reports, the Ombudsman considers it to be good administrative practice for EMA to have a continuously developing policy on access to documents and, in this context, to constantly re-assess its position on what constitutes confidential information. However, it would not be appropriate to require EMA to re-do (parts of) access requests already dealt with following such a policy change, as this would paralyse its handling of new access requests.

33. The Ombudsman believes that a possible solution is for the complainant to make a new access request concerning those specific pages that contain redacted batch/lot numbers necessary to the complainant’s research.

Lists of documents held by EMA

Arguments presented to the Ombudsman

34. The complainant is also concerned about the lack of visibility of what is available under EMA’s access to documents policy[14]. The fact that there are no lists of available documents leads to a sizeable increase in workload, both for requesters and for EMA, as requestors spend time trying to identify the availability of documents or have to make blanket requests for data (leading to unnecessarily large requests).

35. The Ombudsman therefore suggested to EMA that it could make proactively available lists of key documents in its possession, such as clinical study reports.

36. EMA responded that the procedures for obtaining marketing authorisation for medicinal products are highly regulated. Documents published by the Commission^[15] provide a detailed overview of the content of the dossiers that must accompany marketing authorisation applications. EMA also publishes relevant information on its own website. Particularly in relation to very broad requests, EMA helps requesters to identify documents which might be of interest to them[16].

37. EMA argued that, in light of the information already publicly available, it would be unreasonable for it to make available a list of documents submitted to EMA for each marketing authorisation application.

The Ombudsman’s assessment

38. EMA’s explanations are reasonable. It is correct that publicly available documents indicate which clinical study reports are submitted together with marketing authorisation applications. In case of doubt, requesters can also submit requests for information[17] to EMA to establish which documents are in the possession of EMA.

39. There was thus no maladministration concerning this aspect of the complaint.

Conclusion

The Ombudsman closes this case with the following conclusion:

There was no maladministration by the European Medicines Agency in the handling of an access to documents request related to clinical study reports.

The complainant and EMA will be informed of this decision.

 

Emily O'Reilly

European Ombudsman

Strasbourg, 08/02/2018

 

[1] In accordance with Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents, OJ 2001 L 145, p. 43.

[2] More information available at: http://www.ema.europa.eu/ema/index.jsp?curl=pages/special_topics/general/general_content_000555.jsp&mid=WC0b01ac05809f363e

[3] EMA work programme 2017, EMA/583016/2016 Rev.1, page 109, available at: http://www.ema.europa.eu/docs/en_GB/document_library/Work_programme/2017/02/WC500221614.pdf

[4] Judgment of the General Court of 22 May 2012, EnBW Energie Baden-Württemberg v Commission, T-344/08, ECLI:EU:T:2012:242, paragraph 47 and case-law cited.

[5] In accordance with 4(1)(b) of Regulation 1049/2001.

[6] Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the institutions and bodies of the Community and on the free movement of such data, OJ 2001 L 8, p. 1, available at: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32001R0045

[7] Article 4(2), first indent, of Regulation 1049/2001.

[8] Article 10 of Regulation 45/2001.

[9] Article 2(a) of Regulation 45/2001.

[10] Article 6 of Regulation 1049/2001.

[11] See footnote 2.

[12] External guidance on the implementation of the European Medicines Agency policy on the publication of clinical data for medicinal products for human use, EMA/90915/2016, page 41, available at: http://www.ema.europa.eu/docs/en_GB/document_library/Regulatory_and_procedural_guideline/2017/09/WC500235371.pdf

[13] Terms of use available at: https://clinicaldata.ema.europa.eu/web/cdp/termsofuse. For general information purposes, users only need to register and accept the terms of use. Unfair commercial use is not allowed.

[14] European Medicines Agency policy on access to documents (related to medicinal products for human and veterinary use), POLICY/0043, EMA/110196/2006, available at: http://www.ema.europa.eu/docs/en_GB/document_library/Other/2010/11/WC500099473.pdf

[15] https://ec.europa.eu/health/documents/eudralex/vol-2_en

[16] In accordance with Article 6(2) of Regulation 1049/2001.

[17] http://www.ema.europa.eu/ema/index.jsp?curl=pages/about_us/landing/ask_ema_landing_page.jsp&mid=WC0b01ac05806499f0