COMPLAINT: 444/2022/MIG

Case title: The European Medicines Agency's refusal to give public access to parts of a clinical study report concerning a drug for the treatment of schizophrenia and bipolar disorder

Date: Wednesday, 30 March 2022

Remote meeting arrangements: Microsoft Teams

Present

EUROPEAN MEDICINES AGENCY

Head of Legal Department

Head of Document Access and Publication Department

Head of Access to Documents Service

Head of Litigation Office

Legal Adviser (Litigation Office | Legal Department)

Data Protection Officer

EUROPEAN OMBUDSMAN

Fergal O'Regan, Chief Legal Expert

Jennifer King, Legal Expert

Michaela Gehring, Inquiries Officer

Olatz Finez Marañon, Inquiries Trainee

Purpose of the meeting

The purpose of the meeting was to discuss the case and to obtain further information from EMA as to why it refused access to the redacted information at issue in the complaint, that is, the patient ID numbers and the patients’ gender, including further information on the risk assessment that EMA carried out in this case and on the medical significance of the redacted information.

Introduction and procedural information

The Ombudsman inquiry team introduced themselves, thanked the EMA representatives for meeting with them and set out the purpose of the meeting. They outlined the legal framework that applies to meetings held by the Ombudsman, in particular, that the Ombudsman would not disclose any information identified by EMA as confidential, neither to the complainant nor to any other person outside the Ombudsman’s Office, without EMA’s prior consent.^[1]

The inquiry team explained that they would draw up a draft report on the meeting to be sent to EMA to ensure that it was factually accurate and complete. The meeting report would then be finalised, included in the file and provided to the complainant. No confidential information would be included in the report or otherwise provided to the complainant or any third party.

Information provided by EMA

On EMA’s approach toward assessing documents to which public access is sought

The EMA representatives explained that EMA applies a uniform approach to assessing documents that are the subject of requests for public access, and uses a defined approach to determine the appropriate level of redaction of personal data. They said that, as a first step, EMA classifies a requested document, depending on its context and on the type of personal data it contains, for example, “patient level data from clinical trial”. Depending on the classification of the document, EMA then assesses the personal data contained therein, using a dedicated internal methodology appropriate to this classification.

In particular, as regards clinical study reports (CSR) EMA evaluates the category of risk of re-identification for the patients concerned. For that purpose, EMA takes into account various aspects, such as the prevalence of the condition in question, the number of patients that participated in the clinical trial and the duration of the clinical trial. Based on a defined methodology, EMA allocates a risk category to the document (high, medium or low risk) that will then determine whether access can be given to the various types of personal data concerned. This includes direct identifiers (such as the patients’ names) as well as indirect identifiers, that is information that could lead to the re-identification of patients when used in combination with other information (for example, the patients’ age or their gender, whether they formed part of a vulnerable group of subjects or not).

The EMA representatives also explained that, when establishing the risk-categorisation methodology to be used for its assessment, EMA takes into account the sensitivity of the different types of personal data in question as well as the utility of its disclosure for the public. For example, EMA would normally not redact the medical history of patients or the adverse effects they experienced during a clinical trial, except if this information is considered to be very sensitive. Likewise, EMA would normally disclose the age of the patients concerned. However, if the clinical trial at issue concerns, for example, children, EMA considers that disclosure would increase the risk of re-identification whilst not having any added value for the reader of the report (for whom it will suffice to know that the patients were, for example, adolescents).

On EMA’s assessment in this case

The EMA representatives then explained, based on the relevant risk categorisation methodology, how the risk assessment was conducted in this case. In line with EMA’s methodology, the CSR at issue was classified as “containing patient level data from clinical trial”. It was found that the clinical trial concerned a non-vulnerable group of patients, that the number of patients who had participated in the clinical trial had been comparatively small, that the clinical trial had been conducted over a short period and in one country only, and that it did not concern a rare disease or an orphan drug. Based on this, EMA classified the risk as “medium” and used the appropriate methodology for its detailed risk assessment.

On the redactions challenged by the complainant

As regards the patient ID numbers, the EMA representatives stated that patient ID numbers are pseudonymised data that enable the re-identification of the data subject(s).

The EMA representatives also explained that it is the company conducting the clinical trial that generates the patient ID number and creates a key code that allows for re-identification. 

While the key code is kept confidential and access to it is restricted, it is usually preserved by the company concerned for a long period, for example in case that it becomes necessary to contact a patient.

In general, EMA does not disclose patient ID numbers^[2] (irrespective of the risk category it applies to a document) given that these numbers are unique, i.e. they relate to one specific patient only, and are thus associated with a high risk of re-identification.

The EMA representatives stated that any information that can contribute to the identification of a natural person must be considered personal data. Being a patient-specific identifier (as opposed to information such as race or age, which applies to more than one individual), the patient ID number makes it possible to connect unrelated information from different parts of a document to the same patient. It thereby significantly increases the risk of re-identification of a patient as compared to more general identifiers, such as age, race, etc., which could pertain to several patients.

The EMA representatives said that EMA’s redactions of patient ID numbers in a clinical study report are aligned with previous decisions of the European Ombudsman on the same matter (see, in particular, decisions 1602/2016/JAS and 2123/2020/VS). They also referred to Opinion 4/2007 on the concept of personal data of the Article 29 Data Protection Working Party of 20 June 2007. At page 18 et seq. of this Report, the Working Party noted that key-coded information, of the sort commonly used in clinical trials with medicines, is pseudonymised personal data, not anonymised data.

Moreover, the patient ID numbers in this case comprise the investigator number and the patient sequence number. As the investigator number equates to the site number, EMA considered that disclosure of this information would reveal the geographical location of the site where a patient has been treated which would significantly further increase the risk of their re-identification.

As regards the redaction of the patients’ gender, the EMA representatives explained that it is necessary to balance the utility of the information for the public with the risk of re-identification of patients. In this case, EMA considered that the factor “age” (which has been disclosed) was medically more significant than the factor “gender”, while disclosing both would have significantly increased the risk of re-identification of the patients that participated in the trial, in combination with the medical history, the age and racial origin details, which were not redacted from the report.

On the passage of time

The EMA representatives stated that the fact that almost 30 years have elapsed since the clinical trial was conducted does not imply that the risk of re-identification has diminished. They stated that the patients’ right to have their personal data protected continues and that it was reasonable to expect that a number of patients were still alive.  Therefore, EMA did not consider, in the present case, the passage of time as a factor affecting the risk of re-identification. EMA cannot control what information third parties may hold (e.g., the list with the study participants’ ID numbers and names) that may enable them to identify the study participants.

On the possibility to re-code the patient ID numbers

As regards the possibility to replace the patient ID numbers with a new code (so as to enable the reader of the redacted version of the CSR to “follow” specific patients throughout the document), the EMA representatives took the view that this would amount to the creation of a new document which is not required by the law. Further, the EMA representatives argued that re-coding patient ID numbers would entail an excessive administrative workload and that it would be technically challenging. In addition, it would not remove the risk of re-identification: the reader of the redacted version of the CSR would still be able to link different pieces of information relating to the same patient. Thus, they could come into possession of information on specific patients, which would increase the risk that they might be identified. They also recalled that the European Ombudsman decided, in her decision in 1602/2016/JAS, that EMA’s refusal to recode, rather than to redact, patient identifiers in the documents released to the complainant did not constitute maladministration.

Conclusion of the meeting

The inquiry team thanked the EMA representatives for their time and for the explanations provided, and the meeting ended.

Following the meeting, the inquiry team obtained copies of the following documents from EMA:^[3]

• Two methodology documents used for the assessment of the document at issue in the complainant’s access request (including the results of the assessment).

 

Brussels, 09/06/2022

Fergal Ó Regan                                                                                        Michaela Gehring

Chief Legal Expert                                                                                   Inquiries Officer

 

[1] Article 4.8 of the European Ombudsman’s Implementing Provisions.

[2] The inquiry team informed the EMA representatives that the complainant questioned this. The Ombudsman will share with EMA the relevant evidence provided by the complainant and give EMA the opportunity to comment.

[3] These documents are confidential and will not be disclosed to the complainant or any other person outside the Ombudsman’s Office without EMA’s prior agreement.