Background to the complaint

1. In March 2021, the complainant made a request for public access^[1] to documents to the European Medicines Agency (EMA), asking for access to the marketing authorisation dossier of Zyprexa (Olanzapine), a drug used to treat schizophrenia and bipolar disorder that has been marketed in the EU since 1996.

2. In November 2021, EMA disclosed to the complainant the clinical study report dated April 1995, subject to redactions of certain personal data of the patients enrolled in the clinical trial at issue, including redactions of the patients’ gender as well as of the ID numbers (pseudonyms) allocated to the patients during the clinical trial. EMA considered that disclosure of this information would undermine the privacy and the integrity of the patients concerned and that the complainant had not demonstrated a necessity in the public interest for the transfer of this information.^[2]

3. The complainant challenged EMA’s refusal to disclose the patient ID numbers and the patients’ gender (by making a ‘confirmatory application’). He argued that, due to the passage of time, it could be assumed that relevant additional data that would allow for the re-identification of the patients concerned must have been deleted by now. He also contended that disclosure of the patient ID number and the gender of the patient was necessary to enable the public to fully understand the findings of the clinical study and to verify the safety and efficacy of the drug concerned.

4. In January 2022, EMA issued a confirmatory decision maintaining that access to the personal data at issue in the complainant’s confirmatory application had to be refused.

5. Dissatisfied with this outcome, the complainant turned to the Ombudsman in February 2022.

The inquiry

6. The Ombudsman opened an inquiry into EMA’s refusal to give public access to the personal data concerned.

7. In the course of the inquiry, the Ombudsman inquiry team inspected the clinical study report in question and held a meeting with EMA representatives to discuss the complaint. A report on this meeting^[3] was then shared with the complainant, who did not comment on the report. However, in the course of the inquiry, the Ombudsman received additional arguments from the complainant and, subsequently, EMA’s reply on the complainant’s arguments.

Arguments presented to the Ombudsman  

8. In the meeting with the Ombudsman inquiry team, EMA explained that it applies a uniform approach to assessing documents to which public access is sought. It first classifies a document based on its context and the level of personal data and the type of personal data it contains and then it evaluates the personal data contained therein. Specifically, when assessing personal data contained in a clinical study report, EMA assesses the risk of re-identification for the patients concerned, taking into account various aspects, such as the prevalence of the condition in question, the number of patients that participated in the clinical trial and the duration of the clinical trial.

9. In this case, EMA had found that the personal data at issue concerned a non-vulnerable group of patients, that the number of patients who had participated in the clinical trial had been comparatively small, that the clinical trial had been conducted over a short period and in one country only, and that it did not concern a rare disease or an orphan drug. Based on this, EMA had classified the study as giving rise to a “medium” risk of re-identification and, using its dedicated methodology for its detailed risk assessment, concluded that certain information such as the patients’ age could be disclosed, whereas access had to be refused to the patient ID numbers and the patients’ gender.

10. As regards the patient ID numbers, EMA said that these are pseudonyms that allow for the re-identification of the patients and that, because they are unique, the risk of re-identification from their disclosure is considered high. EMA therefore does generally not disclose this information.

11. EMA added that patient ID numbers are generated and stored by the company conducting the clinical trial and that they are usually kept for a long period, for example, in case it becomes necessary to contact a patient. EMA said that it cannot control what information third parties may hold and that the patients’ right to have their personal data protected continues.

12. EMA also argued that the patient ID numbers at issue also contain the ID number of the respective investigators that had treated the patients concerned. Disclosure would thus reveal the geographical location of the site where a specific patient was treated, thereby increasing the risk of re-identification.

13. Concerning the patients’ gender, EMA said that the factor “age” (which it had disclosed) was medically more significant than the factor “gender”. Disclosing both age and gender would have significantly increased the risk of re-identification of the patients when read together with the information that had been disclosed.

14. In its confirmatory decision, EMA also said that any gender-related differences would have been considered by the experts who evaluated the drug before marketing authorisation was granted and that their views would be reflected in the relevant assessment report (EPAR)^[4].

15. The complainant questioned EMA’s statement that it usually does not disclose patient ID numbers, arguing that EMA had disclosed such information to the public in the past.

16. In reply, EMA confirmed that it had disclosed patient ID numbers on two occasions in the years 2011 and 2012. It said that it had not considered this information to constitute personal data back then but that it had changed its approach since then, based on court rulings^[5] and the views of other bodies^[6].

17. The complainant also raised concerns about the integrity of the manufacturer concerned. He referred to a decision by a national authority not to authorise another drug produced by this manufacturer, and to product liability lawsuits against this manufacturer in the US that were based on its promotion of off-label use of the drug at issue.

The Ombudsman's assessment

18. The concept of ‘personal data’ under the EU data protection rules^[7] is very broad. It comprises “any information relating to an identified or identifiable natural person”.^[8]

19. In addition, the right to have one’s personal data protected is a fundamental right that has no expiration date.^[9]

20. The information at issue relates to patients that participated in a clinical trial. Whilst the patients have not been identified, the Ombudsman finds it reasonable to consider that disclosure of the ID numbers allocated to them during the clinical trial or their gender could risk that they might be indirectly identified.

21. Specifically, as regards the patient ID numbers, EMA has clarified that the key code needed for the re-identification of the patients may still be stored by third parties and that parts of this number relate to the geographical location of the sites where the patients concerned have been treated. In addition, given that EMA has disclosed significant information about these patients (such as their age and their medical history), disclosure of the patient ID numbers would allow the reader of the clinical study report to gather a significant number of details about specific patients. This, in turn, would increase the risk of their re-identification.

22. A review of the clinical study report at issue showed that the patients’ pseudonyms are generally mentioned several times in the document. The Ombudsman therefore agrees that it is reasonably foreseeable that disclosure of this information would increase the risk of re-identification of the patients concerned.

23. If any pseudonym was mentioned only once, disclosure of this information would be meaningless for the purpose of the complainant.

24. The Ombudsman also notes that replacing the pseudonyms would not eliminate this risk of re-identification, as it would simply replace one unique identifier with another.

25. The same holds true for the patients’ gender. Whilst, on its own, this information might not necessarily make a person identifiable, when read in conjunction with the information that was disclosed, the patients’ gender would increase the likelihood of re-identification.

26. In light of all this, the Ombudsman considers that the information at issue constitutes personal data within the meaning of the EU data protection rules and it can only be disclosed in line with these rules.

27. The EU data protection rules require that a person seeking access to personal data must demonstrate a specific need in obtaining such access.^[10] Moreover, that specific need must serve a public interest. Even if such a need exists, the personal data cannot be disclosed if the data subject has a legitimate interest in non-disclosure, which outweighs this need. Finally, even if that test is met, disclosure of the personal data can only occur if it is the most appropriate means of attaining the purpose pursued by the person seeking access. If an alternative, less intrusive means of achieving the same purpose exists, this must be used instead of granting access to the personal data.

28. In addition, as regards personal data related to individuals’ health, as in this case, the EU’s data protection rules recognise that such information is particularly sensitive and thus provide for an increased level of protection.^[11] Therefore, the threshold for establishing a need for disclosure in the public interest is higher than in cases that concern public access to less sensitive personal data.

29. The complainant argued that the personal data at issue should be disclosed to enable the public to verify the safety and efficacy of the drug concerned.

30.  The Ombudsman agrees that, in principle, it is important that clinical study reports be made available, to allow independent researchers to verify the safety and efficacy of the drug concerned.

31. The Ombudsman notes that EMA has published the clinical study report with very limited redactions.

32. As regards the very limited redactions EMA did make, the Ombudsman notes that EMA sought to identify which information relating to patients is of most clinical value and has released that information. It made a judgment call that information related to age and ethnic origin was of greater clinical value than information relating to gender, and released the information relating to age.

33. The complainant has put forward no scientific arguments as to why information on gender would be determinative in terms of understanding the clinical study report. Thus, the Ombudsman is of the view that the redaction of patients’ gender does not prevent the public, including independent researchers, from evaluating the clinical study report.

34. As regards the redaction of pseudonyms, the Ombudsman notes that even if disclosure of pseudonyms might, in principle, assist in the full understanding of clinical study reports, the legitimate interests of the patients must be taken into consideration. Patients have a legitimate interest in protecting their identities. Revealing pseudonyms would allow third parties to gather large amounts of information concerning each individual, thus making it more likely that patients might become identifiable.

35. Whilst the complainant also raised concerns about the integrity of the manufacturer concerned, these are very general in nature. As such, they are not sufficient to establish a need in the public interest to have the personal data of the patients disclosed.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

There was no maladministration by the European Medicines Agency in refusing access to the personal data at issue.

The complainant and EMA will be informed of this decision.

 

Emily O'Reilly
European Ombudsman

Strasbourg, 20/06/2022

 

[1] Under Regulation 1049/2001 regarding public access to European Parliament, Council and Commission documents: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32001R1049, which applies to documents held by EMA pursuant to Article 73 of Regulation 726/2004 laying down Community procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32004R0726.

[2] In accordance with Article 4(1)(b) of Regulation 1049/2001.

[3] The full meeting report is available at: https://www.ombudsman.europa.eu/en/doc/inspection-report/en/156981.

[4] Available at: https://www.ema.europa.eu/en/medicines/human/EPAR/zyprexa#:~:text=Zyprexa%20is%20usually%20taken%20by,be%20obtained%20with%20a%20prescription.

[5] EMA referred to the orders of the vice-president of the court in cases EMA v AbbVie, C-389/13 P(R): https://curia.europa.eu/juris/document/document.jsf?text=&docid=145282&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=5802615 and EMA v Intermune, C-390 P(R): https://curia.europa.eu/juris/document/document.jsf?text=&docid=145281&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=5802615.

[6] EMA referred, for example, to recital (17) of Commission Implementing Regulation 520/2012 on the performance of pharmacovigilance activities: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:159:0005:0025:EN:PDF and to page 11 f. of the European Data Protection Board’s response of 2 February 2021 to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research: https://edpb.europa.eu/sites/default/files/files/file1/edpb_replyec_questionnaireresearch_final.pdf.

[7] Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data: https://eur-lex.europa.eu/eli/reg/2018/1725/oj.

[8] Article 3(1) of Regulation 2018/1725.

[9] Article 8 of the Charter of Fundamental Rights of the European Union: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012P/TXT.

[10] In accordance with Article 9(1)(b) of Regulation 2018/1725.

[11] In accordance with Article 10 of Regulation 2018/1725.