Preparing documents under the revised CTIS transparency rules

The EU Clinical Trials Information System makes a defined set of a trial's data and documents public under transparency rules revised in June 2024. A sponsor submits each document ready for disclosure, with personal data and commercially confidential information redacted from the version for publication under the Clinical Trials Regulation and further regulations, and a clinical study report used in a marketing authorisation application falls under EMA Policy 0070 as well.

The rules that govern what the system publishes

The Clinical Trials Regulation aims for transparency through publicly accessible information but also limits the disclosure of personal data and commercially confidential information. ¹ Two further regulations apply to the disclosure of clinical trial information in the EU and EEA, and Policy 0070, which covers marketing authorisation applications, also affects documents for public disclosure. ² One of them, the General Data Protection Regulation (EU) 2016/679, sets the overall rules for protecting personal data, and Article 93 of the Clinical Trials Regulation refers to it on personal data. ^{2, 1}

Documents in scope for publication can still contain personal data, which should be protected under Regulations (EU) 2018/1725 and 2016/679, and commercially confidential information, which should be protected taking into account the marketing authorisation status of the medicine, unless there is an overriding public interest in disclosure. ³ Personal data may not appear in documents submitted to the public side of the system unless specifically required by law, and participants must be assured through informed consent that their data and rights are protected against misuse. ¹ Both personal data and commercially confidential information should be redacted from documents in scope before they are submitted. ¹

Whose personal data the documents can carry

How personal data are handled in the system is set out in the joint controllership arrangement for it, the European Medicines Agency's guidance on protecting personal data and commercially confidential information, Annex I, and the questions-and-answers document. ^{4, 2} The representatives of the sponsor or marketing authorisation applicant or holder who use the system must follow the data protection rules and are responsible for protecting personal data in publicly accessible documents. ⁴

Four kinds of personal data can arise in the system. ⁴ Registered users' names, surnames and email addresses are held for administration and not published. ⁴ Trial participants' data may appear in application documents but should be kept out of documents in scope for publication, and in a clinical study report must be protected by redaction or other anonymisation techniques. ⁴ The principal investigator's name and professional contact details are published, while the investigator's curriculum vitae is submitted and not published. ⁴ Details of the sponsor's contact point and legal representative in the EU are required but not published, whereas the scientific and public contact points are required and published. ⁴

Annex I, a European Medicines Agency document, says what personal data each document for publication is expected to hold. ⁵ The protocol, including patient-facing documents, and the final summary of results are expected to carry personal details of sponsor staff, signatures included. ⁵ The recruitment arrangements, subject information and informed consent form carry the name or identifying details of the principal investigator, which are to be disclosed, or of other individuals including site personnel. ⁵ The clinical study report carries pseudonymised participant data, and no personal data are expected in the summary of product characteristics or the lay summary. ⁵ The standard templates Annex I points to are ICH M11 for the protocol, the agency's product information templates for the summary of product characteristics, with the QRD templates for nationally authorised products, EudraLex Volume 10 for the recruitment arrangements, subject information and informed consent form, the good lay summary practice guidance for the lay summary, and ICH E3 for the clinical study report. ⁵

Protecting commercially confidential information

Commercially confidential information in documents for the system should be protected following the principles described for Policy 0070. ⁶ A protocol becomes public in most cases immediately after the first member state's decision, so protecting the confidential information in it needs careful consideration. ⁶ The protocol of a category 1 trial in adults is disclosed later than those of other trials, but a sponsor should consider that such a trial may end earlier than planned and its information become public earlier than anticipated. ⁶

The clinical study report under two regimes

A clinical study report used in a marketing authorisation application is in scope twice: under the Clinical Trials Regulation at the level of a single trial, and under Policy 0070 at the level of a marketing authorisation dossier, with the Regulation referring to the policy for the report's disclosure. ^{7, 8} So the earliest public access to a report will most likely be through the system. ⁷ As of September 2024, how that early access would affect the Policy 0070 process remained for the regulators to clarify. ^{7, 8} Nor had the regulators yet given details of how the report's disclosure under the two regimes would be aligned. ⁹

Where a report stands alone, is not part of a drug submission dossier and includes EU participants, it is publicly disclosed through the system's portal under the Clinical Trials Regulation; where it eventually forms part of a European drug submission dossier, it is disclosed through the Policy 0070 portal. ¹⁰ The uploads under the two regimes are made independently, to two different websites, but under the same data protection and confidentiality rules. ¹¹

The Regulation covers the report of a trial performed under it and used in a marketing authorisation application in the EU and EEA. ¹² The marketing authorisation applicant or holder submits the report to the system as used in the application, with its appendices except those listing individual patient data, appropriately redacted or anonymised for personal data and commercially confidential information. ¹² No anonymisation report should be submitted with it unless one is specifically required. ¹²

The report is the document likely to carry most of the personal data needing redaction or anonymisation. ⁹ Where safety information in the annual safety reports may also appear in the report, a participant should be referred to by the worldwide unique case identification number and the trial identifier rather than the subject identifier. ⁹

Writing documents that are ready to disclose

To write documents that are ready to disclose:

• Reduce personal data and commercially confidential information to what the regulatory requirements need, considering what the system holds in its structured fields as well as in the documents.
• Retain enough data utility in redacted documents.
• Include participants' personal data only where the regulatory assessment needs it, in the version not for publication, and redact it from the version for publication before upload.
• Leave principal investigators' names and contact details unredacted; they are legally required.
• Redact all signatures, or leave authors' signatures out of versions for publication altogether.
• Use generic functional, non-personal telephone numbers and email addresses for contact points, including the scientific and public contact points.
• Keep details of trial participants out of patient narratives: give month and year for a date of birth, count days relative to the trial's start, and name a world region instead of a specific country.
• Keep information on sponsor and other staff to a minimum.
• Redact from the version for publication the names of certain roles that the version not for publication is expected to carry, such as the person issuing the site suitability document or the composition of the data safety monitoring board.
• Remove personal data from the document's metadata in its properties before submitting it.
• Avoid replicating paragraphs within and between documents, and use cross-references and electronic links instead.
• Name files clearly so that each is submitted into the correct slot.
• Keep an overview of the company's transparency policy, and monitor what is public not only through the system but on sponsor websites, in conference presentations and in global public databases.

^{13, 14, 4, 8, 15}