How Policy 0070 was drafted, contested and adopted
EMA Policy 0070 took shape between 2012 and 2016: the dispute over access to the agency's documents and the stakeholder workshop that followed it, a draft put out for consultation, the objections and comments it drew, the principles the agency committed to before adopting it, and the steps by which it was agreed, postponed, brought into force and given its detailed guidance.
How the dispute over access arose
Discussions on the right of access to clinical trial data were first triggered by complaints to the European Ombudsman about the European Medicines Agency refusing access to documents in its possession. The Treaty of Lisbon had extended the right of public access to information to all EU institutions, including the agency, and it stipulates that the widest possible access should be granted, that exceptions should be interpreted strictly, and that justification must be provided. The agency gave four main reasons for refusing: the TRIPS agreement, the disproportionate effort required to prepare and release documents for publication and disclosure, data protection issues, and commercial interest prevailing unless outweighed by public interest. It was unable to show convincingly that the first three were valid and failed to establish a specific commercial interest that disclosure of the data concerned would undermine, so it agreed to grant access to the documentation. Some of the companies involved took legal action against the agency.
Open access to clinical trial data had been much discussed, and it came to the forefront with the publication of Ben Goldacre's Bad Pharma. In response to an increasing number of formal complaints about restrictive practices in publicising clinical data, the agency started an initiative to make patient-level study data accessible, and in November 2012 it held a workshop to bring the stakeholders together to discuss and establish the way forward.
The stakeholder workshop of November 2012
The agency stated at the start of the workshop that it was committed to making patient-level clinical trial data publicly available following the decision on marketing authorisation, whether that decision was positive or negative, with the goal of increasing transparency and thus confidence in the system for approving new medicines in Europe. The workshop's aim was a dialogue among representatives of health agencies, data protection institutions, the pharmaceutical industry, academia, the press, physicians, patient groups and other stakeholders on how public access to clinical trial data could be implemented.
The workshop made clear that there is considerable discrepancy between how academic research institutions, the press and the pharmaceutical industry perceive the evaluation of the clinical trial data used in the marketing-authorisation process. To one observer, the meeting, although set up as a workshop, resembled a public hearing in some aspects: panel members from academia (Peter Gøtzsche) and the press (Virginia Barbour and Ben Goldacre) presented the prosecution case that industry withholds and manipulates clinical data in order to coerce the regulators into approving new medicines, industry representatives filled the role of defendants, and a patient representative acted as expert witness.
The panel's positions were these:
- Re-analysis by anyone. Peter Gøtzsche, director of the Nordic Cochrane Centre and a cofounder of the Cochrane Collaboration, held that because the pharmaceutical industry acts as judge of its own trial data, the data analysis is biased, and that both results and raw data should be available to everyone for re-analysis. Even where access to documents held by the agency was granted, they were not available in electronic, searchable form. As the data are provided freely by patients, they belong to everyone, and industry must be obliged to provide access so that others can easily re-evaluate them. He held that the third biggest cause of death in the USA is the harmful effects of drugs, partly because inadequate data analysis leaves the harms many drugs can cause unknown. He demanded open access to clinical data for everybody and publication of the data on a public website.
- Case-by-case release with the sponsor's interest protected. Industry was represented by two members of the European Federation of Pharmaceutical Industries and Associations (EFPIA): Susan Forda, chair of its Scientific, Regulatory Manufacturing Policy Committee, and Neil Wier, a member of its Research Directors Group and senior vice president of discovery at UCB Pharma. Wier pointed out that the industry was looking to develop personalised medicines, so future trials would include patients' genetic information and increase data confidentiality issues. He added that new products must yield an appropriate commercial return on investment. Susan Forda agreed that public access to clinical data is important but held that it should be handled case by case, with consideration of intellectual property rights and personal data. She was not in favour of making data available for products whose applications are withdrawn or whose development is cancelled. In her view an appropriate and balanced approach to data access is required to protect the legitimate interest of the trial sponsors.
- Every request met, and the protocols published. Ben Goldacre held that public engagement in clinical research can only be positive and that having many eyes assess the safety and efficacy of medicines would be beneficial. He called for industry to meet all requests to release clinical trial data, with the data publicly available to academia and competitors alike and a public record of all such requests. He cited a UK general practitioners' research database that gives doctors access to the full health records of 3 million patients as a valuable tool for physicians. He did not see patient data protection as an insurmountable hurdle. He called for full details of study protocols to be publicly posted, as current trial registries do not carry enough detail. He pointed out that not all studies on medicines are posted on the clinical trial databases, and in his view all trials for all drugs should be made public.
- Reproducibility as the standard. Virginia Barbour, chief editor of PLoS Medicine, held that clinical research data should be published to ensure that it is reliable and reproducible, that suppression of research results should be combatted, and that technology should be used to enable transparency. Subject data supporting a successful marketing-authorisation application should be made public when the authorisation is granted, and in the longer term data from unsuccessful applications should be too. To enable reproducibility, the data and the analysis must be available in a way that lets others reassess the data, stored in a readily accessible format with datasets and links to the specific protocols. Anonymisation standards are required to protect the personal data of trial participants. She also held that funding and incentives are required to enable data access, which could be in a separate repository or an independent web portal.
- Controlled access, from the patients' side. François Houÿez, representing patient organisations, described his experience of collaboration between patient groups and the agency as very open and positive. He thought that the FDA's hearings are a good model for transparency in decision-making on drug approval and that something similar might be worth considering in Europe. He perceived that some patients may be willing to forgo data privacy rules if it can benefit future generations, as for rare diseases in children, but that patients are greatly concerned about access to individual data in areas such as transmittable diseases or conditions with social stigma, as for HIV. He did not support data access for everyone, because uncontrolled re-analysis can lead to confusion and undue concern, citing research on genetically modified organisms, where contradictory evaluation of the data resulted in less rather than more transparency about the real risks. He proposed that third parties wishing to access data be required to state the purpose and need for access, describe the analytical methods to be used, demonstrate the expertise to perform them and ensure the data will be adequately protected, and that the results of a re-analysis be disclosed to the agency before being made public. If clinical data are to be shared with any third parties, in his view the informed consent form must clearly say so.
Giovanni Buttarelli, the Assistant European Data Protection Supervisor, held that data protection is not incompatible with full transparency but that the fundamental rights of patients must be respected. The intention was to allow interested parties access to full data sets, but what the notion of public interest covers in this context had to be determined, and as a general rule sensitive data on individual patients may not be published. If access is restricted to selected groups or individuals through a platform, it is critical to identify who has access and when, who controls access and with what competency, including whether the agency should be the only body competent to decide on access.
The risk of bad analysis
The only consensus on the panel came when the chairman, Mark Walport, asked whether there is a risk of bad analysis of data: all agreed that there is. Gøtzsche found the argument about bad analysis a bit amusing, as the situation cannot be worse than one in which the only people who have seen all the data work for the company that will earn a lot of money from the products. Wier responded that clinical experts are almost always involved in evaluating the data; Gøtzsche denied it, holding that clinical investigators are never allowed to see all the data and are turned down every time they ask for the raw data.
Who should have access, and on what terms
Asked what is in the public interest as far as disclosure of clinical data is concerned, Houÿez sympathised with groups wanting to see the patient data but saw an ethical problem in not knowing who has access to it. In his view patients would feel safer if those doing the secondary analysis or looking at the data are clearly identified, have the skills and come with a method to analyse the data, and he suggested that an independent body could review each request and decide whether to grant access. Barbour replied that flaws in patient consent forms cause problems with access to data, which correct wording in the form can avoid. She did not agree that who can access the data should be pre-specified, holding that it is much better to have many eyes on data than few.
Goldacre held that patients' trust in the trial sponsor is often misplaced, since the main analyses conducted by the trialists themselves are often flawed. He remarked that people very commonly switch their primary outcome between protocol and analysis without adequately declaring it, and the results of clinical trials are often not disclosed to doctors and patients. He pointed out that requiring patients to consent prospectively to sharing would prevent access to data from trials already conducted and delay transparency by at least five years. In his view the problem of bad analysis is best solved by requiring fully published protocols and analytic strategies from everybody before they start. On peer review of secondary analyses, he did not think journals the best place to publish clinical trials, but held that a secondary analysis should be regarded as evaluable only if its analysis plan is published beforehand.
Limiting harm from flawed or misread analyses
Asked how to minimise the potential harm to a population from published data that is wrong or misinterpreted, Gøtzsche held that primary publications are by and large pretty unreliable and have cost the lives of hundreds of thousands of people, and that much more openness is needed. Forda suggested that a Good Practice of Analysis be implemented, along with a public forum in which an analysis plan can be published and reviewed by others before the analysis is conducted, as this would help to minimise harm. She recommended that third parties who want to run analyses approach the companies directly for data and publicly post the request. She agreed that the data can in principle be made available but warned that inappropriate analysis could lead to media scare stories that lead doctors to stop prescribing beneficial products, as in the measles, mumps and rubella vaccine scare. Additional analyses, in her view, should be prospectively defined and reviewed, with people given an opportunity to comment.
Goldacre held that there is an ongoing reality of bad-quality analyses by industry and academics of their own data, and that fixing it requires public posting of protocols and public sharing of data so that everybody can cross-check everybody else's work, with primary and secondary analyses both conducted as transparently and properly as possible. In Barbour's view, by sharing data and analyses people do much smarter things than the original investigators ever thought of, which she called the democratisation of data she wants to see.
When Houÿez's organisation wishes to re-analyse data, it approaches the person conducting the study and confronts them before going public, and he thought this a model that could be applied. He noted that public hearings the agency planned on the safety and therapeutic benefits of products would provide a public arena in which different results could be confronted.
Houÿez noted the risks of confusion among the public, of miscommunication and of disclosing information that can identify patients, and held that which data sets can be made public should be discussed case by case. Once privacy is breached, in his view, the information cannot be recalled and any harm done is done. Walport agreed that any data released must maximise the privacy of the trial participants. Buttarelli noted that a new EU data protection package would keep the current definition of personal data.
How the data could be released in practice
Gøtzsche could see no immense practical problems with making data available and was not in favour of requiring a declaration of the purpose of a re-analysis.
Goldacre repeated that misleading analyses by industry of its own trials are already a serious, existing problem that needs to be addressed. At worst he would be happy with a two-tier system, in which the public can access the data held by the agency and newer data can be requested from the company. Everybody's requests and all rejections, in his view, should be posted in public immediately.
Barbour suggested that drug companies need incentives to provide data access, and emphasised that the data must be available in an open-access format readable by automated systems, or not much is gained.
Houÿez noted that additional experts can already be invited to the agency's meetings when applications are reviewed, which could be an opportunity to invite external parties to review the data as well.
Wier held that who bears the cost of making data publicly accessible must be considered, as translating data into searchable form is neither trivial work nor a trivial cost.
What the agency committed to
Concluding the workshop, the agency invited stakeholders to collaborate with it on policies in five areas: protecting patient confidentiality, clinical-trial data formats, rules of engagement, good analysis practice, and legal aspects. It committed to publishing a draft policy on data access for public consultation by 30 June 2013 and to implementing the final version by January 2014.
What the draft proposed
On 24 June 2013 the agency issued its draft policy on the publication of clinical trial data for consultation, after lengthy interaction with different stakeholders, as part of a drive towards greater transparency. The draft, POLICY/0070 (EMA/240810/2013), provided for publishing large parts of the clinical study reports in a common technical document submission, with the accompanying summary documents and overview.
Under the draft, the agency would commit to proactively publish on its website, as of March 2014, modules of the common technical document in a submission, with the individual clinical study reports in module 5, whether or not approval had been granted. Certain parts, such as the module on biopharmaceutics, were regarded as containing commercially confidential information and would not be made available. Other parts, mainly the patient-level data, would be under controlled access, with the agency as gatekeeper following procedures and criteria for release that were as yet poorly defined. The draft complemented the agency's existing policy on access to documents, POLICY/0043 (EMA/110196/2006).
Under the draft, anyone wishing to have access to patient-level data was to agree to a legally binding data-sharing agreement. The agreement was designed to ensure that the intended use is in the interests of public health and in line with the spirit of informed consent, and the requester had to explain in detail what the data would be used for, such as a meta-analysis. The requester would also have to agree not to try to identify patients by linking to other databases or programs, such as hospital discharge records, which might enable identification of patients in serious-adverse-event listings. The draft stated that the data would be appropriately de-identified, in a similar way to the recommendations for publishing raw clinical data in journals.
Under the draft, data on investigators and other trial staff were to be fully available: names, addresses, appointments, qualifications and clinical duties.
Objections to the draft
The draft caused quite a stir. One regulatory writer expected its varied stakeholders, such as pharmaceutical companies and patients, to hold different opinions on it. EFPIA, a major representative of the pharmaceutical industry, was particularly critical and set out its opposition to many of the draft's details. Its three main worries were that the policy might not fully safeguard patient confidentiality, that it might undermine trust in the regulatory approval system and so discourage investment, and that commercial secrets might be disclosed, with the ensuing disincentive to fund innovative research.
Patient and investigator privacy
EFPIA questioned whether the draft's de-identification would be sufficient given rapid advances in re-identification technology. It would prefer more control over how and what is released, with the requester referred to the company and the agency as interlocutor, and it suggested that it should not be possible to download the data. It also considered the legal basis for making investigators' and trial staff's data available dubious, and cited a number of EU regulations in support.
The regulatory writer held that the vetting system the agency proposed made it hard to determine how likely it was that the anonymity of patient data, collected under an informed consent that guaranteed patients' privacy, would be broken and the data re-used for purposes other than improving public health. Many of the legitimate uses for such data, the writer observed, would be meta-analyses or re-analyses, which would be extremely tedious if the data could not be downloaded. The writer hoped that "address" in the draft meant business addresses rather than home addresses, which may appear on CVs in the appendices of a clinical study report. One worry, the writer supposed, was that some investigators and patients would be less inclined to take part in a study if they knew that their personal information might be compromised.
Trust in the approval system
Whether the draft would undermine trust in the regulatory approval system would, in the same writer's view, probably be answered very differently inside and outside the pharmaceutical industry. In the eyes of the general public, the writer held, the credibility of the system had taken plenty of hits, and books such as Bad Pharma had generated plenty of discussion. Under the proposal, sceptics would be able to see the data on which an approval or rejection is based and judge whether decisions are consistent across applications and appropriate. The writer called this a utopian vision that could generate greater trust in the system, provided that appropriate decisions are being made. A potential danger, though, was that the data may be used to generate flawed analyses that cause undue public alarm. The writer asked whether companies funding investigators to trash competitors' programmes would be such a far-fetched scenario, and held that how this would play out was hard to predict.
Investment and innovation
Pharmaceutical companies are very used to confidential dealings with the health authorities, and in the writer's view the thought of much of their submission dossier being readily perused by anyone must be disquieting and the ready availability of such information could be a disincentive for investment. Although EFPIA did not say so explicitly, one worry, the writer held, must be that releasing the information would benefit generics companies over innovators. In the writer's view, having to interact with the agency to procure information under its existing access-to-documents policy differs greatly from having much of it freely available on the internet, as the proposal provided. With the information more readily accessible, individual investigators and small start-ups might also use it as a stimulus to launch truly innovative projects that attract investment, so the overall effect on innovation was hard to predict.
The balance of benefits and risks
The same writer welcomed greater transparency but held that inappropriate analyses of the data causing unwarranted public alarm, and identification of anonymised information, remained major concerns. While the policy was still a draft, the writer concluded that it was impossible to know how far the final form would differ, that as it stood the policy might improve access to data for legitimate purposes but also carried risks of inappropriate use, and that the revised policy might well alleviate some of these concerns. The writer added that once the policy was in effect the agency would be advised to be on stand-by for rapid action in case the law of unintended consequences applied.
The public consultation
The public consultation on the draft ran from June to the end of September 2013 and drew more than 1,000 comments. It generated input from what the agency called an unprecedented range of stakeholders: patients, healthcare professionals, pharmaceutical industry representatives, researchers, transparency campaigners, academic and public institutions, health technology assessment bodies and others. Many contributors provided detailed in-depth comments, some substantial and some technical, including suggestions on methodological and technical aspects of implementing the policy. On 13 November 2013 the agency was devoting attention to every comment received, as part of its collaborative approach to developing a methodology for releasing clinical trial data with its stakeholders, and it reaffirmed its commitment to transparency and to the principles of publication of and access to clinical trial data. To conduct the in-depth analysis required, it said it would spend additional time reviewing the comments, which might delay finalising the policy, initially planned for the end of 2013. It undertook to give an update on timelines at the latest following its Management Board meeting of 11–12 December 2013.
The agency held that its draft had prompted broad debate among an unprecedented range of stakeholders, with an important focus on the benefits to patients and to society of giving access to clinical trial data and on the best approach to achieve it. It also held that the draft had been the catalyst for various initiatives in the same direction from the pharmaceutical industry, funding bodies and academic centres.
The principles agreed before adoption
Having reviewed all the comments, the agency reported that they showed large support for its plans to allow access to clinical trial data submitted as part of marketing authorisation applications, and that they also showed a need for further analysis and clarification of certain aspects. It undertook to continue working with stakeholders, including industry, academia and civil society organisations, to clarify and fine-tune the proposed rules and achieve the broadest possible consensus. That work was to be guided by a set of key principles agreed with the agency's Management Board on 12 December 2013, and the policy and an implementation plan were to be discussed at the Board's March 2014 meeting.
The key principles included a stepwise approach to implementation, whose first step was preparing for the publication of clinical study reports redacted as appropriate, developing a methodology for de-identifying patients, and defining a standard format for submitting data. The principles also foresaw preliminary steps before data access, designed to address the risk of possible unfair commercial use of the data while ensuring proactive and non-selective access: "use control", not "access control".
The agency reiterated its firm commitment to the objective of full transparency regarding clinical trial data. It stated that it pursued publication of and access to clinical trial data because it believes that the release of data is about establishing trust and confidence in the system. It also holds firmly that wider availability of data broadens the scientific knowledge base, fosters innovation, encourages investment in the development of medicines and ultimately benefits public health.
It undertook to monitor progress in the court cases brought against it by two pharmaceutical companies and the ongoing discussions on the new European clinical trials legislation. It recognised the need for consistency in the general approach to access to documents by EU institutions and bodies, while recognising the specificity of the documents in its possession and its primary duty to protect and foster public health.
The targeted consultation and the Board's agreement
After the consultation of June to September 2013, the agency carried out a second, targeted round of consultation in May 2014, which showed broad support for the policy but highlighted concerns over the proposed view-on-screen-only access. The agency stated that it had aimed throughout to achieve the broadest possible consensus among its stakeholders and their often competing views and interests.
On 12 June 2014 the agency's Management Board agreed the policy on the publication of clinical trial data, together with more user-friendly amendments proposed by Executive Director Guido Rasi. The agreed policy would not only allow the agency to proactively publish clinical trial data submitted as part of marketing authorisation applications but also make it possible to download, save and print the data for academic and non-commercial research purposes. The wording, including practical arrangements for academic and non-commercial research users, was then to be finalised for adoption by the Board through written procedure by mid-July 2014, and the policy was to be effective from 1 October 2014. The agency undertook that the policy would not prejudice citizens' rights under the existing access-to-documents legislation, Regulation (EC) No 1049/2001, and the new clinical trial Regulation (EC) No 536/2014. The agency described the policy as an important step towards increased transparency in the regulation of medicines in Europe, one that takes it beyond its legal obligations and provides an unprecedented level of access to the clinical trial data used in decision-making on new medicines.
The postponement of formal adoption
On 9 July 2014 the Board postponed formal adoption of the policy to its meeting of 2 October 2014. Further to the agreement reached with the European Commission under Article 80 of Regulation (EC) No 726/2004, the Board had not been able to conclude on the final wording through a written procedure. Board members confirmed their general support for the overall aims and objectives of the policy, including Rasi's amendments allowing data to be downloaded, saved or printed for academic and non-commercial research, and offered additional contributions to be considered and addressed in the following weeks, with a view to reaching final agreement at the October meeting. Further clarifications on wording and practical arrangements were to be discussed.
The agency welcomed this additional round of joint reflection and said it respected all opinions, including the views of several Member States, which it stated largely reproduced the complexity of the political and technical debate that had emerged during the earlier general and targeted consultations. It added that over the previous 12 months it had attempted to strike a balance between proactive data disclosure, the absolute need to protect personal data, and concerns about protecting commercially confidential information. The agency's management remained committed to introducing the measure as soon as possible, to enhance citizens' awareness of and confidence in the EU authorisation system for medicinal products. It held that any delay prevented citizens, and academics and non-commercial researchers in particular, from enjoying the benefits of proactive publication for a further period. It undertook to continue working with the Board and the European Commission ahead of the 2 October meeting, so that members received the clarifications they had requested and adoption of the policy was facilitated.
Entry into force
The policy on publication of clinical data for medicinal products for human use entered into force on 1 January 2015. It applied to the clinical reports in all marketing-authorisation applications submitted on or after that date. By mandating stepwise disclosure of the clinical data submitted under the centralised marketing authorisation procedure, it would strengthen the trend towards public disclosure in the EU. The first reports were to be published as soon as a decision on the application had been taken, which as of June 2015 was foreseen for mid-2016.
The implementation guidance
On 24 June 2015 the agency held a webinar on implementing the policy, and on 29 June it published the video recording and the slides of all the presentations. To help stakeholders anticipate the requirements and prepare for publication, the agency explained the work processes it foresaw. The webinar covered the principles for submitting redacted clinical reports, the redaction consultation process, and guidance on redacting commercially confidential information in clinical reports and on anonymising clinical reports for publication. Participants were able to comment interactively and share their views. A face-to-face meeting was to follow at the agency on 6 July 2015 for more detailed discussion of the draft guidance on anonymisation and on redacting commercially confidential information, and stakeholder organisations were asked to nominate experts. The guidance was expected to be finalised and published after the summer.
On 3 March 2016 the agency published detailed guidance for pharmaceutical companies on the requirements to comply with the policy, finalised after an extensive consultation with all stakeholders concerned throughout 2015. By then the first reports were foreseen to be publicly available in September 2016. The guidance consists of four chapters:
- The first is an overarching introduction with the scope and the definitions used throughout the text.
- The second details the procedural aspects of submitting clinical reports, including the concrete processes.
- The third gives guidance on anonymising clinical reports for publication. Because a number of methods are available to present the data in a form that does not allow participants to be re-identified, it singles out no one method and instead recommends how best to balance data utility for researchers with a minimal risk of re-identification. Companies must provide a report explaining their approach to anonymisation, which the agency reviews and publishes.
- The fourth covers the identification and redaction of commercially confidential information in clinical reports submitted for publication. It makes clear that the vast majority of the information in clinical reports is not considered commercially confidential. In the limited circumstances in which a report might contain such information, the company must submit for review a table justifying why the data were redacted, and the guidance clarifies which types of data the agency would typically refuse as commercially confidential and how their redaction is handled.
The agency was also to start reaching out to the companies concerned by the first wave of publication, those whose decision-making process had been finalised since the policy entered into force. It was to organise a webinar in the second quarter of 2016 for companies' outstanding practical questions, broadcast live and kept available on its website.