CTIS: Questions and Answers on Data Protection

Recommendation

4-6 June 2024
Munich, Germany

Qualified Person Education Course Module A PLUS IMP Pre-Course Session
Understand the Implications of becoming a QP

The European Commission, the EMA and the Heads of Medicines Agency (HMA) prepared a questions and answers document on data protection. The Q&A document has been created to provide guidance to CTIS (Clinical Trial Information System) users on how to protect personal data and commercially confidential information (CCI) in CTIS.

Content

The Q&A document has been produced to address a number of questions related to the transparency aspects of the CTIS which were communicated by sponsors in response to the EU survey on the CTR implementation. It is expected that the Q&As will be updated on a regular basis as soon as new information becomes available. According to the document, the Q&A intends to provide more clarity on main aspects that have been discussed with the Clinical Trials Coordination Group (CTCG) also in relation to the comments received during the public consultation of the draft Guidance on how to approach the protection of personal data (PD) and commercially confidential information (CCI) in documents uploaded and published in the CTIS. The same principles described in this Q&A will be incorporated in the mentioned guidance once finalized.

Personal Data (PD)

• Which CTIS documents require a signature?
  For the documents uploaded in CTIS a signature is expected to be provided for the QP declaration for GMP (Part I) and the Suitability of Sites document (Part II). In addition there may be Member States (MS) requirements for signature according to MS National laws (e.g. Hungary, Portugal, Romania, Slovakia). Further clarification on MS specific requirements for signed documents will be provided, as applicable. 
  
  
• Name and surname of individuals – where are they expected to be included ?
  The name and surname of applicable persons are only required on the following documents:
  • Principal investigator on the CV;
  • Qualified Person (QP) on the QP declaration;
  • The person issuing the site suitability document;
  • Data Safety Monitoring Board (DSMB) composition on the charter or applicable document;
  • Minimum amount of sponsor staff in the protocol
  • GDPR compliance statement to be provided under the CTIS ‘form’ section, in line with the available template

Any signed document and any document containing personal data (e.g., names and surnames, and also contact details) should be provided in the CTIS dossier placeholder ‘not for publication’.

Commercially Confidential Information (CCI)

• May sponsors mark / highlight the text that they consider CCI in documents ‘not for publication’?
  Yes. The sponsor could place red border boxes around the text in the non-redacted document to clearly indicate what they consider as CCI. However, it should be considered that extensive redaction in the document versions ‘for publication’ would go against the spirit of transparency of the CTR. Moreover, the redacted documents have to remain meaningful to the public, including potential trial participants and health care professionals.
  
  
• How will the Member States ensure that CCI is not inadvertently published through MS responses and assessments?
  The CTIS contains multiple safeguards to protect the inadvertent publication of CCI or PD. The system ensures that information classified as quality-related within considerations, RFIs and assessment reports is never published. In addition, MS users are aware of the need for correct categorization of their considerations in the system and that the published documents and structured data should be carefully phrased. The system also automatically excludes certain types of documents from publication for example, draft assessment reports, ASRs, ad hoc assessment forms and related documents. In addition, assessors will be aware of information highlighted as CCI in the document version ‘not for publication’ and take this into account to avoid that such information is not accidentally disclosed in the assessment report.

For more information please see the Questions and answers on the protection of commercially confidential information and personal data while using CTIS published in Clinical Trials Information System: training and support.