Considerations For Compliance With CTIS Submissions Under The EU-CTR

By Michael Halaiko and Alexandra Moylan

Effective Jan. 31, 2023, all new applications for clinical trials within the European Economic Area (EEA) must be submitted through a central web-based portal called the Clinical Trial Information System (CTIS), in accordance with the EU’s Clinical Trial Regulation (EU-CTR) under Regulation No. 536/20141. CTIS was developed and implemented to serve the dual purpose of 1) simplifying the clinical trial application process and submission of clinical trial data and results within the EEA (which consists of EU member states, plus Iceland, Norway, and Liechtenstein), and 2) furthering the EUCTR’s goal of public transparency and data availability regarding clinical trials.

The implementation of CTIS presents potential advantages and challenges for sponsors of clinical trials within the EEA. Having a single access point for submissions regarding clinical trials performed in the EEA should generally prove beneficial for sponsors. However, the level of transparency of the information submitted through CTIS is new under EU-CTR, requiring sponsors to develop and refine an internal framework to ensure compliance with the allowed redaction of commercially confidential information (CCI) and the mandatory redaction of protected personal data (PPD) in CTIS submissions.

A Streamlined Process For Clinical Trial Submissions

The key goals of CTIS include harmonizing and streamlining the clinical trial submission process within the EEA, fostering innovation within the EU, and increasing the number of studies conducted in member states. The EU-CTR has slightly expanded the information that a sponsor must report beyond that which was required under the EU Clinical Trial Directive (EU-CTD). For example, sponsors must now provide notice of the start and conclusion of the trial in all jurisdictions and a summary of the clinical trial results in a form that is understandable to laypeople. However, for the most part, much of the same information must be submitted under the EU-CTR as was previously required under the EU-CTD.

CTIS streamlines submission of clinical trial applications and reporting by creating a single submission portal, rather than requiring sponsors to submit the required information to multiple regulatory authorities in different jurisdictions. Under the EU-CTR, applications and reporting obligations for multistate studies will now be led by a single reporting member state throughout the clinical trial’s life cycle. While using CTIS will require training individuals on a different process for submissions within the EU, the impact of the streamlined processes for conducting and reporting on clinical studies in the EU should generally be beneficial to sponsors.

Challenges Related To Increased Transparency

Under the new EU-CTR transparency goal, information and data submitted to CTIS will be made available to the public with exceptions only for PPD and CCI. This is a significant, material difference between the former EU-CTD and the EU-CTR. The EU-CTD treated most clinical trial related information and documents as confidential, except for information that was required to be posted on EU’s Clinical Trial Register. In contrast, the EU-CTR treats all clinical trial related documents and information as public information. Once a decision on the trial is made by the reporting member state, regardless of whether that decision is favorable, the CTIS information is made publicly available unless the sponsor has received a deferral under the EU-CTR. Under certain circumstances, a sponsor may request a deferral, which will delay, but not prevent, the publication of certain data and documents, such as protocol, investigator brochure, and informed consent form. (According to draft guidance from the EMA, the availability of a deferral will depend on the “trial phase and clinical development of the medicinal product(s) being tested.”)

This different treatment of clinical trial information and data presents new challenges for sponsors to navigate. Sponsors must now identify and redact PPD and CCI from the publicly available version of CTIS submissions. The failure to properly redact PPD could result in fines under the EU’s General Data Protection Regulation (GDPR) or private actions by individuals whose data was disclosed. The failure to properly redact CCI could result in public disclosure of confidential and proprietary company information and cause the loss of a strategic business advantage.

While the European Medicines Agency (EMA) has published several reference guidelines regarding PPD and CCI, there remains much uncertainty, especially with respect to CCI, regarding how sponsors should approach redactions and how regulators will review such redactions.

Protected Personal Data: PPD redactions are more straightforward than CCI redactions and, therefore, are likely less of an issue for sponsors. Redaction of PPD from the publicly available version of CTIS submissions should be guided by GDPR.

Using GDPR’s definition of “personal data,” any information relating to an identified or identifiable natural person should be redacted by a sponsor as PPD, with few exceptions. This is not limited to direct identifiers that might be obvious, such as a first name, surname, signature, and state-issued identification number. PPD also includes indirect identifiers that, when combined with other information, could identify a natural person. Examples of indirect identifiers include gender, email addresses, and professional titles.

Additionally, there are “special categories” of personal data that the GDPR places emphasis on such as medical information, race, ethnicity, and religion. At a minimum, medical information of study subjects will likely be implicated in most clinical trials, and care must be taken to ensure that this information is redacted. Moreover, even pseudonymized medical data collected during a trial is considered PPD and must be redacted by the sponsor.

If there exists a “key” that connects the pseudonymized data to an individual, regardless of how well-protected that key may be, it is still considered “personal data” under GDPR. Data that can no longer be connected to a natural person is called “anonymized data.” Anonymized data are not “personal data” under GDPR and would not require redaction under EU-CTR before submission to CTIS.

Lastly, the redaction of personal data is not limited to trial participants. Information that may identify employees of sponsors, CROs, or the clinical site must also be redacted. According to the EMA’s draft guidance, currently, the only exception to this rule is for the names and professional contact information of the principal investigator, the sponsor’s legal representative, and the head of the clinical site where the study is being performed.

Commercial Confidential Information: Understanding what information can be permissibly redacted as CCI is much less clear than PPD redactions. The EMA’s guidance materials generally focus on identification of information that is not CCI, rather than helping sponsors understand and identify information that qualifies as CCI.

The threshold test for CCI is whether the information is already in the public domain. Information that is publicly available cannot qualify as CCI. For example, information that exists on a website, in a publication, or is simply general knowledge in the scientific community is not CCI. Thus, in flagging certain information for potential CCI redaction, sponsors should first determine whether the information is published on their websites, has been made available in prior study publications, and/or constitutes general scientific knowledge for a particular therapeutic compound or in a particular therapeutic area. (EMA publications provide a more substantial list of information that is not CCI.)

If the information flagged as potential CCI is not publicly available, then the sponsor must assess whether the information, if disclosed, may undermine the legitimate economic interest or competitive position of the sponsor. Although the EMA’s draft guidance lists potential examples of CCI, it warns that sponsors “should not consider by default such types of information as being CCI.”

The examples included in the guidance are:

• the names of manufacturers or suppliers of the active substance or the excipients
• the excipient’s quantitative composition of the investigational/authorized product
• detailed information on the synthesis or manufacture of the active substance
• detailed descriptions of the manufacturing and control processes for the investigational/ authorized final product
• information related to future development plans for indications other than the one under investigation and not yet disclosed in the public domain
• new biomarkers or novel methodologies not yet qualified and not in the public domain
• detailed information concerning innovative analytical methods
• detailed information on the facilities and equipment available at the sponsors and clinical sites.

Apart from these few delineated examples of potential CCI, and examples of what should not be redacted as CCI within the draft guidance and other EMA publications, sponsors are left without much guidance for determining whether information can be appropriately redacted as CCI.

Implementing A Plan For Addressing PPD And CCI

Sponsors should develop and implement a framework for transitioning from the EU-CTD to the EU-CTR CTIS submission process to ensure that all PPD and CCI are appropriately redacted. This should include support from legal and in-house SMEs. It is also important to include sufficient training for employees who are navigating CTIS and leading CTIS submissions.

As noted, redaction of PPD is straightforward, but no less important as it could expose the sponsor to liability. GDPR should guide the sponsor’s redaction of PPD.

Redaction of potential CCI, however, presents a challenge for sponsors. Sponsors should develop a system for flagging potential CCI. They should also identify key in-house SMEs who can assist legal personnel in assessing flagged information for CCI redaction. Additionally, sponsors should strive for uniformity in evaluating CCI for redaction for submissions within a study and for submissions from study to study. This makes consistency among the SMEs and legal personnel performing the assessment critical.

Once it is confirmed that the potential CCI is not publicly available, the SMEs and legal personnel should together undertake an exercise of assessing whether they can reasonably define how the information is new or innovative and how its disclosure would undermine the economic interests or competitive position of the sponsor.

There is limited guidance on what constitutes CCI. Similarly, how regulators will respond to the redaction of information outside of the limited categories listed in the draft guidance remains unknown. Accordingly, sponsors should assess whether the benefit of protecting a particular piece of information from disclosure is greater than the potential risk of having the trial application delayed if regulators disagree with the redaction decision.

Finally, where a sponsor determines that it needs to redact information as CCI, its redactions should be targeted to only the specific words or numbers necessary to protect its interests. Redactions of pages, paragraphs, or even entire sentences should be avoided where possible as such redactions are likely to draw the attention of regulators and potentially delay the study.

About the Authors

Michael Halaiko, CIPP/E is a partner at Nelson Mullins’ Baltimore office and leads the firm’s Clinical Trial Team and is a member of the firm’s Healthcare team.

Alexandra Moylan is a partner at Nelson Mullins’ Baltimore office and a member of the firm’s Healthcare and Clinical Trial teams.