Overview on data privacy
- 1. Overview on Data Privacy (Clinical Data Manager’s Perspective) Vinayak Thorat Clinical Data Manager [email protected]
- 2. “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks. - Universal Declaration of Human Rights – Art. 12
- 3. “Everyone has the right to respect for his private and family life, his home and his correspondence. -European Convention for the Protection of Human Rights and Fundamental freedoms
- 4. “The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with applicable regulatory requirement(s). -ICH Guideline for Good Clinical Practice (GCP)
- 5. TOC ▸Introduction ▸Scope of Topic ▸Minimum Standards ▸Best Practices ▸Important Considerations 5
- 6. Introduction Why is Personal Data Protection important? 6
- 7. Introduction Why is Personal Data Protection important? • It is an Universal Human Right • Possible damages to the business and the image of a company • Important financial & individual risks for non- compliance Inability to perform research Important fines Legal consequences • Important risks for the data subjects Identity theft and Fraud Discrimination 7
- 8. • Data privacy refers to the standards surrounding protection of personal data. • Personal data can be defined as any information that can lead to identification, either directly or indirectly, of a research subject; e.g. Subject names, initials, addresses, and genetic information. Important Definitions 8
- 9. What Constitutes Private or Personal Information? According to EU Directive 95/46/EC, Private of personal information means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.” 9
- 10. What Constitutes Private or Personal Information? Per HIPAA: 45 CFR Section 164.501: “Private or Personal Information that is a subset of health information, including demographic information collected from an individual and: • Is created or received by a health care provider, health plan, employer, or health care clearing house; • Relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and That identifies the individual; or With respect to which there is a reasonable basis to believe the information can be used to identify the individual.” 10
- 11. How privacy protection gave to research subjects ? • Protocol review and approval by an Institutional Review Board (IRB) • Right to informed consent • Right of the subject to withdraw consent and have no further data collected • Right to notice of disclosure • Confidential collection and submission of data 11
- 12. Who are responsible? Primarily Site management or clinical monitoring team are responsible for subject data privacy; However, Data Management Personnel should be acquainted with common issues related to data privacy and should follow regulatory and organizational guidelines to ensure the privacy of research subjects. 12
- 13. SCOPE Important Considerations Minimum Requirements Glance on Regulatory Guidelines We will talk about!!! 13 Best Practices
- 14. Minimum Requirements • All personnel involved in handling (directly or indirectly) of Personal identifiable information (PII) must be trained on data privacy concepts & issues; company policy; regulatory agency policy and applicable local, state, federal, and international laws. • Data collection tools should capture minimum PII; e.g. CRF, clinical, laboratory, genetics database, data transfer specifications, ePRO etc. • Documents which are accessible to data management team should not content PII except subject identifier. • Timely review and updates of company privacy policy/ related SOPs. 14
- 15. Best Practices • Educate associated personnel regarding subject data privacy • Develop organization SOP for data privacy • Define internal and external accountability in the company policies • SOP should be present and implemented for data transfer. • All privacy considerations must be addressed and documented. • Setup internally or tie up with quality assurance department to ensure compliance with data privacy regulations. • Maintain proper physical and electronic security measures. e.g.: Storage of Paper CRFs should be stored in regulated access environment; for electronic records password authentication and firewall security must be present. 15
- 16. Legislation and Regulatory Guidance • EU Data Protection Directive 95/46/EC • EU Data Protection Directive 2001/20/EC • General Data Protection Regulation: Regulation (EU) 2016/679 16
- 17. EU Data Protection Directive 95/46/EC- 7 Principles • Notice: Data subjects should be given notice when their data is being collected; • Purpose: Data should only be used for the purpose stated and not for any other purposes; • Consent: Data should not be disclosed without the data subject’s consent; • Security: Collected data should be kept secure from any potential abuses; • Disclosure: Data subjects should be informed as to who is collecting their data; • Access: Data subjects should be allowed to access their data and make corrections to any inaccurate data; and • Accountability: Data subjects should have a method available to them to hold data collectors accountable for not following the above principles 17
- 18. Clinical Trials Directive (Directive 2001/20/EC) • The Clinical Trials Directive is a European Union directive that aimed at facilitating the internal market in medicinal products within the European Union, while at the same time maintaining an appropriate level of protection for public health. • It seeks to simplify and harmonize the administrative provisions governing clinical trials in the European Community, by establishing a clear, transparent procedure. • The Member States of the European Union had adopted and publish by 1 May 2003 the laws, regulations and administrative provisions necessary to comply with this Directive. • The Member States had applied these provisions at the latest with effect from 1 May 2004. 18
- 19. The Articles of the Directive 2001/20/EC • Scope (Directive does not apply to non-interventional trials). • Definitions • Protection of clinical trial subjects • Clinical trials on minors • Clinical trials on incapacitated adults not able to give informed legal • Ethics Committee • Single opinion • Detailed guidance • Commencement of a clinical trial • Conduct of a clinical trial • Exchange of information • Suspension of the trial or infringements • Manufacture and import of investigational medicinal products • Labelling • Verification of compliance of investigational medicinal products with good clinical and manufacturing practice • Notification of adverse events • Notification of serious adverse reactions • Guidance concerning reports • General provisions • Adaptation to scientific and technical progress • Committee procedure • Application • Entry into force • Addressees 19
- 20. General Data Protection Regulation: Regulation (EU) 2016/679 • The General Data Protection Regulation (GDPR) is a regulation by which the European Parliament, the European Council and the European Commission intend to strengthen and unify data protection for individuals within the European Union (EU). • The primary objectives of the GDPR are to give citizens back the control of their personal data and to simplify the regulatory environment for international business. • When the GDPR takes effect it will replace the data protection directive (officially Directive 95/46/EC) from 1995. • The regulation was adopted on 27 April 2016; It enters into application 25 May 2018 after a two-year transition period. 20
- 21. General Data Protection Regulation: Regulation (EU) 2016/679 • The regulation applies if the data controller or processor (organization) or the data subject (person) is based in the EU therefore, regulation also applies to organizations based outside the European Union if they process personal data of EU residents. • Valid consent must be explicit for data collected and purposes data used. Consent for children must be given by child’s parent or custodian, and verifiable. Data controllers must be able to prove "consent" (opt-in) and consent may be withdrawn. • Data Protection Officers are to ensure compliance within organizations. • Any incident related to data breach, is mandatory to notify the Supervisory Authority within 72 hours from the data breach. 21
- 22. Safe Harbor Principles • Notice: Subjects must be informed of how their data will be collected and used. • Choice: Subjects must be able to opt out of collection of their data and its transfer to third parties. • Data transfers: Any transfers of data to third parties must only be to other organizations that have rigorous data-protection policies. • Security: All reasonable efforts must be made to prevent the loss of any data collected. • Data integrity: Data must be reliable and relevant to the purpose for which it was collected. • Access: Subjects must be able to access information about them that is collected, and have an opportunity to have this data corrected or deleted if necessary. • Enforcement: A mechanism must be in place to effectively and consistently enforce these rules. 22
- 23. Clinical data managers should ensure that access to data is restricted to qualified and approved personnel Important Considerations 23
- 24. Central Committees • Reports to and meetings with various committees may necessitate presentation of some study data in the form of reports from database, original or copies of source data. • In any cases, personal subject identifiers should be removed prior to presentation of data to the committee, and in some cases, study identifiers may need to be added. • Independent committee should be present to ensure data anonymity. Important Considerations 24
- 25. Data Collection • Data collection instruments should be designed with subject identifiers which can be anticipated while designing CRF, Clinical database, laboratory database and data transfer specifications etc. • Subject genomic data should be handled with utmost care, which includes, Storage of this data into completely independent data servers and physical locations Independent qualified resources Detailed and Specific SOPs dedicated to the processing and use of this data • Different data collection methodologies may required for different considerations: e.g. for Paper Based Studies: SOPs for redaction of personal identifier, handling, transfer and storage of documents required. Important Considerations 25
- 26. Data Transfers • Data transfer specification document should be produced prior to data transfer. • Data transfer process should be exhaustively tested to ensure transferred information could not jeopardize data privacy. • The planned data transfer should be reviewed to ensure all transferred data matches the database. Computer and Network Security • Any lapses in computer or network security may jeopardize the integrity of the database, and therefore, data privacy. • Organization’s information technology personnel develops SOPs for computer and network security • Data managers have a responsibility to use systems appropriately and responsibly. Important Considerations 26
- 27. Vendor Management & Lab Data Management • Different standards should be present depends upon level of access • Vendors having access to clinical database should be meet international standards. • Vendor facility audit should be conducted to ensure facility compliance & data transfer and reporting specifications should be compliant with respective regulatory guidelines. • Personal identifiers should be redacted & should not contain any subject-specific information prior to submission to data management e.g.: Mr. Mike became unconscious due to hypoglycemia. • If any deviation/violation in privacy policy observed by data management team, it should be addressed to appropriate internal or external clinical site management team for corrective and preventive actions or as per organizations SOPs/Policies. Important Considerations 27
- 28. Redaction (editing before presenting) of Personal Data • Redaction is the act of appropriately editing text from a document before releasing the document to other personnel or departments. E.g.: Mr. Mike became unconscious due to hypoglycemia change it to Subject felt unconscious due to hypoglycemia. • Organizations should have SOPs for redaction of personal data. • Primarily responsibility of redaction of personal data lies to site or monitor, however data managers should be mindful while performing data management activities to identify and rectify the data privacy issues. Important Considerations 28
- 29. Global studies should adhere to the most restrictive regu lation s of th e cou n tries in volved . 29
- 30. References • International Conference on Harmonisation. Harmonised Tripartite Guideline for Good Clinical Practice. 2nd ed. London: Brookwood Medical Publications; 1996. • European Parliament and Council of Europe. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Strasbourg, France: European Parliament and Council of Europe; 1995. Available at: http://ec.europa.eu/justice_home/fsj/privacy/law/index_en.htm. Accessed November 10, 2008. • European Parliament and Council of Europe. Directive 2001/20/EC of the European Parliament and of the Council of 4 April 2001 on the approximation of the laws, regulations and administrative provisions of the Member States relating to the implementation of good clinical practice in the conduct of clinical trials on medicinal products for human use. Strasbourg, France: European Parliament and Council of Europe; 2001. Available at: http://ec.europa.eu/enterprise/pharmaceuticals/eudralex/vol1_en.htm. Accessed November 10, 2008. • Antokol J. Protecting Personal Data in Global Clinical Research. The Monitor.2008:22;57–60. • Code of Federal Regulations, Title 45, Part 164.501, Uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required. Washington DC. US Government Printing Office; 2002. Available at: http://www.access.gpo.gov/nara/cfr/waisidx_02/45cfr164_02.html. Accessed November 10, 2008. 30
- 31. THANK YOU! Visit us on www.ancillarie.com 31 copyright © ancillarie 001- 31JAN2017