Personal Data in European Medicine Regulation

Text sign showing Industry News. Business photo text delivering news to the general public or a target public | Image Credit: © Artur - © Artur - stock.adobe.com

The European Medicines Agency (EMA) announced on Dec. 18, 2024 that the agency, along with the Heads of Medicines Agencies (HMA) have revised their guidance on identification of commercially confidential information (CCI) and personal data used in marketing authorization applications as part of their commitment to transparency in the disclosure of information in response to access-to-document requests and the publication of data for authorized medicines.

The original 2012 guidance document offered, for the first time, a common approach for European regulators to use in order to identify parts of an application dossier that can or cannot be released publicly. EMA and national competent authorities have gained experience since then in the handling of access-to-documents requests and have applied more transparency when data is released. Therefore, EMA stated in a press release that it was necessary to review the 2012 guidance to align with current day-to-day practices and harmonize those practices across authorities. The revised guidance also applies to EMA’s 2014 proactive clinical data publication.

“As a general rule, the overwhelming majority of data in marketing-authorization applications is not considered CCI,” EMA stated in the press release (1). “The exceptions mainly relate to information about the manufacturing of a medicine, as well as information about facilities or equipment and some contractual arrangements between companies. While considered CCI at the time of the initial guidance, general information related to quality is now mostly considered releasable.”

The revised guidance considers information as “releasable by default” instead of applying a yes or no rule to an entire section of a dossier when determining which data can be released. Detailed practical orientations are provided for specific points that may be redacted or made anonymous within each section of the dossier. The guidance’s annex has also been updated to include examples of information that may be considered CCI or protected personal data.

How personal data are to be protected when it might lead to identification of a person is also detailed in the guidance. The revised guidance considers recent data protection legislation in the European Union, including the EU General Data Protection Regulation and Data Protection Regulation for the European Union. Identifying personal data of experts, staff, or patients that should be made anonymous is also addressed in the guidance.

The revised guidance went through public consultation in 2024 and report of the analysis from that consultation will be published in 2025.

The EU has been proactive over the past several years regarding data protection. In September 2024, EMA and HMA published recommendations for staff in the European Medicines Regulatory Networks about the use of generative artificial intelligence in large language models (LLMs), stating it could create potential data security risks (2). These guidelines are part of the HMA/EMA Multi-annual AI Workplan 2023–2028, published in December 2023, to be a guide for the use of AI in managing risk and maximizing benefits of AI.

References

1. EMA. A Common EU Approach to Data Transparency in Medicine Regulation. Press Release. Dec. 18, 2024.
2. Barton, C. Responding to the Increased Use of Generative AI. Pharmaceutical Technology Europe 2024 (9). https://www.pharmtech.com/view/responding-to-the-increased-use-of-generative-ai