1. Operations Director, CTRU
Practical steps to protect participant trust when releasing data from clinical trials
Gillian Booth
Operations Director, CTRU
University of Leeds

2. A bit like a tightrope walk – balancing the risks and benefits
As with most areas of clinical research this is about considering any risks, how likely they are to occur and their impact if they do occur and what mitigation can be put in place
As early as possible (trial set up) think about future proofing use of data for further research e.g. consent, contractual terms clear for ownership and future use / exploitation of IP
The following slides describe the CTRU approach

3. What is the Purpose?
Is the evidence of scientific integrity satisfactory?
Is there potential for the data to be misused?
Where will the data be held and who will take legal responsibility?
Through asking questions such as:
The purpose of the research, what data is required and what it will be used for
Who is requesting the data and where are they employed
Where is the data being sent and where will it be stored?
Evidence of scientific integrity:
- Is this bone fide research and is the researcher a bone fide researcher?
Data variables sufficient to allow the research project to achieve it’s goals
Funding in place
Ethical approval / peer review needed and if so, in place?
Exacting the same standards to which we would be expected to work

4. Do you have Permission? What is the legal basis for the data release?
What are the governance procedures?
Are there any other restrictions?

5. Medical Confidentiality
Comply with the Law
Protection of Rights and Wellbeing of the Individual
EU Clinical Trials Directive
NHS Act 2006
Consent
Data collected under a duty of medical confidentiality. You must be clear on the legal basis for the transfer (either appropriate consent to release the data for the purpose Or Section 251 approval)
Consent is needed even where data is anonymized
Best to consider this up front and include in the original consent form. Will require tracking throughout the lifetime of the trial (incase the consent position changes) and also after the trial (this is a key feature of the new DPR)
Medical Confidentiality

6. Implement Governance Processes
Will the data release affect the scientific integrity of the trial?
During trial – requests are considered by the Independent Trial Steering Committee
After trial – processes for approval differ across organisations e.g.:
Independent Data Release Committee
Independent Trial Committee (e.g. TSC)
Chief Investigator, CTU and Sponsor
Note - Some funders have specific requirements regarding the governance process for release of data for secondary research purposes e.g. MRC this needs to be considered for individual trials if the unit policy does not standardly comply

7. Other Restrictions Who owns the IP?
Are there specific contractual considerations or restrictions?
What is the ‘value’ of the dataset? (Research sensitivity and commercial sensitivity)

8. Protecting the Participant’s Identity
Is the data identifiable?
Will the data be combined with other datasets and how does this affect the chance of re-identification?
Where is the data being sent?
What are the security arrangements?
In the UK the 1998 DPA applies – there are different legal considerations across the world.
Essentially the risk is ‘identification of a individual participant’ – all measures should be put in place to minimise the risk to an acceptable level.
In the UK where data is identifiable it is covered by the DPA1998. This places specific restrictions on use of the data including where it can be sent i.e. abroad.
Where is it being sent – if outside of EEA must be anonymized unless certain protections in place through contracts
Who (organization) will take legal responsibility for the data once transferred including security
Security Who (organization) will take legal responsibility for the data once transferred including security. Examples include:
Only contract with legal entity
Contractual restrictions not to try reidentify or contact the participants
Only use for agreed purposes and destroy when project complete
Storage under password protected / restricted access systems
Not to transfer over the web or e.g. use SFTS