International Transfers of Personal Data at sanofi-aventis R & D Pierre-Yves Lastic, PhD Senior Director, Standards Management & Data Privacy Sanofi-aventis R&D CONFERENCE ON INTERNATIONAL TRANSFERS OF PERSONAL DATA Brussels 23-24 October 2006 1
Overview Presentation of sanofi-aventis R&D (SARD) Role and general organization Geographic distribution Types of Data transferred Data in regulatory submissions Data in international R&D projects Human Resources administrative data Enforcement of Personal Data Protection Code of Ethics PDP Organization Standard Methodology & Contracts Awareness & Training 2
3
Sanofi-aventis R&D Project based Research & Development organization Discovery Research is responsible for identifying the most promising research targets for therapeutic innovation and capitalizing on its biological and chemical skills to discover and propose new candidate compounds for development. Development takes the compounds proposed by Discovery Research and turns them into medications. As soon as a compound enters development, a dedicated project team is formed, with members drawn from a variety of functions including researchers, clinicians, pharmacists, toxicologists and representatives from regulatory affairs and marketing. The team's task is to develop the compound all the way to marketing. R & D teams are international and team members are located in over 25 centers on 3 continents 4
5
Clinical Trials A clinical trial (also called clinical study) Is designed to verify the efficacy and safety of a compound for use by human beings. It takes place after in vitro and animal studies (preclinical testing) have proved satisfactory. The compound, also called investigational product, is compared either to a placebo (a substance with no pharmacological activity) or to existing treatments, to determine whether it is more or less effective. The clinical trial determines the effective dose regimen, possible toxicity and the nature and frequency of adverse events it may cause. Clinical trials are a mandatory part of the procedure leading to approval of a drug for marketing Before new treatments can be made available to all potential patients, they must be deemed effective and well tolerated. Clinical trials are used to validate new treatments but also to define the patient categories for which they are most effective. Finally, clinical trials help to gain a better understanding of the characteristics of a disease. 6
How is a clinical trial organised? Pre-Marketing Clinical studies are conducted by physicians or hospital teams and proceed along 3 successive phases: Phase I: At this point, the compound is tested mainly on a limited number of healthy subjects*, who may receive compensation and are under strict medical supervision. The compound is tested over a short period of time. The purpose is to evaluate the product s safety, how it evolves within the body, the tolerance threshold and adverse events. (* Patients are recruited to phase I studies especially in cases such as cancer therapies.) Phase II: Testing involves larger groups of patients. The purpose is to test the product s efficacy and determine optimal dosage regimen. These studies are usually comparative: one of two groups of patients is administered the product whereas the other group is given a placebo. Phase III : Testing involves large number of patients, with the purpose of comparing the therapeutic efficacy of the compound to a reference treatment (if there is one) or to a placebo (when there is no alternative therapy). Such studies involve generally many study centers in several countries. In most cases, neither the patient, nor the medical profession are aware of what each patient is being treated with (double blind trial): this is to avoid any bias or prejudiced opinion on either side regarding efficacy or adverse events. 7
How is a clinical trial organised? Post-Marketing Once these 3 phases have been successfully completed, the resulting data, together with the results of preclinical testing, are collected to compose a registration file that will be submitted to public Health Authorities for license to market. Trials do not cease once the pharmaceutical has been put on sale; they continue throughout its marketing life. Trials called Phase IV, are carried out after approval in conditions close to those of usual medical care Specific targets at this point are to detect possible rare undesirable side effects which had escaped attention in the previous phases (pharmacovigilance) and to define conditions of use for certain groups of at-risk patients. During this phase, drug interactions can be listed and new galenic forms and therapeutic indication extensions can be developed. 8
26 Clinical Research Units (out of 61 Affiliates Medical Departments) 9
Types of Data transferred Data in regulatory submissions Patient Data from Clinical Trials & Pharmacovigilance Data Data about investigators & other contractors as well as employees CNIL Reference Methodology for Biomedical Research Data in international R&D projects Data about team members Human Resources administrative data International mobility 10
Data in regulatory submissions Patient Data from Clinical Trials Collected according to standards set by international rules based on the Helsinki Declaration on patients rights, known as Good Clinical Practice (GCP), defined by the International Conference on Harmonization (ICH) composed of members of Regulatory Authorities (FDA, EMEA, MHLW) and industry (PhRMA, EFPIA, JPMA) Patient medical data are anonymised Patient sign an informed consent that describes the clinical trial and the use of their data, as well as their rights Data about individuals involved in clinical trials GCP requires the evidence that individuals involved in clinical trials are appropriately trained CVs & training records from the following groups Sponsors project teams Investigators and hospital staff Contractors Are submitted to Health Authorities or kept in view of regulatory inspections 11
Other Personal Data Data in international R&D projects Data about team members necessary for the coordination of the project teams: Who does what? Who has which responsibility for which project? Who should be asked to handle a specific topic? Most of this information is available through the company intranet or in project specific virtual meeting rooms Human Resources administrative data This type of data is rarely transferred between countries An exception being employee data concerning moves between countries (company internal international mobility) 12
Enforcement of Personal Data Protection Code of Ethics Personal Data Protection Organization Standard Methodology & Contracts Awareness & Training 13
Code of Ethics The fundament of the personal data protection policy is the Code of Ethics of the sanofi-aventis Group http://en.sanofi-aventis.com/images/060306_ethique_en.pdf Its implementation is being supervised by an Ethics Committee at the highest management level The policy is being further described in a Personal Data Protection Charter It is enforced through a Personal Data Protection Organization 14
Personal Data Protection Organization Oversight Personal Data Protection Committee Geographic Organization Compliance Officers Data Protection Officers (depending on national laws) Functional Organization Functional Data Privacy Officers Operational staff acting as Data Privacy contacts 15
Standard Methodology Computerized System Methodology Implementation and maintenance of computer systems follow a standard methodology aimed at insuring compliance with various internal & external requirements like: Health regulations (ICH GCP, 21 CRF part 11, etc.) Financial (Sarbannes Oxley Act, Loi de Sécurité Financière, etc.) Privacy and Personal Data Protection (National laws & internal procedures) Ensures the early involvement of the functional privacy officer The FPO works with representatives of the various functions (e.g. project management, operational staff, information systems, legal affairs, human resources) to: Assess the system in terms of data privacy Prepare the registrations/declarations as needed Forward the necessary documentation to the countries involved Set up the data transfer contracts as needed Ensure proper data privacy training of the users 16
Standard Contracts & Agreements Patients Informed Consent Contains standard clauses concerning the use of the patient anonymized data for research and drug registration (based on wording from the CNIL Reference Methodology for Biomedical Research) Investigators contracts Includes the investigators agreement to transfer his personal information (e.g. CV and financial disclosure) between countries for regulatory purposes (also based on the CNIL s recommendations) Contracts between company affiliates Based on EU Working Party 29 recommendations Contracts with service providers 17
Awareness & Training (1/2) Key element in compliance with Personal Data Protection Rules is raising awareness about these rules This is especially true when the perception of privacy differs between countries Having a contract between affiliates is only a first step All persons involved on both sides need to understand and respect the terms of the contract Depending on staff involvement, simple information or in depth training may be needed Awareness of local associates is raised through the local Compliance Officers and DP Officers 18
Awareness & Training (2/2) All Project Managers are trained in Computerized System Methodology, which includes a data privacy module Training plans, including data privacy aspects are part of the computerized system development Users of systems managing sensitive data receive a specific training 19
Conclusion The use of contractual clauses to allow the international transfer of personal data is practicable once a standard process (organization, standard methodology & contracts, training) has been put in place but the implementation of such a process requires considerable time and resources The use of Binding Corporate Rules seems to require an even bigger effort 20