Data policy for the Early Breast Cancer Trialists’ Collaborative Group (EBCTCG)
1. lndividual patient data supplied to the Early Breast Cancer Trialists’ Collaborative Group are held in confidence securely in the University of Oxford’s Nuffield Department of Population Health (NDPH, Oxford Population Health). The Unit has an Information Security Policy (ISP), available on request, applicable to all research undertaken and it outlines the potential risks to information held in the department and details the safeguards and procedures that are in place in order to guard against them.
2. It is outside the scope of the present document to list all legislation, guidelines and regulatory requirements applying to all the research that NDPH organises or collaborates in across the world. However it is appropriate to identify key legislation and regulatory requirements that apply to many of the activities of NDPH. These include:
- EU Clinical Trials Directive
- Data Protection Act 1998 and UK Freedom of Information Act 2000 in the UK (and similar legislation in other countries)
- UK Privacy and Electronic Communication Regulations 2003
- FDA Code of Federal Regulations Title 21 Part 11
- British Standard ISO IEC 17799:2005
- UK General Data Protection Regulation (UK GDPR in accordance with Article 6(1)(e), Article 9(2)(j)), tailored by the Data Protection Act 2018
The NDPH ISP also complies with the NHS Safe Haven Policy.
3. Regardless of the classification of information, consideration is given to ensuring that information is accurate, that changes are accountable and that only authorised individuals can make changes. This is dealt with in detail in the ISP but of special relevance to the EBCTCG is the handling of CONFIDENTIAL Individual Patient Data. Such information is not in the public domain. Access to CONFIDENTIAL information is on a 'need to know' basis. Electronic data are protected by any or all of the following: assigned log-ins, protected network areas and encryption. Physical CONFIDENTIAL information is kept in locked areas with no general access.
4. Exchanges of CONFIDENTIAL information and software with other organisations (by whatever means) are based on a formal exchange policy and compliant with all applicable legislation. Procedures should be established to protect information and physical media in transit. Any information that is sent from other organisations to NDPH should be secured and senders are strongly encouraged to do so. NDPH will make available technical help to outside collaborators explaining how to secure information for transmission. Emails containing CONFIDENTIAL information should use an appropriate form of encryption. For any data on any type of media sent from NDPH, NDPH will bear responsibility for conforming to data protection rules and procedures. Any incoming data will come under the same rules and procedures once acquired by NDPH.
5. For the EBCTCG, although, ideally, we should like to receive the individual patient data in the preferred format for the overview, trialists can provide their data in any format and using any coding they wish. The EBCTCG Secretariat will process the data and seek clarifications as necessary from the responsible trialists.
6. All data provided to the EBCTCG Secretariat remain the property of the trialist who supplied it, unless they transfer ownership to the EBCTCG Secretariat (e.g. on the retirement of the trialist).
7. Supplied data will not be shared with others outside the EBCTCG Secretariat without the permission of the responsible trialist. NDPH (which hosts EBCTCG) has a defined policy on data sharing. EBCTCG data will be used for the purposes of medical research only and within the constraints of consent under which the data were provided to the EBCTCG, and of contractual agreements between the study from which data are requested and its funders or external data sources.
8. Trialists can withdraw their data from the EBCTCG analyses at any time.
9. No individual patients will be identified in any publications or presentations by the EBCTCG. Data are de-identified for analyses.
10. The statistical analyses are in accordance with the methods developed by the EBCTCG, and are discussed with the writing committee for the individual papers, the EBCTCG Steering Committee and the collaborators more generally (at EBCTCG meetings and during the consultation on the manuscripts).
11. All publications of the EBCTCG analyses will be in the name of the Group, with acknowledgment of the relevant collaborating trialists, who will have the opportunity to comment on the manuscript before publication.