Drug Evaluation Committee 2023-36 Handling of Personal Information When Using ePRO
Related Category: Other
Initial Publication Date: February 2024
Question
Recent clinical trials frequently involve PRO assessments and patient diaries, and there is an increasing number of trials where participants access the site via a dedicated tablet or their own smartphone to complete diaries and questionnaires.
If participants use their own smartphones, could you please advise on any points to note when registering a personal email address?
Additionally, regarding the scenarios where participants download an app onto their own smartphones or register a personal email address on a smartphone designated for the diary, I would appreciate your guidance on the steps the site should take—such as obtaining prior confirmation from the sponsor, clearly stating this in the informed consent document, and ensuring compliance with IRB requirements.
From the perspective of personal information protection, I would also appreciate understanding the points the site should be mindful of.
JPMA Opinion
The following outlines our opinion regarding precautions to take when registering a patient’s personal email address.If a specific individual can be identified from the username and domain name of an email address (e.g., Seiyaku_kyoko@example.com), that email address constitutes personal information in and of itself.Even in other cases, if a specific individual can be identified by easily cross-referencing the information with other data, the information, taken together with that data, may constitute personal information.
If the information constitutes personal information, compliance with the Act on the Protection of Personal Information is required. Specifically, the following points must be observed.
1. Specify the purpose for obtaining personal information and use it only within that scope. Additionally, notify the subject of the purpose of use and obtain their consent.
2. Store and manage personal information appropriately to prevent leaks.
3. When providing personal information to a third party, obtain consent from the subject in advance.If the recipient country has been determined, confirm that the explanatory document includes the name of the foreign country, information regarding that country’s personal information protection system, and information regarding the measures taken by the third party to protect personal information. Even if the recipient country cannot be specified at the time consent is obtained, confirm that the document states that the recipient country cannot be specified and explains the reason why.
4. If a request for disclosure, etc., is received from the subject, respond to it.
Therefore, it is important not only to include provisions in the informed consent document for the clinical trial to ensure compliance with the Personal Information Protection Act as described above, but also to specify in the document what information will be collected and how it will be handled if the subject’s own smartphone is used, and to obtain appropriate consent from the subject.
Please also refer to the “Guidelines for the Security Management of Medical Information Systems, Version 6.0 (May Reiwa 5)” as necessary.