Protecting your information Dont get burnt by FOIA

The Freedom of Information act (FOIA), which came into effect in full on 1st January 2005, heralded a new era of transparency for public organisations. However, the impact of FOIA has not been limited to the public sector: it has had considerable significance for private companies. This article explores some of the ways in which pharma companies are affected by this highprofile legislation, and what they can do to protect their data.

Background

FOIA gives individuals and companies rights of access to information held across almost the entire spectrum of public bodies within the UK. This includes every level of government (from Parliament to local councils), as well as most publicly funded bodies such as universities, Research Councils, the NHS and the MHRA.

The Act is retrospective, so applies to information held by a public body before it came into force. The information requested may even be held by a third party on behalf of the public body in question. An applicant is not normally charged for making an information request, unless the cost of responding is greater than £450 (or £600 for requests to central government and Parliament). The public body has just 20 working days to supply the information requested, or to inform the applicant that it no longer holds the information or that one of the exemptions applies.

FOIA sets out a number of exemptions from the general duty of disclosure. The key exemptions relevant to pharmaceutical companies dealing with public bodies, such as the NHS and the MHRA, are where:

(i) the information has been provided in confidence
(ii) disclosure of the information would reveal a trade secret or prejudice the commercial interests of any person
(iii) the information is personal
(iv) the information relates to investigations and proceedings conducted by public authorities.

Marking a document as confidential may not be sufficient, since it is the substance of the information, rather than any label attached to it, that is critical. However, using such labels and agreeing an explicit confidentiality obligation in a contract are indicative of the parties intentions, and are thus often helpful.

The commercial interests exemption covers situations where disclosing the information is likely to affect the companys competitive edge and thereby benefit competitors. This exemption is qualified, and so the public body must also weigh up whether it is in the public interest to disclose the information.

Companies should remember that the commercial sensitivity of information may decrease with time the key question is how sensitive the information is at the time of the request.

Where information is personal, an exemption applies that upholds the principles of the Data Protection Act 1998 (DPA).

Relevance of FOIA for private companies

The move towards greater transparency of public information presents a number of risks and opportunities to private companies. There is an obvious danger that important information relating to a companys products and processes will be released into the public domain and will thereby fall into the hands of a competitor. Companies will similarly want to protect sensitive details relating to their employees and premises, particularly in the case of companies undertaking animal research.

Conversely, a company may use FOIA to its advantage by making requests for information in relation to its competitors or potential business opportunities. FOIA can also be used to gather information on the overall regulatory landscape in order to better understand decisions made by regulatory authorities.

The Times has reported that a number of private firms have used FOIA to obtain commercial information from the NHS and thereby win valuable contracts. Many of the requests received by NHS trusts relate to contracts with third-party service providers that are probably in direct competition with the company requesting the information.

The pharmaceutical industry

In June 2007, the MHRA and the VMD prepared a draft Guidance on the disclosure of types of Human and Veterinary Medicines Information held by the Human and Veterinary Regulatory Authorities. This is due to replace the guidance set out in the Memorandum of Understanding (MoU), signatories to which include the ABPI, PAGB and NOAH.

The MoU set out a traffic-light classification of the various categories of document held by regulators, indicating whether each was exempt, not exempt or exempt only where the public interest test was satisfied. A review, initiated in December 2006, concluded that the MoU had not adequately reflected the greater spirit of openness and commitment to disclosure that the Access to Information legislation was designed to foster in public bodies.

The Guidance, currently in draft form, is a common understanding of what will be disclosed, withheld, or disclosed only after consultation with third parties. It is a working document, subject to review and not legally binding. It states that the application of the public interest test to determine whether disclosure is necessary may result in different outcomes from those set out in the Guidance.

The Guidance, like the MoU, categorises information into three tables according to when it may be published:

documents that public bodies will routinely publish online/in print

documents/information that public bodies will disclose on request

documents/information that public bodies may be able to disclose on request if disclosure is in the public interest.

Public access to information held by the EMEA, as well as other EU institutions and agencies, is governed by Regulation (EC) No 1049/2001. This contains broadly similar provisions to those of FOIA, and likewise indicates numerous exemptions including confidential information, commercial interests and legal advice exemptions. It also requires the consideration of a public interest test.

Regulatory submissions

The pharmaceutical sector is heavily regulated, so the number of official documents and records relating to most businesses within this sector is considerable. In the UK, the MHRA gathers market-sensitive information at every stage of a products life cycle from the laboratory to the final consumer.

The results of clinical trials and adverse event reports for authorised products both fall within the broad definition of information that may be disclosed under FOIA. This information is likely to be particularly sensitive when a marketing authorisation is still being sought. During this somewhat lengthy process, a number of documents and correspondence may pass to and from the regulator and further trials may be conducted to address specific safety issues or other concerns. Inappropriate release of such information could have a significant impact on a companys share price, compromise its intellectual property or even cause unnecessary alarm among its customers.

Such information is classified in the Guidance as information that may be disclosed only when it is in the public interest to do so. It states that the MHRA will usually consider the public interest in disclosure of such information to be outweighed by the public interest in keeping it confidential.

When facts are kept back

If a public body withholds information following a request, an internal review process should be carried out by a senior agency official who was not previously involved in the request. The refusal notice given to the applicant should state the review policy and whether a review has taken place.

If a complaint is made against the public body, the Information Commissioner will investigate the facts and may then issue a decision notice. This is the Commissioner's final view on whether or not the public body has complied with FOIA, and may require the public body to release information.

What you can do

When private companies contract with public bodies, such as the NHS or a university, they should consider taking the following precautions:

Include an express confidentiality clause that makes explicit what information is considered to be commercially sensitive, and ensure that effective procedures are in place to manage the subsequent information flow.

Consider submitting documents to the public body in two versions, one fully disclosable and the other containing commercially sensitive/confidential information that should not be disclosed. This may initially impose a greater administrative burden, but will reduce the need for consultation by the public body following a request for information and reduce the likelihood of sensitive information being released accidentally.

Include an obligation on the public body to return all confidential information at the end of the contract when it is no longer required.

When submitting a bid as part of a public procurement tender process, request confirmation from the public body that detailed information relating to pricing structures, costing mechanisms and so on will be kept confidential even after a bidder has been selected.

Require the public body to notify the private company when it receives a FOIA request and subsequently take the companys views into account when deciding whether to disclose information. This obligation could be expanded to require the public body to consider all the available exemptions (but in practice, such a clause may be resisted).

For further information, visit www.ico.gov.uk, www.foi.gov.uk and www.foi.nhs.uk.

SUMMARY The Freedom of Information Act (FOIA) requires public bodies to disclose information they hold on request. Exemptions include information that is confidential or commercially sensitive. Some private companies are using FOIA to access commercial information from the NHS that gives them a business advantage. Current draft guidance on the disclosure of medicines information by regulatory authorities states that certain types of information, including clinical trial results, may be disclosed only if it is in the public interest. Companies can protect their data by identifying information that is confidential or commercially sensitive.

Sarah Hanson is a Partner in the Lifesciences Group at CMS Cameron McKenna LLP.