European Cystic Fibrosis Society

1. General:

a.   The guidelines of the ECFR are made according to the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The definitions according to chapter 1, article 2 are as follows:

i. Data subject: the individual CF patient
ii. Controller: the ECFS and the ECFR Steering Committee
iii. Processors: the software service provider, the steering committees of the national registries and the local centers.
iv. Third party: any scientist or project manager applying for data access.

b.  The ECFR is founded and run by the European Cystic Fibrosis Society (ECFS).

c.  The purpose of the ECFR is

i.  To measure, survey and compare aspects of cystic fibrosis and its treatment in the participating countries, thereby encouraging new standards of dealing with the disease.
ii.  To provide data for epidemiological research.
iii. To identify special patient groups suitable for multi-centre trials.

d.  The data collected will be restricted to include only data needed to fulfill these purposes.

e.  Funding of the ECFR can be private or public. Private funding should be through the ECFS and must be unconditional regarding access to data. No demands or request for special data or access to data will be met.

f.  The ECFS is responsible for the ECFR observing the EU Data Protection Law on data handling and storage, use of data, anonymity, security etc. The individual centers are responsible for the data being accurate and kept up to date (on a yearly basis). The individual centers are responsible for obtaining informed consent according to the specific national requirements.

g.  After an individual country/centre decides to participate in the ECFR, they can later decide to withdraw their data, but not retroactively. Projects already approved by the ECFR scientific committee will have access to the data included in the ECFR at the date of the approval.

2. Responsibility for Data Storage

a.  The ECFS is responsible for the use and storage of data delivered to the ECFR by the countries and centers. The ECFS is the data controller.

b.  Storage of data at a software service provider is to be supervised by the ECFS. The service provider should be authorized for data storage by the national data protection agency of the country where the data are stored (must be an EU country).

c.  Should the ECFR be closed for any reason, all data will be cleared. Each centre will be able to get an extract of their data before closure of the ECFR. Authorisation of storage and handling of such data will be the responsibility of the single centre.

3. Ownership of data

a.  Each centre/country owns its own data and has the right to use them freely (as stated in the local consent form). Each centre/country should be able to have their data extracted directly from the ECFR.

b.  Access to the total dataset of the ECFR is governed exclusively by the ECFS, following the guidelines below.

4. Steering and scientific committee

a.  Each country that contributes/plan to contribute to the ECFR will have a representative in the Registry working group of ECFS. The working group will meet once a year at the ECFS conference. The working group will elect five members amongst themselves. Election will be for a period of 4 years at a time.

b. The five elected members will constitute the ECFS steering committee, which will be supplemented with appointed members:

i. Patients’ organizations: two members from Cystic Fibrosis Europe. Both will be appointed by their organization.
ii. ECFS: the ECFS board will appoint one member of the steering committee
iii. “Trusted third party”: this member will be responsible for center codes for anonymisation purposes
iv. A data protection legal and ethics expert (this person can be one of the patient representatives if applicable)

c.  Furthermore the steering committee will appoint associated non-voting members according to its needs, e.g. a statistical expert, representatives of sponsors, representatives of associated registries, clinical trial networks representative.

d.  A chairperson is to be elected by the steering committee with an election period of 4 years. The chairperson will report periodically to the ECFS board about the ECFR activity and progress.

e.  The steering committee has sole right to decide who can get access to data (following the guidelines below).

f.   The use of the ECFR data is monitored by the scientific committee, which consists of five members appointed from the steering committee

i. The scientific committee will consist of three of the elected members, the ECFS representative, and one of the patient representatives.
ii. The scientific committee will be responsible for reviewing all applications for data by any third party, and making a recommendation for the steering committee to approve or reject the application. The decision will be communicated to the steering committee who then have seven days notice to veto the decision. If vetoed there will be a discussion. Otherwise the decision of the scientific committee stands.

5. Projected data analyses

Annual report
a.  The ECFS will publish an annual report with epidemiological presentation of core data.

i. The annual report will be on a European and country level.
ii. Centre data will be accessible only to the center’s director, and to a national registry steering committee in case that such recognized organization exists for the country (by a number – known to each centre only).
iii. The annual report will be kept at the ECFS offices and will be accessible at the ECFS and ECFR home pages.

Data for epidemiological research
b.  All data extracts are granted after application (online/email) only (except data extracts for individual centers – see above). Any applications from third country (non-EU) must ensure an adequate level of protection (chapter IV, article 25.1), and must be approved by the Danish Data Protection agency before release of data.

c.  All applications will be continually reviewed by the scientific committee (no deadlines). Applications should be answered within one month of reception.

d.  The scientific committee members must approve all applications by majority.

e.  Title of project and contact person of all approved applications will be published in the annual report.

f.  Data extracts are paid by the applicants at a cost fee that will be determined by the steering committee.

g. All applications should be scientific projects headed by individual independent scientists.

h.  All associations with private companies especially pharmaceutical companies should be acknowledged in the application.

i.  No private or public company or patient organisation will be granted direct access to data.

Individual data
j.  Applications for data of individual patients (e.g. diabetic patients) will follow the same procedures as above.

k.  Patients suited for multi-centre trials will be identified on a centre-level. The local centre can then be informed of the trial. Patients can only be identified by the local centre, and must be contacted by their local physician.

Publishing:
l.  All projects approved should be published, in the least as an abstract at the ECFS conference. If this is not possible, the key results must be reported at the web page of the ECFR.

m.  A copy of any publication must be forwarded to the steering committee.

n.  The ECFR should be acknowledged in any publication, with a reference to the list below.

o.  An updated list of the persons responsible for the ECFR at the individual centers/national registries should be available at the ECFS homepage for reference in published articles.

6. Patient information:

a.  An English version of the patient information is made available to all participating centers/countries. Translation should be done on a national level. These guidelines should also be available to the patients in translated form.

b.  In countries with an existing national registry special informed consent for the ECFR might not be required, but the individual centre and/or national registry is responsible for the EU Data Protection Law, as well as national data protection laws and/or ethical requirements to be observed. The ECFS recommends, that patients be informed specifically of the ECFR.

c.  Informed consent forms must be stored at the individual centre.

d. The patient/guardian has the right to see his/hers/the child’s data within a reasonable time. This access will be managed and met at a centre level.

e.  The individual centre is responsible for informing the national registry or the ECFR if a patient has withdrawn his/hers consent. Data concerning this patient should be immediately removed from the registry.

Please find the guidelines for the ECFR in PDF format here.