# The Big Data Regulator, Rebooted: Why and How the FDA Can and Should Disclose Confidential Data on Prescription Drugs

**Authors:** Christopher J. Morten, Amy Kapczynski
**Citation:** "The Big Data Regulator, Rebooted: Why and How the FDA Can and Should Disclose Confidential Data on Prescription Drugs," 109 *California Law Review* 493 (2021) (with Amy Kapczynski)
**Source:** https://lawcat.berkeley.edu/record/1208024/files/3-Morten-and-Kapczynski-postEIC.pdf

## INTRODUCTION

*p. 2*
Few issues are more important to the American public than the quality and safety of our medicines. About half of all Americans take one or more prescription drugs, 1 and medicines represent a startling 2% of total U.S. gross domestic product (GDP) each year. 2 Life as we know it relies on vaccines that prevent dangerous diseases. But there is a structural problem at the heart of our system for the development and assessment of therapeutics and vaccines: 3 a problem of secrecy in the age of big data.

*p. 3*
The problem of data secrecy is especially visible in the shadow of the COVID-19 pandemic. As we complete this in the summer of 2020, governments around the world are taking unprecedented measures to promote the development of a COVID-19 vaccine. Billions of dollars of public money are being invested, with dozens of potential vaccines in development. 4 But researchers have raised an outcry, pointing out that they have no access to some of the most basic and important information about the design and outcomes of the most promising COVID-19 vaccine trials. 5 Access to this information could enable scientists to understand key clinical trial decisions in time to influence them, to evaluate the quality of the evidence as it emerges, and to protect against mistakes and misconduct, such as changes in trial endpoints that produce spurious results. Researchers could also make novel uses of the data collected, advancing our understanding of COVID-19 at a critical time. 6 Under pressure, several companies (as of this writing) have begun to release some such data voluntarily. 7 This is a positive step and a proof of concept. But there are important gaps in what has been provided 8 and no systems in place to be sure that they will be remedied, despite the extraordinary stakes. [Vol. 109:493 The inability to access data related to COVID-19 vaccine development sheds light on the problems caused by systemic data secrecy in clinical trials. Therapeutics and vaccines are complex products. We cannot know whether they hurt or help without rigorous clinical trials, whose conduct and interpretation are highly complicated. Today these trials, particularly at later stages, are typically conducted by companies with strong financial interests in the outcomes. 9 This is a key justification for our drug regulatory system: independent experts are needed to protect the public by examining and validating data about the effects of medicines. 10 But our drug regulatory bodies are under-resourced, and recent examples show that outside expert analysis can reveal concealed risks of medicines.

*p. 4*
The rise and fall of the painkiller rofecoxib (Vioxx) offers a stark example of the harms of data secrecy. The drug was promoted as being safer than aspirin and became a blockbuster. It earned $2 billion each year for Merck before it was abruptly removed from the market because it caused heart attacks, strokes, and heart failures. 11 The evidence only became known to outside experts through litigation. 12 Later independent research showed that signals of these risks were present in data held by the FDA nearly 3.5 years before the drug was withdrawn from the market. 13 That evidence did not reach doctors or patients because the data was not made available to the scientific community. 14 An FDA official later estimated that tens of thousands of people died as a result. 15 Data secrecy also causes harm by undermining our health care system. Secrecy prevents us from making the best allocation of scarce resources and obscures avenues for systematic reforms at the FDA and in the pharmaceutical industry. Data secrecy may also undermine trust. The American public, for example, expressed widespread hesitancy about any COVID-19 vaccine that was to be rushed to market before the November 2020 U.S. election. 16 Sharing safety and efficacy data on drugs and vaccines-including COVID-19 vaccineswould help to secure public trust in the FDA review process and in the products that emerge from it and would help to protect the scientific integrity of the FDA review process from political pressure. 17 There is, accordingly, an emerging consensus that independent researchers need better access to clinical trial data to keep both the industry and regulators honest and accountable. 18 Yet existing tools for an independent assessment of clinical trial data are inadequate. What remains missing is an effective legal and regulatory framework for the release of this data within the United States. For several years, working closely with medical researchers and a legal team, we have worked to maximize the potential of existing strategies for clinical trial data disclosure. This Article sets out a key lesson of that work: existing tools are inadequate for the task. If researchers are to have systematic access to the clinical trial data needed to help spot unsafe and ineffective medicines, the FDA will have to make clinical trial data available proactively.

*p. 5*
We show that the agency can, consistent with existing law, make clinical trial data available proactively. We describe how the FDA can do so while navigating the two main challenges of data sharing: protecting the privacy of individuals who participate in trials and addressing claims that company data federal statutes 20 or, if permitted, will require expensive compensation to the industry for intellectual property violations. 21 This Article is centrally aimed at solving an important public health problem, but it also contributes to two broader literatures. The first is the literature on transparency and the implications of freedom of information laws. Transparency as an ideal has been rightly criticized recently as having taken on a formalistic, decontextualized quality. As an ideal, transparency does not appropriately recognize that "freedom" at times requires more than unfettered, standardless exchange 22 and does not appreciate how freedom of information laws can be weaponized to undermine public interests. 23 We show here that the implications of data sharing turn on and should be sensitive to a broader politicaleconomic context. Data sharing can serve public interests because of a wider ecology that provides researchers with the necessary resources to analyze the data and includes publications and norms (of the "open science" tradition in academic medicine, for example) that help generate and validate important new insights and challenge false claims. Data itself does not produce these insights, and a context that enables trustworthy analysis is essential if data sharing is to work well.

*p. 7*
To this end, we argue that data use agreements will be an important component of data disclosures in our "big data" age. They provide a means to navigate issues of privacy and commercial interest-issues that can otherwise shut down data sharing, rightly or wrongly-and a mechanism to develop and See also Eisenberg, Data Secrecy, supra note 19, at 488-89 (suggesting statutory reform to permit proactive disclosure while not explicitly arguing that proactive disclosure is prohibited under current statute); Galbraith, supra note 19, at 776 ("[G]enuine statutory reform to make the clinical trials process more transparent must occur so that proper protection is provided for all patients requiring medical care.").

*p. 7*
21. impose other publicly minded conditions. 24 The role of these agreements here illustrates the importance of contract as a tool to facilitate information exchange and innovation. 25 Decontextualized demands for "openness" have gained traction in recent decades 26 and might suggest that in every instance we need unfettered data exchange that treats all parties equally, including companies. We argue instead that the FDA should prioritize health researchers over industry actors and that it should use data use agreements to ensure those researchers protect legitimate public interests. These contracts are possible only with proactive disclosure and are inconsistent with reactive FOIA requests.

*p. 8*
We join other scholars in suggesting that the future of freedom of information, if it is to achieve its aims, lies in the development of robust proactive disclosure systems. In part to mark these distinctions, we call what we seek here not data transparency, but data "publicity." The term as we use it, which draws upon early progressive traditions, marks the need for attention to context, power, and resources if data sharing is to serve the public. 27 We also seek to contribute to the broader literature on the future of the regulatory state and the conditions of democracy broadly understood. Today, we live in an extraordinarily information-intensive age. Decades of dramatic advances in technologies for information processing have transformed the core of the modern economy and enabled the emergence of massively complex new industries and firms. This means that not only pharmaceuticals but also products like cars, insurance, airplanes, and phones are far more informationally intensive today than they were twenty years ago. Informationally intensive products and systems are complex, opaque, and dynamic. 28 Systems that are improperly or fraudulently designed-think here about Volkswagen's deceptive "defeat 24. See Fan, supra note 22, at 198 (proposing "[e]xpert-[o]riented [b]ounded [a]ccess" to government agency-held data under data protection plans to permit meaningful use of that data while insulating agencies from legal risk).

*p. 8*
25. See Amy 27. See Pozen, Transparency's Ideological Drift, supra note 22, at 148 ("The progressives in the early 1900s spoke of 'publicity,' rhetorically tethering their efforts to the notion of a public and its needs and demands."); Matthew Herder, Denaturalizing Transparency in Drug Regulation, 8 MCGILL J.L. & HEALTH S57, S61 (2015) (explaining the progressive tradition of "publicity" in Canadian consumer protection law and policy in the late nineteenth and early twentieth centuries).

*p. 8*
28. See JULIE E. COHEN, BETWEEN TRUTH AND POWER: THE LEGAL CONSTRUCTIONS OF INFORMATIONAL CAPITALISM 172 (2019) ("Industrial-era regimes of economic regulation presumed well-defined industries, ascertainable markets and choices, and relatively discrete harms amenable to clear description and targeted response. The shift to an informational political economy has disrupted those presumptions . . . .").

*p. 9*
device" to evade emissions testing, 29 or Boeing's defective automated flight software for the 737 Max 30 -generate serious social and individual harms. Regulators face growing challenges in this environment, and we need structures to allow the public to hold both regulators and the industry accountable. Yet the same barriers that appear in this context-issues of privacy, corporate claims to trade secrecy and confidentiality, and difficulties with reactive data release models (FOIA especially)-will reappear throughout the administrative state. Our Article thus can help inform a wide variety of regulators who face related issues, whether in the area of consumer products, environmental protection, or artificial intelligence. Data publicity will have plausible benefits elsewhere, and regulators can learn from how it can be achieved at the FDA. But they must also learn from the fertile conditions in the pharmaceutical and medical context that allow clinical trial data publicity to inform the public. It is not open data alone, but data publicity in a context where resources and expertise exist to enable intelligible uses of such data, that furthers democratic accountability. 31 We begin in Part I by describing the need for proactive disclosure of safety and efficacy data 32 and why existing legal avenues, such as FOIA, fail to create adequate data publicity. In Part II, we show that, contrary to the conventional wisdom and the (usual) view of the FDA itself, federal law does not prohibit the FDA from disclosing such data, even from the moment of drug or vaccine approval. Consistent proactive disclosure, however, will require revisions to the FDA's current regulations, corrections to its interpretations of certain statutes, and, for the most sensitive data, data use agreements. We also show that the move should not hurt and may improve innovation, nor should it require compensation under the Takings Clause. If the agency does not act, Congress can and should, as we describe in Part III. [Vol. 109:493

## A. Protecting Health with Data Publicity

*p. 10*
In the United States today, a company may not sell a new drug or vaccine until it first submits studies to the FDA that show the product is safe and efficacious. 33 Though not widely recognized, the FDA's primary function in this context is to generate and validate information. 34 The FDA requires companies to produce not only positive but also negative information about their products, to share data with regulators who can validate the data, 35 and to create labeling and guidance that summarize this information for patients and practitioners. 36 The clinical studies or clinical trials that drug companies submit to the FDA typically cost many millions of dollars to conduct, take years to complete, and occur in a variety of stages. 37 Laboratory, animal, and other pre-clinical tests are performed 38 even before clinical trials. If these yield promising results, researchers begin studies in humans, conventionally in three phases: phase 1 trials, typically small and used to evaluate toxicity and dosage; phase 2 trials, larger and used to gather more safety information and to begin to explore efficacy; and phase 3 trials, still larger and used to determine whether the drug has benefits that outweigh its harms for the proposed use, and to examine adverse events in a larger population. 39 Phase 4 trials are done after marketing to study longer-term safety and effectiveness, new uses of the drug, and other outstanding questions not resolved at approval. 40 To market a drug, companies must provide data from such trials to the FDA in a formal application: New Drug Application (NDA) for small molecule drugs or Biologics License Application (BLA) for biologic drugs, including vaccines. 41 The most important trials described in NDAs and BLAs, commonly called "pivotal" trials, are those for which drug companies submit complete data sets to the FDA. It is primarily based on this safety and efficacy evidence that the FDA decides whether to approve the application (and thereby permit the drug onto the market). 42 As a result, the FDA "houses the largest known repository of clinical data" in the world. 43 This data is of enormous significance to public health but is not routinely shared or made available to researchers. Traditionally, data remains only with the FDA and the entity that conducts and/or sponsors the study, and outside reviewers have little opportunity to access it. [https://perma.cc/ZV9B-SVAQ] ("[T]he quantity and quality of evidence supporting recent drug approvals is variable, both in terms of the number of pivotal trials and their design features, such as randomization, blinding, choice of comparators and end points, number of treated patients, and trial duration."). The agency has, in addition, indicated an openness to reliance on "phase 2/3" trials (which blend aspects of phases 2 and 3 in a single trial) and "adaptive" trials (in which the trial design changes during the trial, in prospectively planned ways, based on data accumulated along the way). "Safety" and "efficacy" of medicines cannot be determined independently of one another; they must be understood together. No drug is without side effects, and medicines can also cause harm indirectly by displacing other remedies. A drug is considered acceptably "safe" only if its known therapeutic benefits outweigh its known harms. 45 This weighing of benefits and harms is invariably specific to a particular use in a particular patient population-what doctors and the FDA refer to as an "indication." 46 For example, a drug might be proved safe and effective, and thus be FDA-approved, for the specific indication of slowing tumor growth in people with a particular kind of lung cancer, or for patients with severe, but not mild, rheumatoid arthritis. The link between safety and efficacy means that a drug that is shown to be entirely ineffective-that is, that has no therapeutic benefits-is per se "unsafe." Because safety can only be understood in relation to efficacy and vice versa, we refer to "safety and efficacy data" collectively throughout this Article.

*p. 12*
Recent research has documented the problems associated with secrecy in safety and efficacy data. We now know, for example, that many clinical trials are not published in a timely fashion. 47 Publication bias is also a deep problem for trials conducted by the industry, government, and academia alike: negative studies are significantly less likely to be published than positive ones, and when trials are published, key information may be omitted or the study's results may be mischaracterized. 48 One recent article compared the FDA's summary reviews of trials with the published literature for antidepressant drugs and showed that very few of the trials the FDA considered negative were published while almost 45. FDA's Drug Review Process: Continued, FDA, https://www.fda.gov/drugs/drug-information-consumers/fdas-drug-review-process-continued [https://perma.cc/94LB-SRR3] ("Once a new drug application is filed, an FDA review team--medical doctors, chemists, statisticians, microbiologists, pharmacologists, and other experts--evaluates whether the studies the sponsor submitted show that the drug is safe and effective for its proposed use. No drug is absolutely safe; all drugs have side effects. 'Safe' in this sense means that the benefits of the drug appear to outweigh the known risks.").

*p. 12*
46. 13, 2020), https://www.sciencemag.org/news/2020/01/fda-and-nih-let-clinical-trial-sponsors-keep-results-secret-and-break-law [https://perma.cc/KBV2-R9NQ] (showing that many U.S. universities and federal laboratories have failed to publish the results of clinical trials they sponsored). all of the positive trials were published. 49 Of the few negative studies published, most were misleadingly described in print as having positive results. 50 This publication bias means that doctors may have an inaccurately rosy view of a medicine's benefits. Importantly, the "meta-studies" that are used to collate evidence and guide clinical practice are also undermined by secrecy because the FDA review teams typically only have access to the published literature. In rare cases of effective data publicity, when teams have been able to access more complete data sets, the results and recommendations of their reviews have sometimes been reversed. 51 For patients, the implications of hidden data are sometimes grave. For example, in its few years on the market, rofecoxib (Vioxx) was estimated to have caused 88,000 to 140,000 serious cardiac events, leading to tens of thousands of deaths. 52 Paroxetine (Paxil) offers another example. The antidepressant was never approved for use in pediatric populations but became a popular pediatric treatment-with over two million prescriptions for children per year-on the basis of a medical journal article that claimed that the medicine was "generally well tolerated and effective" in young patients. 53 In fact, paroxetine caused suicidal thinking and suicide in a substantial portion of young people. 54 When independent researchers gained access to the study underlying the published article, they found that it showed the risks quite clearly. 55 GlaxoSmithKline ultimately pled guilty to fraud. 56 Medical ethicists support data publicity because it reduces risk to patients and promotes efficient use of resources. Because patients undergo risks in clinical trials, the scientific community has an obligation to make the best possible use of the results and prevent unknowing duplication of studies. 57 Clinical trial data publicity can also help affirm the credibility of properly conducted studies and help us better direct our health care spending. 58 Drug prices and overall spending on "innovative" new drugs have ballooned in recent years, sometimes without evidence that these expensive treatments provide meaningful therapeutic benefits over older, cheaper alternatives. 59 For example, data access helped researchers show that governments have likely wasted billions of dollars stockpiling ineffective influenza treatments. 60 Independent analyses have also repeatedly identified approved medicines that are significantly overpriced given their true therapeutic benefits. 61 In some cases, companies have deliberately obscured evidence that only a narrow population will benefit from a drug to generate greater sales. 62 Data sharing can help improve treatment guidelines and prevent wasteful spending by governments and insurers. 63 This can help incentivize better innovation too. 64 Finally, data publicity can help identify and correct problems in regulatory and industry practices. For example, a group of researchers at Johns Hopkins, in part with our assistance, recently obtained detailed, internal FDA data on the oversight of fast-acting fentanyl products. 65 Based on this data, the Hopkins researchers revealed flaws in the agency's Risk Evaluation and Mitigation Strategy (REMS) program. 66 These flaws allowed the drugs to be widely prescribed to patients for whom the risk of addiction and overdose was unacceptably high, exacerbating the opioid epidemic. 67 The revelations sparked 70 and, ultimately, agency changes to the REMS program, which tightened prescription rules to reduce inappropriate use. 71 Data publicity can also shed light on bad industry practices-practices that are constantly evolving. For example, data released in conjunction with lawsuits helped show the emergence of the "ghostwriting" phenomenon, where companies pay prominent researchers to put their names on studies in which they played no part, 72 and "seeding trials," where companies engage in otherwise prohibited marketing under the guise of running clinical trials. 73 As these examples show, a robust ecology of researchers and organizations has been able to generate important new health insights in high-stakes instances and connect those insights to changes in practice. This is the result of a broader political economy that includes not just industry-funded researchers but also strong public and publicly funded academic health research. Over decades, with hundreds of billions of dollars of support from public funders like the National Institutes of Health (NIH), academic science has evolved a network of institutions and practices-including academic journals, independent, non-profit health technology assessment organizations, norms about conflict of interest, and norms of priority and disclosure that underpin the "open science" model. 74 A healthy ecosystem of independent researchers is critical because validating clinical trial data is an enormously time-and resource-intensive exercise that requires dedication to scientific craft. Private markets provide inadequate incentives for this critical validation work; innovators do not benefit from publicizing negative studies, and their competitors face free-rider dynamics and misaligned incentives. 75 Public funding for such reanalysis may need to grow as we make more data available. This ecosystem of independent researchers strengthens the FDA's role as the arbiter of the safety and efficacy of medicines, devices, and vaccines. 76 Validation of the FDA's work helps protect the agency from undue pressure from the pharmaceutical industry, patient groups, politicians, and other stakeholders, and usually confirms the soundness of the agency's decisions. 77 When independent reviewers do occasionally detect mistakes in the FDA's decisionmaking-as they did in 2005, helping to avert FDA approval of a diabetes drug, muraglitazar, because of excess cardiovascular risk that the agency and its advisory committee missed 78 -they generally help conserve the FDA's resources by helping it detect and address problems quickly, and protect its credibility by averting more serious regulatory failures.

*p. 17*
Safety and efficacy data on prescription drugs would ideally be shared at the moment of FDA approval or very shortly thereafter. The deadly and costly regulatory failures we describe above, like those related to rofecoxib (Vioxx) and fentanyl, highlight a major drawback of our current system. If relevant data reaches independent researchers, it usually does so years after approval, by which time much damage has already been done. Safety and efficacy data is most valuable in the months immediately following approval of a new drug, as it is 75. See Kapczynski, Dangerous Times, supra note 10. 76. For an analysis of the FDA's role, not just in keeping unsafe and ineffective drugs off the market, but in generating, validating, and disseminating evidence of safety and efficacy, see Kapczynski 79 This is when insurers decide whether to place the new drug on their formularies, 80 medical associations update treatment guidelines, 81 and individual prescribers and patients typically begin seeing advertisements 82 and must decide whether the new drug is right for them. Effective data publicity could create a virtuous feedback loop: if useful safety and efficacy data were made available at the time of approval, the ecosystem of researchers reviewing and interpreting this data would grow larger and stronger, and their insights and recommendations would reinforce the value of data publicity.

*p. 18*
While data on unapproved drugs is important for research (for example, because it can speed up research on the same or similar compounds), we focus on the data needed to assess the quality of drugs that are currently on the market because this data is particularly urgent for patients and providers. 83 Several different categories of data from trials of FDA-approved drugs should be shared to benefit patients, clinicians, researchers, and insurers. Clinical trial data can be thought of as falling into three broad categories: (1) metadata, which is data about the data that includes protocols, statistical analysis plans, and analytic code; (2) summary data, which is any summary that highlights and explains key results made by companies, regulators, and researchers; and (3) individual participant data, which includes raw data collected from trial participants, 79. See Aaron 83. For a more comprehensive list of types of data that the FDA could and should make available, including data on unapproved drugs, see Sharfstein et al., supra note 19. We do not mean to suggest that important clinical data on unapproved products-in Investigational New Drug (IND) applications, in unapproved New Drug Applications (NDAs) and Biologic License Applications (BLAs), in complete response letters from the FDA, and so on-should not be disclosed proactively. However, the legal case for their proactive disclosure traverses different questions, putting these forms of data beyond the scope of this Article. Among the differences, some of the FDA's existing statutory authority to disclose clinical data is limited to approved products, and claims of confidentiality may be stronger as to data on unapproved products. We note, however, that our proposal to impose data use agreements on data users could address the need for legitimate protection of confidences for other forms of clinical trial data, as well as data from other industries. including in executable data sets and adverse event reports. 84 Each form of data is important. 85 First, metadata is needed to understand how to interpret the data produced by a clinical trial. The most important metadata is the study protocols, which set forth how investigators plan to proceed, include a statistical analysis plan, and identify the endpoints the study will evaluate. Having access to protocols allows researchers to put trial results into context. It also helps researchers spot selective reporting or alteration of clinical trial outcomes, which can generate spurious results. 86 For example, after a study is conducted, finding some pattern in the data is almost inevitable if one "dredges" for a pattern. This stems from the nature of the test for statistical significance, which is conventionally established when there is a less than 5 percent likelihood that an outcome was the result of chance. 87 This means that one in every twenty comparisons that one makes with a data set will produce falsely significant results. If one repeatedly tests data for associations with, say, zodiac sign or hair color, one will eventually be able to produce a positive result, but that result cannot be treated as reliable. 88 It is rare for investigators to fully report all of their outcomes and justify any and all deviations from their protocols in publications. 89 This was a key part of the paroxetine (Paxil) story. On reanalysis, independent researchers discovered that all of the planned study endpoints were negative, but the authors who published the initial misleading study simply switched to different outcomes that generated flattering results. 90 The FDA typically requires drug companies to prespecify the study protocols, including the statistical analysis plans used in the trials relied on 84. See INST. OF MED. OF THE NAT'L ACADS., supra note 18. 85. The set of metadata, summary data, and individual participant data that we recommend here is non-exhaustive. The FDA could undertake proactive disclosure of additional valuable data from trials of FDA-approved products, such as FDA inspection reports on irregularities and misconduct in clinical trials. for approval, 91 but it has been criticized for approving a drug despite alleged data dredging. 92 As such, metadata is essential to interpret clinical trial results.

*p. 20*
Second, summary data is also critical to validate research. Two kinds of summary data that are not generally made public but are especially critical for research validation are clinical study reports and internal assessments done by the FDA, including scientific reviews generated by individual reviewers or teams. A clinical study report (CSR) is a report summarizing a clinical trial prepared by a manufacturer and submitted to the FDA, often running into the thousands of pages. 93 Clinical study reports are currently not routinely disclosed by the FDA, 94 though some have been made available through FOIA litigation, including litigation over Gilead's Hepatitis C drug, sofosbuvir. 95 The European Medicines Association (EMA) has adopted a process for disclosing CSRs with minimal redactions, although its implementation has been suspended. 96 When such CSRs have been made available, they have spurred important new insights into risks, leading to new black-box warnings (the most serious kind) and, in some jurisdictions, to the withdrawal of medicines. 97 The other critical kind of summary data is internal assessments conducted by the FDA. Expert FDA reviewers undertake careful analysis of medicines before they are approved, 98 and the published assessments of senior FDA officials and individual scientific review teams within the FDAclinical/medical, toxicological, statistical, chemical, etc.-provide important indications of agency concerns. 99 These assessments are published as part of the "approval package" that the FDA publishes on the "Drugs@FDA" site every time it approves a new drug or new indication of an existing drug. The assessments contain a variety of important information not often found in the medical literature, such as details from clinical trial protocols and statistical analysis plans, more complete sets of efficacy endpoints and adverse events, comparisons of FDA and sponsor analyses of the same data, important details about postmarketing study requirements, and each individual FDA reviewer's (or review team's) view on whether the drug application should be approved. 100 Summary evidence of this kind helps researchers understand where they might want to dig deeper. 101 Unfortunately, in June 2019, the FDA announced that it plans to discontinue publication of the assessments of individual reviewers and review teams and shift to publication of a single consolidated "integrated review." 102 This is problematic because it allows others less insight into differing 97. YALE COLLABORATION FOR RSCH. INTEGRITY & TRANSPARENCY, supra note 90, at 12-13 (describing how the diabetes drug rosiglitazone (Avandia) received a black-box warning in the U.S. and is no longer sold in the European Union).

*p. 21*
98. See FDA's Drug Review Process: Continued, supra note 45. For a minority of drugs, the FDA convenes a panel of outside experts-an "advisory committee"-to advise on whether to approve the drug. The FDA releases advisory committee materials which reveal the basis of evidence that those experts use to make a recommendation on approval. interpretations and debates inside the agency and may even suppress dissent within the FDA. 103 Finally, individual patient-level data is extremely valuable to researchers. This includes raw data collected for each trial patient, and to be practically usable, data must be made available in executable (analyzable) form (i.e., in a form that can be analyzed using appropriate analytic software, such as Excel). 104 Granular data of this sort is rarely available to researchers, but pilot projects that have made it available on a voluntary basis show both that there is demand for the data and that important research insights can be gleaned from reanalysis of patient-level data. 105 For example, researchers reviewed previously unavailable individual patient data from thirty-three clinical trials of the once-blockbuster, now deprecated 106 drug rosiglitazone (Avandia) and identified serious discrepancies between the safety profile embedded in that individual patient data and previous depictions in summary data, including significantly higher risk of myocardial infarction (heart attack). 107 Some of the most important individual patient data emerge from the "pivotal" trials that are used to support approval of the drug. Individual adverse event reports are also valuable, but the need is less pressing as this data is currently available in redacted form from the FDA. 108 There is a growing movement toward sharing all of this important safety and efficacy data. A consensus is emerging among medical experts that more data sharing is essential to protect public health, 109 more sharing as well. 110 Data sharing also supports the FDA's primary purposes: information production and validation. These functions are negated if much of the information produced under its influence remains unavailable to researchers, doctors, and the public. 111 Many new and emerging initiatives to promote data sharing show that more access to data can facilitate better science and protect patients. 112 But existing approaches have not yet solved the problem.

## B. Insufficiency of Existing Approaches

*p. 23*
There are existing sources of clinical trial data, but none are comprehensive or responsive enough to provide the necessary access and accountability. In this Section, we summarize several leading approaches to obtain clinical trial data: access through the public ClinicalTrials.gov website, litigation against drug companies and encouraging voluntary data sharing by drug companies, access through foreign drug regulators' safety and efficacy data sharing programs, and FOIA requests to the FDA. We explain the limitations of each, which underscore the need for more comprehensive data publicity.

## ClinicalTrials.gov

*p. 23*
Although companies are required to report clinical studies to the NIH, the required disclosures are partial, and compliance is incomplete. Existing law requires anyone who conducts a Phase 2, 3, or 4 clinical trial of an FDAapproved drug or medical device to disclose information on that trial via the ClinicalTrials.gov website, which is administered by the NIH. 113 Each trial must be registered before it begins and must report a summary of trial results when completed. 114 Since 2017, drug companies and other trial sponsors have been required to submit full trial protocol documents after trials are completed. 115 But compliance with ClinicalTrials.gov requirements is spotty, especially when it comes to reporting results after trials are completed: according to multiple studies, only about two-thirds of completed trials had reported results as of 2019, raising concerns that drug companies and other trial sponsors are selectively reporting some results and withholding others. 116 NIH and FDA have not enforced the law's reporting requirements, and few expect them to do so. 117 Moreover, ClinicalTrials.gov's requirements are partial: sponsors need not report complete metadata or summary data, nor individual patient data. 118 Useful and important as it is, the ClinicalTrials.gov website is an inadequate source of safety and efficacy data. 119

## Litigation and Voluntary Data Sharing

*p. 24*
In the United States, a small but vital stream of safety and efficacy data on prescription drugs is unearthed via discovery in tort and other litigation. 120 But only a subset of drugs become the subject of litigation, and the relevant data often remains secret pursuant to protective or sealing orders. 121 While some companies have voluntarily committed to clinical trial data sharing, and efforts by independent and academic researchers to expand voluntary data sharing like the Good Pharma Scorecard 122 are gaining traction, a majority of drug companies still decline to share their data fully. 123 Gaps may be particularly likely where the data is most consequential, and in notable cases, companies have refused to disclose despite repeated requests and even legal action initiated by researchers. 124

## Reliance on Foreign Drug Regulators

*p. 25*
In Europe and Canada, regulatory authorities have taken significant steps toward data publicity. 125 Both are important examples, but reliance on foreign regulators will always be an imperfect solution. Each policy is limited in certain ways-for example, applying only prospectively or limiting the persons who may apply. In addition, drugs are often approved in the United States before they are approved anywhere else, 126 and some drugs are never approved anywhere but the United States. 127 We also do not know if companies submit the same data to different regulatory agencies, and it is plausible that the FDA, which is the most robust drug regulatory agency in the world, has more data, particularly in controversial cases, than do other regulators.

*p. 25*
European and Canadian policies do, however, provide some access to important data and represent significant examples of successful data disclosure programs. The European Union's European Medicines Agency (EMA) has proportion increased to 33% when companies were given an opportunity to improve their policies and practices").

*p. 25*
124. As a vivid example, the drug company Sarepta Therapeutics refuses to share data on its FDA-approved drug eteplirsen with an independent journalist despite years of FOIA litigation. permitted release of clinical trial data upon request since 2010, via "Policy 0043." The policy is broad, potentially covering any documents held by the agency, but requesters must be European citizens or residents. 128 The agency may withhold commercially confidential information but has taken a narrow view of that exception. 129 It has released clinical study reports with very minimal redactions, an approach recently upheld by the Court of Justice of the European Union (CJEU) against a drug company's objection that this violated its intellectual property interests. 130 Reactive data disclosures, however, can be slow and limited -in its first six years, the policy apparently released fewer than four hundred thousand pages of documents. 131 In 2015 the EMA also implemented a proactive policy, "Policy 0070," for releasing the types of trial data discussed here: summary data, metadata, and (eventually) individual patient data. 132 But the policy applies only prospectively, to drug applications submitted after 2015, 133 and it was suspended in 2018 and remains suspended as of late 2020. 134 Policy 0070 is an important precedent: the EMA made data for over 130 drugs available 135 with no obvious ill effect on the industry. The EMA's redaction policy here too was extremely narrow, and the agency regulations detail the many kinds of safety and efficacy data, such as trial endpoints and statistical data, that are defined, by their nature, as not confidential commercial information. 136 In Canada, a proactive disclosure policy modeled on the EU's launched in early 2019 and, like the EU's, includes most but not all of the data that is important here. 137 Health Canada also announced that it would release historical data on earlier-approved drugs "upon receipt of a request from the public and within the limits of [the agency's] administrative capacity." 138 Proactive disclosure has proceeded gradually: as of August 2020, data from only about sixty-five drugs had been posted; 139 Health Canada has said it will prioritize release of data on first-in-class drugs before expanding to all new drug submissions in 2020 or 2021. 140 Given the limits of the EU and Canadian policies and the scope of the FDA's data holdings, comprehensive data publicity will require action in the United States. However, as we describe later, drawing on these foreign examples can facilitate this work. 141 [Vol. 109:493

## The Freedom of Information Act

*p. 28*
FOIA is currently the most important approach for independent researchers to obtain clinical data from the FDA regarding approved drugs. 142 On its plain text, FOIA might seem like a reasonable way to obtain safety and efficacy data from the FDA. FOIA generally requires a federal agency to make information-"records"-within its possession "promptly available" to "any person" 143 who requests that information. 144 A naïve researcher might reasonably file a FOIA request with the FDA for all of the safety and efficacy data it possesses on a drug of interest and eagerly await the FDA's "prompt" release of that data, as contemplated by the statute. But our naïve researcher is very likely to be disappointed.

*p. 28*
FOIA at the FDA has four key flaws: FOIA requests are (1) reactive and require the requester to know precisely what information she seeks before she asks, (2) slow, (3) resource intensive for requesters, and (4) highly deferential to the pharmaceutical industry. We will describe each in detail and explain how they together buttress the data secrecy regime.

*p. 28*
First, to ensure processing, a FOIA requester must request a limited set of specific, clearly defined data. 145 The requester generally cannot simply ask for data from a particular clinical trial but must identify the precise metadata, summary data, and individual patient data she needs to perform an independent analysis of each trial. This creates an information asymmetry problem, the "requester's paradox": how can a requester request a specific record if she does

## 2021]

*p. 29*
THE BIG DATA REGULATOR, REBOOTED 521 not know how to describe the record, for example, because she is unaware it exists? 146 Second, if the FDA did process our requester's request, the FDA would take months or years to release any information. 147 The FDA's FOIA office is backlogged, with over three thousand FOIA requests outstanding at the end of 2018, and the agency routinely fails to meet the statutory requirements for speed of response. 148 In our experience making and litigating FOIA requests, 149 obtaining clinical data from the FDA takes years, which includes time spent negotiating page-by-page with the FDA over release of individual documents along with long stretches of waiting. Expedited processing is theoretically available 150 but is almost always denied by the agency. 151 Third, FOIA is not only slow but also resource intensive. Successful use of FOIA to obtain clinical data from the FDA requires money and some legal sophistication. 152 for searching, reviewing, and duplicating documents that can run to the tens of thousands of dollars for large productions of data. 153 Fourth, and perhaps most importantly, out of deference to the pharmaceutical industry, the FDA will likely heavily redact whatever data it does release. Therefore, this data will have limited value. One of FOIA's exemptions, Exemption 4, permits an agency to withhold trade secrets and a broader category of confidential commercial information (CCI) from a FOIA requester. 154 The agency has adopted a fairly expansive definition of CCI. 155 Although FOIA is a permissive statute that allows agencies to voluntarily release information, even if the information qualifies as a trade secret or as CCI, 156 the FDA's own rules in fact prohibit the agency from disclosing such information. 157 Additional FDA regulations also create default rules that make much of the safety and efficacy data in new drug applications presumptively secret until, or perhaps even after, the moment of FDA approval. 158 . Once an NDA is approved, 21 C.F.R. § 314.430(e) explicitly makes certain summary data available for disclosure. Once certain later milestones are reached-e.g., the FDA approves a generic application that references the NDA-then "[a]ll safety and effectiveness data and information which have been submitted in an application and which have not previously been disclosed to the public [become] available to the public, upon request." Id. § 314.430(f). The FDA has interpreted this rule as meaning that complete safety and efficacy data is not disclosable to FOIA requesters at the moment of approval but only becomes disclosable when a milestone event enumerated in subsection (f) occurs. See, e.g., 50 Fed. Reg. 7452, 7490 (1985) (stating that under 314.430(f), "safety and effectiveness data and information . . . are publicly disclosable as soon as an abbreviated [generic] application under section 505(j) of the act for the product can be made effective . . . ."); Frequently Asked Questions on Botanical Drug Development, FDA, https://www.fda.gov/about-fda/center-drug-evaluation-and-research-cder/frequently-asked-questions-botanical-drug-product-development [https://perma.cc/WP9A-V6TF] ("What kind of IND and NDA data may be released without prior permission from the sponsor? . . . Once an NDA is approved, FDA may release certain safety and efficacy information ( § 314.430(e))."); Defendants' Supplemental Memorandum of Law in Support of Motion for Summary Judgment at 12-13, Seife v. FDA, No. 1:17-cv-03960 (JMF), 2020 WL 5913525 (S.D.N.Y. Oct. 6, 2020), ECF No. 146 (stating that "any information [in an NDA] that did not appear in the SBA [i.e., the action package posted on Drugs@FDA] after approval was considered confidential and would remain so unless previously disclosed to the public"). Contrary to the FDA's interpretation, the rule's text does not explicitly state that full results cannot be made public before the identified milestone events but rather that such results will be released after such events. The plain text thus leaves room for discretionary disclosure, though it does not require mandatory disclosure. The regulations for biologic drugs (including vaccines) differ in a manner that supports this interpretation. Under 21 C.F.R. § 601.51, the FDA has bound itself to disclose all safety and efficacy data in a BLA from the moment of approval. 21 C.F.R. § 601.51(e) (2019) ("After a license has been issued, the following data and information in the biological product 2021] THE BIG DATA REGULATOR, REBOOTED 523 application in question has not been made public, no data is available. 159 However, if the application's existence has been made public, then the FDA has discretion to "disclose a summary of such selected portions of the safety and effectiveness data as are appropriate for public consideration of a specific pending issue." 160 Moreover, the FDA's current process gives drug companies, not agency officials, the first opportunity to determine which clinical data on their products to disclose and which to keep secret. The agency permits companies to designate data and other information as CCI upon submission, 161 notifies companies of FOIA requests, and permits them to propose withholding of that data before it is released to the FOIA requester. 162 While the FDA has an obligation to independently verify the submitters' proposed withholding and redaction, 163 it does not always do so, 164 perhaps because of the agency's limited resources, deep backlog of FOIA requests, or desire to avoid confrontation with the industry. Between 2008 and 2017, the FDA most frequently cited FOIA file are immediately available for public disclosure unless extraordinary circumstances are shown . . . ."). All of the disclosure provisions of both sections 314.430 and 601.51 are subject to a proviso: if the drug company can show "extraordinary circumstances," then data can remain secret for longer. As Eisenberg has noted, "industry has successfully resisted a plain meaning interpretation" of these provisions, and the FDA does not regularly disclose additional safety and efficacy data even when a drug goes generic. Eisenberg, The Role of the FDA, supra note 19, at 381. Lietzan has suggested that the FDA has concluded that "extraordinary circumstances" apply any time that the clinical data in question retains any competitive value, even overseas, such that "as a practical matter it does not release the content in question." Lietzan, A New Framework, supra note 21, at 43. However, we have not found any instance in which the FDA publicly committed itself to that definition.

*p. 31*
159 164. In a number of FOIA cases, the FDA has initially withheld documents under Exemption 4, deeming the documents to be CCI without having independently or properly verified their status, only to release them later as non-CCI upon court order or negotiation with the FOIA requester. See, e.g., Seife v. FDA, No. 17-cv-03960 (JMF), 2020 WL 5913525, at *2 (S.D.N.Y. Mar. 27, 2019) (holding that "the FDA's redactions [under Exemption 4] are overbroad" and ordering the FDA to "re-review and, as necessary re-redact, the documents that are in dispute"); Order re: Defendant's Motion for Summary Judgment at 21, AIDS Healthcare Foundation v. FDA, No. 11-cv-07925-MMM (JEMx), 2014 WL 10983763 (C.D. Cal. Aug. 6, 2013), ECF No. 60 (holding that the FDA "has failed to demonstrate that the safety and efficacy records that have been withheld are 'confidential' financial and commercial records" and "order[ing] the FDA to produce complete and unredacted copies of the safety and efficacy records to" the FOIA requester); Public Citizen HRG v. FDA (Bextra), PUB. CITIZEN, https://www.citizen.org/litigation/public-citizen-hrg-v-fda-bextra/ [https://perma.cc/PSK9-3H28] (explaining that Public Citizen made a FOIA request to the FDA for certain metadata concerning the drug valdecoxib (Bextra), which was initially withheld but then released after Public Citizen filed a complaint). See generally, Lurie & Zieve, supra note 98 (describing multiple cases in which the FDA did not properly review redactions by submitters and later released these documents after FOIA requests or threats of lawsuits). in 2016. 170 Before FMI, submitters generally had to show that the disclosure would cause "substantial" competitive harm to the submitter in order to support withholding as CCI. 171 This definition was narrow enough to permit some determined FOIA requesters to obtain some (incomplete) safety and efficacy data on FDA-approved drugs. 172 FMI held instead that information could be withheld as "confidential" if it "[was] both customarily and actually treated as private by its owner and provided to the government under an assurance of privacy . . . ." 173 The FMI decision thus raises a troubling prospect: drug companies and the agency have more latitude than ever before to subjectively determine whether material remains secret from FOIA requesters. 174 Both drug companies and the FDA face many temptations to secrecy. 175 However, the FDA still possesses authority to proactively disclose safety and efficacy data that qualifies as a trade secret or CCI. FMI confirmed, not undermined, this authority. 176 A brief example drawn from our own experience may illuminate how these four problems together make it difficult for researchers to understand FOIA. In December 2016, investigative journalist Charles Seife filed a targeted FOIA request for safety and efficacy data, agency records, and correspondence concerning the drug eteplirsen (Exondys 51), which is marketed by Sarepta 170. Food Mktg. Inst. v. Argus Leader Media, 139 S. Ct. 2356, 2366 (2019). In order for an agency to justify withholding data, new statutory language introduced in the FOIA Improvement Act of 2016 requires the agency to prove that it "reasonably foresees that disclosure would harm an interest protected by" the FOIA exemption. 5 U.S.C. § 552(a)(8)(A)(i)(I). The Supreme Court did not decide if this language heightens the standard for withholding for FOIA requests filed after 2016. This statutory text, not yet construed by any court cases in connection with Exemption 4, provides an alternative basis for FOIA requesters to argue that FOIA Exemption 4 cannot possibly cover anything and everything that regulated entities subjectively deem secret upon submission to a regulator. open whether information or data that is merely "customarily kept private, or at least closely held, by the person imparting it" constitutes CCI, or whether the information or data must also be subject to "some assurance" from the agency that receives the submission "that it will remain secret" to the submitter. Id. But while this open question may provide FOIA requesters with a glimmer of hope, the FDA's long-standing regulations, ones that promise the secrecy of much of the safety and efficacy data in drug applications, may render this potential second element of the FMI test moot.

*p. 33*
175. Id. at 2368 (Breyer, J., dissenting) (noting the "temptation, common across the private and public sectors, to regard as secret all information that need not be disclosed, . . . for reasons no better than convenience, skittishness, or bureaucratic inertia").

*p. 34*
Therapeutics and was approved by the FDA for treatment of Duchenne muscular dystrophy earlier in 2016. Seife became interested in eteplirsen because of the controversial circumstances of its approval; in his words, the FDA "overruled its own scientific advisers, rejected the recommendations of its review panel, triggered a formal internal dispute process, and apparently sparked the resignation of one senior official and the retirement of another." 177 Sarepta now charges close to $1,000,000 per patient per year for eteplirsen 178 despite the fact that, even as of mid-2020, it had yet to generate any persuasive evidence that the drug actually works. 179 Seife's 2016 FOIA request was narrowly targeted and sought a specific subset of safety and efficacy data-Clinical Study Reports, protocols and protocol amendments, statistical analysis plans and plan amendments, and regulatory communications-from two specific clinical trials of eteplirsen. 180 The FDA denied Seife expedited processing, placed his request in the "complex processing queue," and declined to provide an estimate of when his request would be fulfilled. 181 With legal help from Yale's Collaboration for Research Integrity and Transparency and Media Freedom and Information Access Clinic, with which both of us are affiliated, Seife filed a FOIA suit against the FDA in May 2017. 182 As of writing in summer 2020, more than three years later, most of the data Seife seeks remains secret, 183 despite eteplirsen's use by patients with Duchenne muscular dystrophy, projected annual sales of over $400,000,000, 184 and hundreds of hours of pro bono legal assistance. Sarepta has intervened in the suit as a co-defendant, and Seife continues to litigate. Sarepta and the FDA continue to argue that, under the Supreme Court's new FMI test, the clinical data Seife seeks can be withheld from Seife and other members of the public. 185 [Vol. 109:493 at the FDA is still more acute because, when the industry and data sets are the targets, confidential commercial information and patient privacy arguments compound the general problems with FOIA.

*p. 36*
The FDA has historically lacked the will to try proactive disclosure. 194 In 2006, Lurie and Zieve remarked that the FDA's tradition of disclosure lagged behind the rest of the Department of Health and Human Services (HHS). 195 What is different now? For one, there is growing enthusiasm among both academics and policy makers to examine and challenge corporate influence over regulatory agencies and to bolster those agencies' power, integrity, and accountability. 196 Political will for real reform may be building as well. President-elect Joe Biden has called for safety and efficacy data on any FDA-approved COVID-19 vaccine to "be made available to the public for independent expert review," as part of a "dedication to science, coordination, transparency, truth, and fairness to all . . . ." 197 Moreover, the legal case for proactive disclosure has become both stronger and more urgent since June 2019 because of the Supreme Court's decision in FMI. 198 As noted above, FMI dealt further damage to the already broken FOIA system, making it harder than ever for researchers to use FOIA to get safety and efficacy data from the FDA. At the same time, the decision contained a littlenoticed silver lining: it confirmed that agencies have authority to disclose information to the public even when that information is protected by FOIA Exemption 4. We propose creating a separate, functional proactive disclosure regime alongside FOIA that embraces this authority.

*p. 36*
194. O'Reilly and Fisher have explained how then-FDA Commissioner Frank Young and other FDA officials intervened during the negotiation and passage of the Hatch-Waxman Act in 1984 to express the view that the Act did and does not expand the agency's obligation to disclose safety and efficacy data, despite statutory language mandating that "[s]afety and efficacy data" "be made available to the public, upon request," under various circumstances. Pub

## A. The FDA's Authority to Disclose Safety and Efficacy Data

*p. 37*
Proactive disclosure of clinical trial data and other evidence of the risks and benefits of prescription drugs and vaccines is legal. Some commentators, especially in the pharmaceutical industry, have suggested that release of this information is simply illegal, whether because of the absence of authority to disclose or because of actual prohibition by statute. 199 The FDA itself has sometimes, 200 but inconsistently, 201 adopted this view. This view is mistaken. Proactive disclosure is permitted under existing law because agencies have the right to release data in their possession unless specifically prohibited by law. The Supreme Court 202 and members of the executive branch, including President Obama and the Solicitor General of the United States under President Trump, have repeatedly recognized this principle. 203 Congress formally recognized [Vol. 109:493 agencies' proactive disclosure power in the federal "housekeeping statute," 204 codified at 5 U.S.C. § 301, which grants all federal agencies general authority to disclose information in their possession. 205 In fact, the FDA already has statutory authority to release many varieties of data about pharmaceuticals, including metadata, summary data (aggregate data), and executable (analyzable) data from clinical trials, as well as certain real-world evidence gathered by the FDA. And FOIA is not itself a limit to disclosure, because while certain exemptions permit agencies to withhold information from requesters, no FOIA exemption standing alone requires agencies to withhold. 206 disclose information,'" "even if a district court's order requiring disclosure under FOIA is stayed pending appeal, the government could simply release the records itself, rendering any appeal moot," and "nothing in an appeal by a nongovernment person could prevent the agency's disclosure of its own records." (quoting Chrysler, 441 U.S. at 294)); Freedom of Information Act: Memorandum from Barack Obama, of the United States, for the Heads of Executive Departments and Agencies, 74 Fed. Reg. 4683 (Jan. 21, 2009) ("The presumption of disclosure should be applied to all decisions involving FOIA. The presumption of disclosure also means that agencies should take affirmative steps to make information public."); Memorandum from the Attorney General for Heads of Executive Departments and Agencies Concerning the Freedom of Information Act (FOIA), 74 Fed. Reg. 51,879 (Oct. 8, 2009) ("I strongly encourage agencies to make discretionary disclosures of information. An agency should not withhold records merely because it can demonstrate, as a technical matter, that the records fall within the scope of a FOIA exemption."). At one point, the FDA itself recognized this principle. Public Information, 42 Fed. Reg. 3094, 3103 (Jan. 14, 1977) ("Agencies and departments subject to the FOIA may decide not to disclose exempt material; they are not required to withhold it.").

*p. 38*
204. Chrysler, 441 U.S. at 309 n.39. 205. "The head of an Executive department or military department may prescribe regulations for the government of his department, the conduct of its employees, the distribution and performance of its business, and the custody, use, and preservation of its records, papers, and property." 5 U.S.C. § 301. In Chrysler, the Supreme Court named § 301 as a source of authority for agencies to create proactive disclosure regulations. Chrysler, 441 U.S. at 309 n.40 ("This does not mean, of course, that disclosure regulations promulgated on the basis of § 301 are 'in excess of statutory jurisdiction, authority, or limitations' for purposes of § 10(e)(B)(3) of the APA, 5 U.S.C. § 706(2)(C)."). Certain circuit court decisions can be read to suggest that 5 U.S.C. § 301, as a "housekeeping" statute, does not provide agencies with "substantive" authority to craft regulations and policies concerning disclosure. See, e.g., In re Bankers Trust Co., 61 F.3d 465, 470 (6th Cir. 1995); Exxon Shipping Co. v. U.S. Dep't of Interior, 34 F.3d 774, 777 (9th Cir. 1994). However, these decisions uniformly address and criticize agency efforts to withhold information from discovery under the alleged authority of § 301, in contravention of the statute's explicit command that "[t]his section does not authorize withholding information from the public or limiting the availability of records to the public." 5 U.S.C. § 301. These decisions do not hold that an agency cannot promulgate rules for proactive disclosure under the authority of § 301. See Gen. Eng'g, Inc. v. NLRB, 341 F.2d 367, 374 n.10 (9th Cir. 1965) (holding that the housekeeping statute is not "a convenient blanket to hide anything Congress may have neglected or refused to include under specific secrecy laws"). Agencies promulgated proactive disclosure regulations under the authority of § 301 at least as recently as the 1960s and '70s-see, e.g., Sears 206. The Supreme Court has explained repeatedly that agencies' proactive disclosure authority extends not just to information outside the scope of the FOIA exemptions but to information within these exemptions, including FOIA Exemption 4. FOIA Exemption 4 merely permits agencies to withhold "trade secrets and commercial or financial information obtained from a person and privileged or confidential." 5 U.S.C. § 552(b)(4). In Chrysler v. Brown, the Court squarely held that FOIA Exemption 4 is an "exception to the disclosure mandate of the FOIA and not a limitation on agency discretion."

*p. 39*
Existing limits on the FDA's disclosure of safety and efficacy data on prescription drugs primarily arise from two concerns: patient privacy and trade secrecy. 207 Patient privacy is a widely accepted value 208 and one we share. Privacy is a vital concern any time clinical data is shared, and the risk of violation of patient privacy is particularly critical when individual patient data is released. Privacy concerns are even more pronounced when the patient population is stigmatized, as in trials of medical abortion drugs or treatments for sexually transmitted infections. Privacy is harder to protect where the clinical study size is small or the disease is rare. The FDA currently, and properly, exempts from disclosure any data that "constitutes a clearly unwarranted invasion of personal privacy," 209 and the agency discloses safety and efficacy data only after the data has been "deidentified" to remove information that readily identifies individual patients to protect patient privacy. 210 As explained in Part II.B, the FDA's rules and practices on deidentification appear reasonable and should be incorporated into the "rebooted" data publicity regime we propose. Existing protocols for deidentification make the practice a viable one for the agency and for researchers. 211 As we discuss below, reidentification is a potential concern, and data use agreements can and should be used to forbid it. 212 However, we disagree with the FDA's stance on trade secrecy and the related concept of CCI. That stance is currently the central obstacle to Chrysler, 441 U.S. at 291 n.11. "[T]he FOIA by itself protects the submitters' interest in confidentiality only to the extent that this interest is endorsed by the agency collecting the information." Id. at 293. "Congress did not limit an agency's discretion to disclose information when it enacted the FOIA." Id. at 294. In Ruckelshaus v. Monsanto Co., the Court concluded that even if certain health, safety, and environmental data about pesticides submitted to the EPA were trade secrets, the Federal Government had the authority to disclose that data as long as it did not provide assurances to the company that it would not do so. 467 U.S. 986, 1004-05 (1984). The Supreme Court's recent decision in FMI again confirms, albeit with little fanfare, that federal agencies possess discretion to proactively disclose material that falls within the scope of FOIA Exemption 4. Food Mktg. Inst., 139 S. Ct. at 2362. In FMI, respondent Argus Leader argued that the petitioner's "injury is not redressable because a favorable ruling would merely restore the government's discretion to withhold the requested data under Exemption 4, and it might just as easily choose to provide the data anyway." Id. The Court dismissed this argument not by questioning the agency's (USDA) discretionary authority to disclose the requested data but instead by relying on the agency's assurances that it would not exercise that authority unless compelled to do so by court order. Id. As such, FMI implicitly acknowledged the agency's discretion to disclose information eligible for withholding under FOIA Exemption 4. 207. See, e.g., FDA's Clinical Data Summary Pilot Program: Questions Frequently Asked by Industry, FDA (May 2, 2018), https://www.fda.gov/drugs/development-approval-process-drugs/fdas-clinical-data-summary-pilot-program-questions-frequently-asked-industry [https://perma.cc/38ZL-CEGJ] ("FDA will redact selected portions of the CSRs for trade secrets, confidential commercial information, and personal privacy information."). FOIA formally reflects both of these concerns in 5 U.S.C. § 552(b)(4) (trade secrets and CCI) and § 552(b)(6) (personal privacy). meaningful public access to safety and efficacy data on prescription drugs. 213 The FDA's professed concern over trade secrecy arises from two distinct federal trade secrecy statutes that govern the FDA: section 301(j) of the Food, Drug, and Cosmetic Act (FDCA), codified at 21 U.S.C. § 331(j), and the Trade Secrets Act (TSA), codified at 18 U.S.C. § § 1905-1909-but the FDA's concern also implicates other sources of trade secrecy law, including FOIA, the Uniform Trade Secrets Act (UTSA), and other state-level trade secrecy laws. 214 We consider each and show that none of these sources of law creates an impassable barrier to data publicity.

## Section 301(j) of the Food, Drug, and Cosmetic Act (FDCA)

*p. 40*
The first statute-section 301(j) of the FDCA-is no barrier to safety and efficacy data publicity at all. Section 301(j) only prohibits "revealing, other than to the Secretary or officers or employees of the Department, or to the courts when relevant in any judicial proceeding under this chapter, any information acquired . . . concerning any method or process which as a trade secret is entitled to protection . . . ." 215 Contrary to the FDA's prevailing view that this section covers some safety and efficacy data, 216 the statutory language is limited to manufacturing information-information "concerning any method or process"-and no court has ever construed § 301(j) to cover safety or efficacy data. The Tenth Circuit has held that § 301(j) "is arguably narrower than [the already narrowly construed trade secret provision of FOIA] Exemption 4 in that 213. See supra notes 199-200 and accompanying text. 214. The FDA has, at times, improperly conflated these sources. See, e.g., Trade Secrets and Commercial or Financial Information that Is Privileged or Confidential, 39 Fed. Reg. 44,612 (Dec. 24, 1974) ("[I]t is not feasible or practical to determine the differences, if any, between the confidentiality provisions in 18 U.S.C. 1905 and 21 U.S.C. 331(j), and in the Freedom of Information Act. If there are any differences, they are extremely subtle and small. Accordingly, the Commissioner intends, for practical reasons of daily administration of the law, to regard the coverage of these provisions as identical.").

*p. 40*
215 30, 2000) ("FDA will not disclose any information from postmarketing study reports that is considered a trade secret as defined in § 20.61(a) and section 301(j) of the act (21 U.S.C. 331(j)) . . . ."); 39 Fed. Reg. 44,602, 44,612, 44,633 (1974) (stating that "[u]nder the Federal Food, Drug, and Cosmetic Act, . . . the safety and effectiveness data for new drugs and new animal drugs, including antibiotic drugs for veterinary use, fall within the trade secrets exemption" and that "[e]ven if [disclosure of trade secrets and CCI] would be in the public interest, in order to protect the public health, and even if the Commissioner wishes as a matter of discretion to release such material, such disclosure cannot lawfully be undertaken"); see also Francer

## THE BIG DATA REGULATOR, REBOOTED 533

*p. 41*
it is limited to information relating to methods or processes whereas Exemption 4 applies to all trade secret information." 217

## The Trade Secrets Act (TSA)

*p. 41*
The second statute, the TSA, 218 requires somewhat more extensive analysis, but ultimately it, too, creates no legitimate barrier to disclosure of the safety and efficacy data we describe above. 219 The TSA is a criminal statute that prohibits federal employees from disclosing certain confidential information when not "authorized by law": Whoever, being an officer or employee of the United States or of any department or agency thereof, . . . publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which information concerns or relates to the trade secrets, processes, operations, style of work, or apparatus, or to the identity, confidential statistical data, amount or source of any income, profits, losses, or expenditures of any person, firm, partnership, corporation, or association; . . . shall be fined under this title, or imprisoned not more than one year, or both; and shall be removed from office or employment. 220 Under the plain text of the Act, disclosure of trade secrets is permissible whenever "authorized by law." The FDA, as we explain below, has the statutory authority to disclose safety and efficacy data, making such disclosure "authorized by law" and within the power of the FDA. 221 The agency need not even evaluate whether the data in question is a trade secret, but as we explain below, 222 can simply promulgate a rule that explicitly authorizes disclosure "by law" and thus avoid conflict with the TSA. The data use agreements we advise below 223 would also permit the agency to contractually prohibit behavior that would violate trade secrecy law, and further insulate regulators from any sanction under the TSA.

*p. 41*
However, agencies are undoubtedly more likely to release information that they believe does not rise to the level of trade secret protection, so we first explain why clinical trial data will not generally be protected by trade secrecy law generally. Two questions arise when assessing whether the TSA even covers safety and efficacy data. The first is whether clinical trial data can ever be considered trade secrets, even under the most expansive understanding of that term. The second is whether the TSA incorporates a narrow or broad definition of "trade secret." As to the first question, safety and efficacy data generally will not meet the definition of a trade secret under current law. State trade secrecy laws are grounded in the UTSA and common law. These laws generally sweep broadly to protect any information that is secret, is subject to reasonable efforts to maintain its secrecy, and that "derives independent economic value" from being secret from competitors who can "obtain economic value from its disclosure or use." 224 The data we seek would rarely meet even this broad definition, contrary to the industry's assertions. 225 First, by its nature, safety and efficacy data has little or no direct value to brand-name competitors developing alternative compounds and thus will confer minimal or no competitive advantage to the company on whose behalf the FDA is currently maintaining secrecy. While PhRMA, one of the two largest pharmaceutical industry trade organizations in the world, has contended that safety and efficacy data "would provide competitors with relevant insight into how to develop other, competitive products," 226 courts have held that most safety and efficacy data from clinical trials have no demonstrable competitive value. 227 Regarding individual patient-level data, competitors generally cannot use "subject-specific data to demonstrate the safety or effectiveness of other products," because "[t]he slightest change in the pharmaceutical formulation or dosage" from an existing drug to a new one can 224. See UNIF. TRADE SECRETS ACT § 1(4) (UNIF. L. COMM'N 1985) ("'Trade secret' means information, including a formula, pattern, compilation, program, device, method, technique, or process, that: (i) derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use."); see also Restatement (Third) of Unfair Competition at § 39 (Am. L. Inst. 1995).

*p. 42*
225. See, e.g., PhRMA Comment Letter, supra note 199 (asserting that disclosure of safety and efficacy data "could cause grave competitive harm to the research-based biopharmaceutical industryand subsequently damage incentives to take new products through the costly drug approval process").

## 2021]

*p. 43*
THE BIG DATA REGULATOR, REBOOTED 535 render the data unacceptable for approval of the new drug. 228 Incomplete but nonetheless informative summaries of much of the same safety and efficacy data must already be disclosed via ClinicalTrials.gov and the FDA's Drugs@FDA website, 229 blunting whatever adverse competitive impact disclosure of the complete set of safety and efficacy data could have. Courts have ruled that clinical trial protocols can in general be released by the FDA, concluding that they do not meet the definition of CCI (more capacious even than trade secrets) under FOIA Exemption 4. By the time a drug is approved, years have likely passed since the clinical trials relied on for approval were designed. This increases the likelihood that details of those trials' designs have been disclosed through other means, thus decreasing their competitive value. Some worry that releasing safety and efficacy data would undermine periods of data exclusivity. 230 "Data exclusivity" law forbids a generic competitor from relying on originator data when seeking an abbreviated application for a follow-on generic or biosimilar drug. But a generic company that could obtain a full data set from the originator might theoretically instead seek to have its product approved as an original rather than a generic or biosimilar drug, evading data exclusivity. 231 As we explain below, the FDA can and should impose data use agreements on data users, which would prohibit competitors from making this kind of use of the data. 232 Data sharing in this fashion will not undermine data exclusivity in the United States. PhRMA has also contended that disclosure of safety and efficacy data would cause competitive harm overseas, because "these data could be used to support approval in virtually every other country in the world, even after redaction of trade secret information." 233 An analysis of drug regulatory processes in leading likely contain no "innovative features" whatsoever and thus not qualify for secrecy, whatever the definition of trade secret or CCI applied. 239 However, these rare circumstances cannot be a fortiori ruled out, making redactions and data use agreements sometimes important to effective data publicity.

*p. 45*
All of the foregoing analysis considered a first question of whether safety and efficacy data constitute a trade secret under the broad definition of trade secrecy that prevails at the state level. Also pertinent is a second question regarding the scope of the TSA's definition of "trade secrets" as it is the TSA, not state law, that directly applies to FDA officials. We believe that definition should be narrowly construed, lest it encompass a great deal of information that is important to the public, but of minimal importance to business. The TSA was adopted, notably, in 1948, an era when trade secret law was less capacious. 240 The Seventh Circuit has suggested that Congress likely intended that the TSAa "rather obscure criminal statute"-to at most prevent agencies from releasing "that narrower category of trade secrets-secret formulas and the like-whose disclosure could be devastating to the owners and not just harmful. Ruckelshaus v. Monsanto, the Supreme Court also gave the TSA little weight in a case about agencies' power to release "health and safety data" under the Takings Clause. 242 Moreover, on two occasions, it appears the FDA has proactively disclosed discrete non-public safety and efficacy data on FDAapproved drugs when doing so served the public interest. 243 To our knowledge, the FDA faced no litigation or other negative consequences after these actions.

## a. Statutory Authority to Promulgate Regulations: the FDCA and the Food and Drug Administration Amendments Act of 2007 (FDAAA)

*p. 46*
Finally, the TSA prohibits disclosure of trade secret information only when that disclosure is "not authorized by law." 244 This means that the FDA can legally disclose safety and efficacy data even if that data is deemed a trade secret, so long as the FDA makes the disclosure pursuant to an authorizing regulation with proper "force of law." 245 An agency disclosure regulation has the "force of law" when promulgated under a grant of Congressional authority via statute. 246 242. Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1001-02, 1008-09 (1984) (concluding that the Trade Secrets Act was "not a guarantee of confidentiality to submitters of data," even in a case where it assumed the information was a trade secret under state law).

*p. 46*
243. In 1980, the FDA published a letter in the New England Journal of Medicine criticizing an article a drug company had published in the same journal. The drug company's article suggested that a clinical trial proved that an already-approved drug (Anturane) was safe and effective for an as-yet unapproved (off label) method of use. The FDA's letter provided a detailed critique of the trial and the drug company's claims and apparently disclosed to the public previously secret data from the trialdata that could have qualified as CCI under the FDA's definition. See Temple & Pledger, supra note 201. In Pub. Citizen Health Rsch. Grp. v. FDA, No. 04-304 (D.D.C. Feb. 26, 2004), the FDA settled a FOIA litigation and released NDA documents concerning unapproved uses of the FDA-approved drug valdecoxib (Bextra) that may have been deemed CCI, at least at the time of the litigation. This case is described in Lurie & Zieve, supra note 98.

*p. 46*
244. 18 U.S.C. § 1905. 245. See Memorandum from William B. Schultz to Allan Coukell, Director, Pew Prescription Project 4 (Aug. 5, 2009), https://www.regulations.gov/document?D=FDA-2009-N-0247-0097 [https://perma.cc/E6QS-DLMF] ("[I]t is not necessary to address [the question of whether clinical data is protected by the TSA] because the Trade Secret bar does not apply where disclosure is authorized by law."); see also INST. OF MED. OF THE NAT'L ACADS., supra note 18 at 71 ("One important open question is the extent to which the FDA may have the authority to issue regulations that override the ordinary constraints of the TSA.").

*p. 46*
246. Chrysler Corp. v. Brown, 441 U.S. 281, 302 (1979) ("The legislative power of the United States is vested in the Congress, and the exercise of quasi-legislative authority by governmental departments and agencies must be rooted in a grant of such power by the Congress and subject to limitations which that body imposes."); see also Qwest Commc'ns Int'l Inc. v. FCC, 229 F.3d 1172, 1177 (D.C. Cir. 2000) (interpreting Chrysler and holding that the relevant question is "whether [a] reviewing court could reasonably conclude that the statutory grant of authority contemplated the regulations providing for release of information"). According to the Supreme Court, an "authoriz[ing]" pro-disclosure regulation, for purposes of the TSA, must have "force and effect of law." Chrysler, 441 U.S. at 298, 301. Assuming it is promulgated with proper process, a disclosure regulation has the requisite force and effect of law so long as there is "a nexus between the regulations and some delegation of the requisite legislative authority by Congress." Id. at 304. The nexus standard is permissive: "[t]he use agreements that limit who uses data and how those users use that data will further shield the FDA, as we describe below. 247 Two distinct statutes empower the FDA to promulgate an authorizing regulation, with force of law, to permit or require disclosure of safety and efficacy data without risk of criminal liability under the TSA. One is the general purpose rulemaking provision of the Food, Drug, and Cosmetics Act (FDCA). 248 Section 701(a) of the FDCA grants the FDA blanket "authority to promulgate regulations for the efficient enforcement of" the FDCA, including the FDCA's mandate to "protect the public health by ensuring that . . . human and veterinary drugs are safe and effective." 249 The other statute is a more recent provision of the Food and Drug Administration Amendments Act of 2007 (FDAAA), which expanded the FDA's already broad mandate to disclose information on drug safety. 250 Subsection (r)(1) compels the Secretary of HHS to "improve the transparency of information about drugs and allow patients and health care providers better access to pertinent inquiry is whether under any of the arguable statutory grants of authority the . . . disclosure regulations . . . are reasonably within the contemplation of that grant of authority." Id. at 306; see also id. at 308 ("This is not to say that any grant of legislative authority to a federal agency by Congress must be specific before regulations promulgated pursuant to it can be binding on courts in a manner akin to statutes. What is important is that the reviewing court reasonably be able to conclude that the grant of authority contemplates the regulations issued."); Parkridge Hosp. v. Califano, 625 F.2d 719, 724 (6th Cir. 1980) (holding that a statute that provided, generally, that "no disclosure . . . shall be made except as the Secretary may by regulations prescribe" met the Chrysler nexus standard (citing 42 U.S.C. § 1306(a))). . The FDA has expressed a justifiably expansive view of its powers under § 371(a), stating that it "gives FDA general rulemaking authority to issue regulations for the efficient enforcement of the [FDCA]." Availability for Public Disclosure and Submission to FDA for Public Disclosure of Certain Data and Information Related to Human Gene Therapy or Xenotransplantation, 66 Fed. Reg. 4688, 4694 (proposed Jan. 18, 2001). The FDA explicitly recognized that § 371 authorizes it to disclose even information protected by the TSA. "FDA's issuance of this proposed rule is authorized even if the information to be disclosed could be considered confidential commercial information covered by Exemption 4 and within the scope of protection of the Trade Secrets Act (18 U.S.C. 1905)." Id. The FDA ultimately withdrew the proposed rule but did not repudiate its interpretation of FDCA § 371(a). See 67 Fed. Reg. 33040, 33045 (withdrawing the proposed rule without comment). Courts endorse a broad interpretation of the FDA's power to regulate under § 371(a). See Nat'l Ass'n of Pharm. Mfrs. v. FDA, 637 F.2d 877, 889 (2d Cir. 1981) (holding that 21 U.S.C. § 371(a) confers power to make substantive regulations that are binding); Pharm. Mfrs. Ass'n v. FDA, 484 F. Supp. 1179, 1183 (D. Del. 1980) (holding that § 371(a) "has been broadly construed to uphold a wide variety of assertions of regulatory power," so long as regulations promulgated under § 371(a) "effectuate a Congressional objective expressed elsewhere in the [FDCA]"); see also United States v. Nova Scotia Food Prods. Corp., 568 F.2d 240, 246 (2d Cir. 1977) (holding generally that "[w]hen agency rulemaking serves the purposes of the statute, courts should refuse to adopt a narrow construction of the enabling legislation which would undercut the agency's authority to promulgate such rules"). 250. 21 U.S.C. § 355(r). On the mandate, see supra Part I.B (explaining, inter alia, FDAAA's mandate to disclose safety and efficacy data through ClinicalTrials.gov and approval packages); see also Andrew C. von Eschenbach, The FDA Amendments Act: Reauthorization of the FDA, 63 FOOD & DRUG L.J. 579, 581 (2008) (describing FDAAA as "massive legislation" informed by a "spirit of transparency"). information about drugs by developing and maintaining an Internet Web site" that "improves communication of drug safety information to patients and providers." 251 Disclosure of safety and efficacy data by the FDA pursuant to a regulation promulgated under either of these statutes would constitute disclosure "authorized by law."

*p. 48*
Below we outline the data publicity regime that the FDA should create through regulation. 252 We close this subpart by observing that when the FDA creates regulations authorizing and implementing disclosure of safety and efficacy data, it can and should concomitantly revise its set of existing disclosure regulations, which insufficiently define and support the agency's proactive disclosure power. 253 The FDA should embrace its proactive disclosure authority and provide stakeholders with notice and certainty. The FDA should revise its rather vague definition of CCI 254 to match the EMA's definition 255 and clarify that only safety and efficacy data that has a genuine "commercial or financial" character qualifies as CCI. This revision should set out in advance clear examples of what may qualify and what likely will not. The FDA should also rescind 21 CFR § 20.61(c), which unnecessarily surrenders the agency's discretionary disclosure authority by promising that "[d]ata and information submitted or divulged to the Food and Drug Administration which fall within the definitions of a trade secret or confidential commercial or financial information are not available for public disclosure." Short of rescission, the FDA should at least specify in a new, superseding rule that § 20.61(c) does not apply to safety and efficacy data. 256 The FDA should also revise scattered rules that promise, or can 251. 21 U.S.C. § 355(r), (r)(1). Congress did not cabin the proper scope of HHS's authority (or that of its delegee, FDA) to disclose of drug safety information but instead explicitly extended its discretion to define and disclose "other material determined appropriate by the Secretary." 21 U.S.C. § 355(r)(2)(B)(vii). While the phrase "other material determined appropriate by the Secretary" has not, at time of writing, been interpreted by any court, it seems clear that Congress intended to authorize FDA to disclose information protected as a "trade secret" or as "confidential commercial information." In another subsection of the same section of FDAAA ( § 355(l)(2)), written at the same time, Congress explicitly withheld authorization to disclose information that qualifies as a trade secret or CCI, but Congress did not withhold this authorization in subsection (r). Compare 21 U.S.C. § 355(r) (which places no limits on disclosure) with id. § 355(l)(2) (the provision of FDAAA that requires "[p]ublic disclosure of safety and effectiveness data and action package[s]" but which explicitly "does not authorize the disclosure of any trade secret, confidential commercial or financial information, or other matter listed in section 552(b) of title 5."). As explained above, supra Part I.A, drug safety and drug efficacy are inexorably linked, and the mandate of § 355(r) to publicize "information about drugs" and "drug safety information" should be understood to encompass safety in the context of a particular usethat is, safety in the context of efficacy. , which declares that any information that meets the FDA's definition of CCI or a trade secret will not be disclosed. Once these regulations have been duly rescinded, the FDA will have no legal obligation to provide the companies that submit safety and efficacy data with notice or an opportunity to be heard before the FDA proactively discloses be construed to promise, secrecy for specific submissions of safety and efficacy data. 257

## B. Rebooting the FDA's Disclosure Rules: A Roadmap to Data Publicity

*p. 49*
We have explained that the FDA has all the statutory authority it needs to proactively disclose safety and efficacy data on pharmaceuticals. The only step required to reboot the FDA's data disclosure is for the agency to promulgate and implement, pursuant to that statutory authority, a relatively simple set of authorizing rules that establish procedures for effective data publicity oriented around non-commercial uses and public health. Here we provide a high-level roadmap to those rules, including what we believe are four key features:

*p. 49*
(1) Prospectively disclosing data on all newly approved drugs;

*p. 49*
(2) Retrospectively disclosing historical data on a limited number of important drugs;

*p. 49*
(3) Requiring the industry to submit its clinical data in redacted, publicly disclosable form to minimize burden on the FDA; and (4) Requiring users to make data requests and enter into data use agreements to prevent misuse of sensitive data. These four features are intended to ensure effective clinical trial publicity while assuaging the two chief concerns that have historically limited the FDA's data disclosure: patient privacy and trade secrecy. The fourth feature will be particularly valuable because data use agreements will not only help to protect patient privacy and relieve any lingering concerns over trade secrecy, but will also increase flexibility, reduce administrative costs, and limit the agency's potential legal liability.

## Prospective Disclosure of Data on All Newly Approved Drugs

*p. 49*
Going forward, the FDA should disclose the safety and efficacy data we described above 258 -metadata, summary data (including FDA analyses), and individual participant data-for all the drugs it approves. Disclosure should occur on the day of, or immediately after, approval because it is in the months following approval that safety and efficacy data is most useful. 259 Of course, the FDA should also disclose later-collected safety and efficacy data from studies of that data. Disclosing data for all FDA-approved drugs will ensure that all patients have access to information about the drugs they are putting in their bodies, regardless of whether the drug is a blockbuster taken by millions of patients or an orphan drug used by only a handful. Given that the costs of preparing data for disclosure will be borne by the pharmaceutical industry, not the FDA, 261 we see no reason for the FDA to limit data disclosure to only a subset of approved drugs, such as those that are controversial or best-selling. Access to broad data sets that incorporate data from many different drugs will also allow some of the promised benefits of big data to emerge, including applications of artificial intelligence. 262

## Retrospective Disclosure of Historical Data on a Limited Number of Highly Important Drugs

*p. 50*
What to do with the enormous trove of data that the FDA currently possesses on already-approved drugs? We believe that at least some of this historical data should be disclosed. Retrospective disclosure of this sort involves practical and legal obstacles that prospective disclosure does not. Our analysis of the primary potential legal hurdle-the Takings Clause-is presented below. 263 As we explain below, takings claims will be surmountable. The bigger hurdle to retrospective disclosure will likely be practical, not legal; locating, formatting, and redacting data for public disclosure would be expensive and time-consuming for the agency. We propose the FDA could begin by retroactively disclosing data from a relatively small number of drugs-perhaps ten to twenty per year. These drugs could be selected based on their aggregate public health significance (e.g., by number of prescriptions or by the impact on overall disease burden), economic importance (e.g., top drugs by revenue), specific concerns over safety or efficacy, or other factors the FDA deems appropriate. The drugs could be selected by experts within the FDA or by an expert advisory committee. [Vol. 109:493 incompletely or incorrectly redacted, whether over-or under-redacted, and by threatening to place ongoing trials on clinical hold if sponsors do not comply. 268 The costs imposed on the industry to prepare these redactions would be non-zero but reasonable. As one admittedly inexact point of comparison, in 2001, the FDA estimated the cost of redacting safety and efficacy data in one investigational new drug (IND) application to prepare it for public disclosure at approximately $124,000 269 (in 2001 dollars, equivalent to about $185,000 today 270 ). As another point of comparison, a 2020 National Academies report on clinical trial data sharing suggests the costs of redacting and otherwise preparing individual patient data for publication are only a few thousand dollars per trial. 271 And, as noted above, the EMA and Health Canada already require the industry to prepare redactions in line with what we propose. 272 The FDA should also follow the lead of the EMA in another respect and revise its regulatory definitions of trade secrecy and CCI to define the many specific forms of clinical data that will generally qualify as neither, to clarify its policies to the industry and prevent overbroad redactions. 273 Indeed, there are good reasons for the FDA to adopt rules for redaction that closely resemble the EMA's and Health Canada's. As noted above, the EMA currently maintains the world's most extensive data publicity regime for clinical trial data on prescription drugs (though it is stalled as of writing), 274 and the EMA has propounded a properly narrow definition of redactable CCI. 275 Health Canada has modeled its nascent data publicity regime after the EMA's. 276 Harmonizing the FDA's redaction rules with those of the EMA and Health Canada would minimize burdens on the drug companies that perform the redaction, allow these regulatory agencies to double check each other's work, and improve overall compliance. 277 Because of its potential privacy implications for patients, individual patient data provides the most significant logistical challenge. 278 While not purporting to detail here how such data can be deidentified most effectively, we do note that protocols, though perhaps imperfect, are already in place, 279 and that the FDA has long experience with redacting individual patient information before disclosing clinical data. 280 The FDA's 2018 clinical data summary pilot program provides a helpful template for deidentification, 281 as do Health Canada's 282 and the EMA's 283 guidance on deidentification of clinical data.

*p. 53*
Deidentification is not a panacea. As artificial intelligence grows more powerful and as more data on each of us is collected, aggregated, and traded by corporations, reidentification becomes more likely and more deeply problematic. 284 We might reasonably fear, for example, insurers reidentifying individual people from a clinical trial in patients with chronic disease to deny coverage to those whose treatment costs are likely to be highest, 285 or residential landlords using reidentification to discriminate against potential renters with certain health conditions, such as HIV. 286 Where certain forms of individual patient data are particularly susceptible to reidentification, such as individual adverse event reports for drugs that treat rare diseases, 287 the risk might be so great that the data should not be disclosed at all. But past experience with clinical data disclosure shows that reidentification can be discouraged-and its harms reduced-through imposition of data use agreements, which contractually prohibit reidentification and other unauthorized use. 288 These agreements form the fourth key feature of data publicity that we describe here, and we turn to them now.

## Data Requests and Data Use Agreements

*p. 54*
Some safety and efficacy data can be disclosed to the public without restriction, as it does not implicate patient privacy or other protected interests. This is particularly true for certain high-level metadata and summary data, like clinical study reports (with minimal redactions to excise manufacturing information or individual information about patients) and internal assessments prepared by the FDA. 289 The same data can and should be released to FOIA requesters in the same way. But open access is the wrong solution for more sensitive data.

*p. 54*
The FDA should limit access to more sensitive data that implicates patient privacy, risks competitors' misuse, or concerns another legitimate interest. First, the FDA should disclose sensitive data only upon receipt of a "data request" from the prospective user. Each request should be reviewed by the FDA. In this review, the FDA could confirm that a given requester is credible and intends to use the data for a legitimate purpose, such as meta-analysis of clinical trials to be published in the medical literature. 290 Requiring data requesters to complete data requests should minimize frivolous requests and thereby reduce the a technical trick derived from cryptography that adds mathematical "noise" to data sets to effectively obscure information about individuals within a data set while still permitting analysis of wider patterns in the data. 299 In this Article we raise but do not attempt to settle the debate over the optimal technical restrictions for clinical trial and other medical data. 300 Rather, the data publicity regime we sketch in this Article can adapt to different technical and legal controls that FDA and outside experts ultimately deem appropriate.

## C. Defending Data Publicity

*p. 57*
If the FDA adopts the proactive data publicity regime we propose, it will undoubtedly be met with industry resistance. The FDA's past proposals for even modest proactive disclosure of safety and efficacy data provoked a barrage of criticism and threats of legal challenges. 301 We have already addressed one of the most important criticisms of data publicity above 302 -the notion that disclosure of clinical data will threaten patient privacy. The pharmaceutical industry's two main remaining arguments are a policy argument-disclosure will erode incentives to innovate-and a legal one-disclosure will violate the Takings Clause of the Fifth Amendment. Neither withstands scrutiny.

## Incentives to Innovate

*p. 57*
The pharmaceutical industry has repeatedly protested that disclosure of safety and efficacy data would be bad public policy. The industry argues that, whatever the benefits, disclosure would permit later market entrants to "free ride" on an innovator company's clinical techniques and clinical data, thereby undermining incentives to develop new drugs. 303 For example, in 2010, PhRMA submitted comments to the FDA alleging that "[i]mplementation of [an FDA proposal to consider release of non-summary (raw) safety and effectiveness data within INDs, BLAs, and NDAs] could cause grave competitive harm to the research-based biopharmaceutical industry-and subsequently damage incentives to take new products through the costly drug approval process." 304 The pharmaceutical industry makes these arguments despite the absence of any study showing conclusively that clinical data secrecy provides significant incentives to innovate. Nonetheless, the incentives-to-innovate argument against data publicity is widespread 305 and worth examining carefully.

*p. 58*
One foundational observation is that drug companies will continue to generate and submit clinical trial data to the FDA for as long as they continue to develop drugs, whatever the FDA's disclosure policy. This is because statute 306 and FDA rules 307 continue to require that data in order to approve new drugs and new indications of existing drugs. Generation and submission of clinical trial data is thus a non-negotiable condition of participation in the marketplace.

*p. 58*
The pharmaceutical industry argument that companies will choose to abandon drug discovery and development altogether for fear of free riders undercutting returns on investment, or even that it would necessarily diminish incentives to innovate at all is unfounded. We have shown above 308 that disclosure of safety and efficacy data will cause no genuine competitive harm to the submitter of that data, whether from competition by brand-name competitors or generic free riders in the United States. To recap, this is because the safety and efficacy data we propose disclosing has little direct competitive value and because the FDA can prevent any genuinely competitive uses of safety and efficacy data through imposition of data use agreements. 309 Competitive harm may not actually be the industry's main objection to safety and efficacy data publicity. Drug companies may simply wish to avoid the release of data showing that their products are ineffective or unsafe. As the D.C. Circuit has observed, drug companies' reluctance to allow the FDA to disclose clinical data on prescription drugs sometimes arises not from a legitimate fear of competitors making use of that data but instead "the embarrassing publicity attendant upon public revelations concerning, for example," violations of safety laws. 310 This is all the more reason to demand disclosure.

*p. 59*
Contrary to the industry's assertions, data publicity can improve innovation incentives. Data publicity can direct companies toward investments in genuinely efficacious medicines. It can discourage wasteful spending on treatments that provide no meaningful therapeutic advantage over older, cheaper alternatives. 311 And, were the United States to develop a centralized or decentralized system for effective drug pricing based upon efficacy, data publicity would help to inform that system. Even absent a formal system of efficacy-based drug pricing, data publicity will discourage the use and purchase of drugs that are entirely unsafe and ineffective and thereby disincentivize their development-a socially useful result.

*p. 59*
A final observation implicates not just incentives but basic concepts of fairness in our system of laws and policies that promote development and distribution of drugs and vaccines. Conceptually, the data that drug companies generate on prescription drugs arguably emerges from a kind of public-private partnership between the industry and the FDA; to deprive the American public of access to data that the public pays to create would be unreasonable. 312 The public often pays directly for the clinical trial data that the pharmaceutical industry generates through public-private partnerships with the NIH and other biomedical research agencies 313 and indirectly through tax credits for clinical trials conducted by the industry. 314 safety and efficacy data might be a reasonable quid pro quo: if drug companies want to sell their products in the enormously profitable U.S. market 315 and benefit from the widespread (though fragile) trust in the safety of drugs that decades of mostly conscientious FDA regulation has cultivated, they must consent to disclosure of clinical data on those products. 316 The pharmaceutical industry's enthusiastic exploitation of the patent system-including so-called "method of use" patents on clinical methods 317 -is another choice that requires (or arguably should require) disclosure of clinical data as a quid pro quo. The publicity of safety and efficacy data that we recommend would expand on and complement the often paltry disclosure of drug patents 318 without disturbing innovators' patent incentives. 319

## Takings

*p. 60*
Drug companies that submit safety and efficacy data from clinical trials of prescription drugs to the FDA have often argued that this data contains trade secrets protected by the Takings Clause of the Fifth Amendment. They contend that disclosure of the data without the submitter's consent constitutes a regulatory taking and requires payment of "just compensation." 320 However, the FDA will owe little or no compensation under the Takings Clause if it begins proactive disclosure of safety and efficacy data.

*p. 61*
For prospective disclosure of any safety and efficacy data submitted to the FDA after the agency implements new data publicity rules, the analysis is simple: the Takings Clause does not apply. In Ruckelshaus v. Monsanto, the leading Supreme Court case on the application of the Takings Clause to data submitted to federal regulatory agencies, the Court held that agency disclosure of industry-submitted information can constitute a taking if and only if the agency first provided an assurance of secrecy. 321 As soon as the FDA ceases assuring the industry that future submissions of safety and efficacy data will be kept secret, all future takings claims will be foreclosed. 322 The takings analysis for retrospective disclosure of safety and efficacy data submitted to the FDA before the agency implements new data publicity rules is more complex but still favors the agency. Under Monsanto, safety and efficacy data could constitute "property" eligible for protection under the Takings Clause if the data is "property" under state law and the agency has promised to keep that data secret. But, as we have argued above, 323 only a relative few subcategories of safety and efficacy data should qualify for protection as trade secrets under ("[T]he statute also gave Monsanto explicit assurance that EPA was prohibited from disclosing publicly, or considering in connection with the application of another, any data submitted by an applicant if both the applicant and EPA determined the data to constitute trade secrets. Thus, with respect to trade secrets submitted under the statutory regime in force between the time of the adoption of the 1972 amendments and the adoption of the 1978 amendments, the Federal Government had explicitly guaranteed to Monsanto and other registration applicants an extensive measure of confidentiality and exclusive use. This explicit governmental guarantee formed the basis of a reasonable investment-backed expectation." (citation omitted)); see also id. at 1008 ("[A]s long as Monsanto is aware of the conditions under which the data are submitted, and the conditions are rationally related to a legitimate Government interest, a voluntary submission of data by an applicant in exchange for the economic advantages of a registration can hardly be called a taking."); id. at 1013 ("[W]e hold that EPA's consideration or disclosure of data submitted by Monsanto to the agency prior to October 22, 1972, or after September 30, 1978 state law: data that has a genuine "commercial or financial" character and some innovative quality, such as new assay methodologies for biomarkers, 324 and data that the FDA formally and unequivocally promises to keep secret after approval, such as where extraordinary circumstances exist for biologic drugs. 325 To the extent that safety and efficacy data does qualify as "property" eligible for protection under the Takings Clause, disclosure of this data will be very unlikely to be construed a taking for two reasons. First, Monsanto held that if an agency does disclose a trade secret against the submitter's wishes, the disclosure does not amount to a compensable taking unless there was interference with "reasonable investment-backed expectations." 326 The Court has elsewhere held that a crucial aspect of the character of the governmental action is the "nature of the State's interest" and that a strong, legitimate public interest tips in favor of finding no taking. 327 As explained above, the public 324. Scholars have argued that under the Restatement and state law definitions of a trade secret, information that private industry submits to regulatory agencies will not always qualify for protection as a trade secret. See Levine, The People's Trade Secrets, supra note 241; Levine, Secrecy and Unaccountability: Trade Secrets in Our Public Infrastructure, supra note 241; Lyndon, Secrecy and Access, supra note 241. In Part II.A, supra, we explained that a few subcategories of clinical data that have genuine "commercial or financial" character and some innovative quality, such as new assay methodologies for biomarkers, properly qualify as confidential commercial information (CCI). In our view, it is, at most, these subcategories of clinical data that meet the definition of a trade secret found in the Restatement (First) of Torts, under which a trade secret must "differ[] from other secret information in a business . . . in that it is not simply information as to single or ephemeral events in the conduct of the business" and must instead be "a process or device for continuous use in the operation of the business." RESTATEMENT (FIRST) OF TORTS § 757, cmt. b. Moreover, the Supreme Court might revisit or refine Monsanto-which relied on a stipulation of all parties, not an actual finding, that trade secrets were property under the relevant state law. he Disclosure Act causes the tobacco companies to lose their trade secrets, entirely, and appellants advance no convincing public policy rationale to justify the taking itself"). Setting aside whether Philip Morris was correctly decided, the facts of Philip Morris are readily distinguishable insofar as the FDA can articulate a convincing public policy rationale to justify disclosure of safety and efficacy data on prescription drugs-see supra Part I.A-and, indeed, already has in some instances. See Availability for Public Disclosure and Submission to FDA for Public Disclosure of Certain Data and Information Related to Human Gene Therapy or Xenotransplantation, 66 Fed. Reg. 4688, 4692 (proposed Jan. 18, 2001) ("The agency believes that there is great benefit in having human gene therapy and xenotransplantation products scrutinized, as they are being developed, by individuals with a wide variety of perspectives . . . because of the unique blend of proposed benefit interest in disclosure of safety and efficacy data on prescription drugs is strong. Second, the economic impact of disclosure would be minor, given the weakness of trade secrecy arguments and the impact of data use agreements that prevent competitor drug companies from relying on the data in their own drug applications or otherwise making harmful competitive use of the data. 328 As such, courts should conclude that disclosures of the kind we describe do not "take" company property at all. 329 CONCLUSION AND EXTRAPOLATION Comprehensive access to clinical trial data is important to protect public health and the integrity of the FDA. Today, researchers and clinicians can only rarely access all of the data they need to validate the efficacy and safety of medicines and guide clinical practice. The current data secrecy regime has already contributed to the deaths of tens of thousands of people and will continue to put the public at risk until steps are taken to proactively disclose data. Regulators in Canada and the EU have taken halting steps in this direction, showing that it can be done, but gaps remain that only the FDA can fill. Here, we show how an administration committed to health care reform and corporate accountability could reboot the FDA and establish an effective proactive clinical trial data publicity regime.

*p. 63*
The data publicity regime we propose will also help the FDA protect its staff and resources. The FDA has been described in recent years as an under resourced agency squeezed by political, industry, and patient pressures. 330 Switching from reactive disclosure through FOIA to data publicity will shift much of the burden of redaction from the agency to the industry and may therefore produce substantial cost savings. The FDA currently spends about $300 as well as potential risk to society that these products possess."). For arguments that Phillip Morris is wrongly decided, and that Monsanto applied differently when the state seeks to shape competition (as it did in that case), and when it seeks to inform the public (as here), see Kapczynski Breast Implant Safety (Mar. 25, 2019), https://www.politico.com/newsletters/prescription-pulse/2019/03/25/up-this-week-breast-implant-safety-414932 [https://perma.cc/NR7H-3T9Y] (quoting the former head of the FDA, Scott Gottlieb, as asking "[i]s trying to increase transparency around complete response letters the best use of the finite public resource i [sic] have?"). [Vol. 109:493 million per year fulfilling FOIA requests, at about $3,000 per request. 331 A significant portion of the FOIA requests fielded by the FDA are for clinical data on approved products. 332 Making this data available through alternative means should reduce the volume of FOIA requests and the costs incurred by processing them. The FDA could then reallocate the money and employee time saved on FOIA to implementing and maintaining the data publicity system. Second, and perhaps more important, data publicity will permit independent researchers to double-check and otherwise support the work of the agency, reducing its error rate and increasing its overall efficiency and credibility. And, of course, from the wider public's perspective, data publicity is an excellent bargain even if it requires increasing the FDA's budget and staff, as it is likely to save hundreds of millions, even billions, of dollars in spending on unsafe and ineffective drugs. 333 We conceived our data publicity regime and wrote this Article before the COVID-19 pandemic began. Now, as we finish our Article in the summer of 2020, the novel coronavirus has cost hundreds of thousands of lives and devastated our country and the world. This catastrophe has exposed and exacerbated innumerable longstanding and systemic problems in our society, our economy, and our politics-problems beyond the scope of this Article. But the virus has also raised issues of data secrecy in a new and unusually vital way. The benefits that would flow from data publicity 334 are desperately needed vis-à-vis COVID-19, including improvements in clinical care; better coordination of clinical research, including avoidance of redundant or unproductive clinical trials; acceleration of the development of new therapies; and validation of the work of the FDA.

*p. 64*
This last benefit-double-checking the FDA's work-may be particularly crucial at a moment when the FDA finds itself under enormous pressure to shepherd new medical technologies to market as quickly as possible. For example, HHS's "Operation Warp Speed" and President Trump called on the FDA to approve COVID-19 vaccines and therapeutics on an unprecedentedly short timetable, and raised concerns that decisions would be made on the basis of incomplete or less than convincing evidence of safety and efficacy. 335 The FDA has already been criticized for hurrying to grant an emergency use authorization for the COVID-19 treatment remdesivir before anything more than preliminary analysis had been published on the clinical trial data that supported the authorization. 336 Our proposed data publicity regime would insulate and support the agency in this challenging time.

*p. 65*
Our ultimate goal, through the COVID-19 pandemic and beyond, is to supplement and strengthen the FDA's capacity, credibility, and authority. The features we propose, like shifting the burden of redaction to the pharmaceutical industry and creating data use agreements that prohibit commercial use, are intended to serve that goal.

*p. 65*
There is, of course, a risk that the agency will not act. 337 If the FDA does not act, Congress can and should. Congress has already acted recently to expand access to certain health data by mandating that the FDA publish approval packages 338 and postmarket drug safety information (including adverse event data at the individual patient level, in anonymized form) 339 on its website. Congress could do the same with the safety and efficacy data we describe. If Congress decides to legislate in this arena, it could helpfully clear up any lingering uncertainty about the boundaries of 18 U.S.C. § 1905 (the TSA) and 21 U.S.C. § 331(j) ( § 301(j) of the FDCA) by mandating release of the specific types of safety and efficacy data we have defined-see supra Part I.Anotwithstanding these statutes. 340 Our analysis also points to a broader problem that is woven through the regulatory state in our information age. Commerce and industry are increasingly informational, making access to data essential to understand the implications of a wide range of products, from self-driving cars to environmental chemicals to complex financial instruments. The same dynamics we trace here-the incentives the industry has to hide data even as it relies on this data to claim that its products will benefit the public-are pervasive. Whether it is Boeing, touting 337. As Justice Breyer observed in his dissent in FMI v. Argus Leader, there is a "temptation, common across the private and public sectors, to regard as secret all information that need not be disclosed . . . for reasons no better than convenience, skittishness, or bureaucratic inertia." Food Mktg. Inst. v. Argus Leader Media, 139 S. Ct. 2356, 2368 (Breyer, J., dissenting). 340. Congress could also ensure that both the FDA and drug companies cooperate with a mandatory data publicity regime by amending the provisions that concern approval of new drugs, 21 U.S.C. § 355 (NDAs) and 42 U.S.C. § 262 (BLAs), to make submission of redacted, publicly disclosable data a precondition of approval and to require FDA disclosure within some defined time period, such as within 30 days of approval. Congress could also legislate to expand disclosure of Phase 4 clinical trial data by making post-approval extensions to patents and other exclusivities that cover prescription drugs conditional on disclosure of that data. For example, the statutes governing patent term extension (35 U.S.C. § 156) and pediatric extensions (21 U.S.C. § 355a) could be amended to require that the drug application holder submit (in appropriately redacted form), and the FDA disclose, all relevant Phase 4 data before the FDA grants the extension. the safety of its planes while hiding their inner workings from regulators and the public, 341 or Monsanto, urging the safety of its pesticides but suing the EPA to prevent public release of safety data, 342 companies have perverse incentives to claim virtue for their products but obscure the data that would enable third parties to validate their claims. Regulators will often possess relevant data but have limits-resources, person power, and conflicts of their own-that prevent the real benefits of this data from being leveraged unless outside parties have access. But those seeking access to corporate data in other areas are likely to face the same obstacles we address here: the cost and complexity of FOIA and the problems of the new FMI standard; the tendency of agencies to overprotect corporate data and treat as confidential or trade secrets data that may not meet that definition; 343 the inability to overcome corporate opposition and privacy concerns without proactive disclosure; and the need to create some limits on disclosure and access to protect values like personal privacy.

*p. 66*
The model we offer of data publicity subject to data use agreements will be informative for other agencies. Our analyses of the TSA and takings law are generalizable and can help support data publicity beyond the pharmaceutical context. There will be, of course, fact-specific questions about where and when disclosure is warranted, and even circumstances where calls for transparency will be disingenuously mobilized to harm the public. 344 It is important to appreciate, as we have stressed, that data publicity at the FDA can inform the public, because it occurs within a particular political economy that includes publicly funded scientists with the skills and desire to analyze that data. These elements will be important to the success of other data publicity regimes too. We leave to future work exploration of the need for and avenues to data publicity elsewhere in the regulatory state. ), https://www.scribd.com/document/385677020/Letter-from-Harvard-leaders-to-EPA-s-Andrew-Wheeler-on-proposed-science-policy [https://perma.cc/RZN7-5VNS] (describing the problems with an EPA "transparency" proposal that would have undermined access to reliable climate science).

## Footnotes

> See National Health Expenditures 2017 Highlights, CTRS. FOR MEDICARE & MEDICAID SERVS.,

> 23. See Pozen, Transparency's Ideological Drift, supra note 22; Margaret B. Kwoka, FOIA, Inc., 65 DUKE L.J. 1361, 1388 (2016).

> 40. Phase 4 trials are also called post-market or post-marketing trials.See Biologics Post-Market Activities, FDA (Sept. 18, 2018), https://www.fda.gov/vaccines-blood-biologics/guidance-complianceregulatory-information-biologics/biologics-post-market-activities [https://perma.cc/DP5C-WVET] (referencing "post-marketing study commitments (also known as Phase IV studies)"). 41. See 21 U.S.C. § 355(b) (NDAs); 42 U.S.C. § 262(a) (BLAs). 42. See 21 C.F.R. § § 314.50(d)(5) (2019) (requiring submission of safety and efficacy data in NDAs); 601.2(a) (requiring "safety, purity, and potency" for BLAs); see also

> See Omudhome Ogbru, Indications for Drugs (Uses), Approved vs. Non-Approved, MEDICINENET, https://www.medicinenet.com/indications_for_drugs__approved_vs_nonapproved/views.htm [https://perma.cc/QNJ3-AJ76] (explaining indications);

> https://www.regulations.gov/document?D=FDA-2019-N-2012-0001 [https://perma.cc/78LY-NFT9]. [Vol. 109:493

> and patients widely support 103. See Letter from Peter Doshi et al. re: Docket No. FDA-2019-N-2012 ("New Drugs Regulatory Program Modernization: Improving Approval Package Documentation and Communication") (Aug. 23, 2019), https://www.regulations.gov/contentStreamer?documentId=FDA-2019-N-2012-0010&attachmentNumber=1&contentType=pdf [https://perma.cc/3HQD-GV6N]; see also Herder et al., supra note 99. 104. Perry Nisen & Frank Rockhold, Access to Patient-Level Data from GlaxoSmithKline Clinical Trials, 369 NEW ENG. J. MED. 475, 476 (2013) (describing these two kinds of patient-level data, raw and analysis-ready, and GSK's efforts to make them more available to researchers). 105. Joseph S. Ross et al., Overview and Experience of the YODA Project with Clinical Trial Data Sharing After 5 OF MED. OF THE NAT'L ACADS., supra note 18, at ix; Developing Global Norms for Sharing Data and Results During Public Health Emergencies, WORLD HEALTH ORG. (Sept. 2015), http://www.who.int/medicines/ebola-treatment/data-sharing_phe/en/ [https://perma.cc/PEN6-86U4];

> 125. See, e.g., Alexander C. Egilman, Amy Kapczynski, Margaret E. McCarthy, Anita T. Luxkaranayagam, Christopher J. Morten, Mathew Herder, Joshua D. Wallach & Joseph S. Ross, Transparency of Regulatory Data Across the European Medicines Agency, Health Canada, and US Food and Drug Administration, J.L. MED. & ETHICS (forthcoming 2021); Arti K. Rai, Risk Regulation and Innovation: The Case of Rights-Encumbered Biomedical Data Silos, 92 NOTRE DAME L. REV. 1641, 1660-63 (2017). 126. See Nicholas S. Downing, Jerenius A. Aminawung, Nilay D. Shah, Joel B. Braunstein, Harlan M. Krumholz & Joseph S. Ross, https://policyoptions.irpp.org/magazines/july-2017/why-some-essential-medicines-areunavailable-in-canada/ [https://perma.cc/3V74-BHXM].

> 154. See 5 U.S.C. § 552(b)(4). 155. See 21 C.F.R. § 20.61(b) (2019) ("156. See infra Part I.A. 157. See 21 C.F.R. § 20.61(c) (2019); see also id. § 20.82(b). 158. See id. § 314.430 (small molecule NDAs); id. § 601.51 (biologic BLAs)

> . 21 C.F.R. § § 314.430, 601.51 (2019). 160. Id. § § 314.430(b)-(d), 601.51(b)-(d). 161. Id. § 20.61(d). 162. Id. § 20.61(e)(3). This rule implements a 163. 21 C.F.R. § 20.61(e) (2019).

> 198. Food Mktg. Inst. v. Argus Leader Media, 139 S. Ct. 2356 (2019).

> 222. See infra Part II.A. 223. See infra Part II.B.4. [Vol. 109:493

> 308. See supra Part II.A.