AUTH/3369/8/20 - Complainant v Pfizer

Access to data behind a website

  • Received
    11 August 2020
  • Case number
    AUTH/3369/8/20
  • Applicable Code year
    2019
  • Completed
    29 March 2021
  • No breach Clause(s)
  • Additional sanctions
  • Appeal
    No appeal

Case Summary

A complainant, who described him/herself as a concerned UK health professional, alleged that two Ecalta (anidulafungin) leavepieces (refs ECA359 and PP-ERA-GBR-0169) which he/she had found online, contained out of date prescribing information. The complainant provided links which referred to the Pfizerpro website and pdf copies of the leavepieces as well as a screenshot of his/her Google search results. Both leavepieces promoted Ecalta for the treatment of invasive candidiasis in adults.

The complainant noted that the first leavepiece (ref ECA359) appeared to have been prepared in 2016 and the prescribing information updated in 2014. There had since been eight updates to the prescribing information and although some of those were minor, the complainant stated that the volume of updates, as well as the lack of an update of the prescribing information in 6 years, was not in keeping with high standards. It was likely that the item had not been recertified since 2016.

The complainant stated that there was no check to ensure someone was not a member of the public. The information displayed on Google itself was bad enough and was apparently promoting to the general public, but that the general public could also download out of date promotional materials was worse.

The detailed response from Pfizer is given below.

The Panel noted from the screenshot provided by the complainant that his/her Google search for ‘Echinocandin’ (the class of medicine to which anidulafungin belonged), appeared to have provided links to the two Ecalta leavepieces.

The Panel noted that, according to Pfizer, the two leavepieces were withdrawn from use in April 2017 and October 2017 respectively, as part of prescribing information updates and had not been available on the Pfizerpro website since; the files were ‘unpublished’ on the Pfizerpro platform meaning that they could no longer be viewed or downloaded from the Pfizerpro website. Since receiving the complaint, Pfizer had learnt that whilst ‘unpublishing’ removed the files from view, it did not delete the pdf files from the folders sitting behind the Pfizerpro website. The URLs for the files could still be accessed by Google and direct links to the files returned in the complainant’s Google search for ‘Echinocandin’. The Panel noted Pfizer’s submission that the health professional self-validation pop-up was not enabled on the URLs for the pdf files as it did not know that Google could directly access them.

The Panel noted that since receiving the complaint, Pfizer had deleted the pdf files for the two leavepieces from behind the Pfizerpro website to ensure that they could not be viewed by Google. The company had also set the status of all embedded pdf files on the Pfizerpro website to ‘private’ which meant that a full login/registration step was required before the files could be accessed; this hid the files from Google ensuring that direct links to the files and associated descriptions would not be returned in any future Google searches for related terms.

Although the Panel was concerned that material that did not appear to meet the requirements of the Code could be accessed, it noted that the two leavepieces had been withdrawn and unpublished from the Pfizerpro website in 2017. The pdf files, however, still sat behind the Pfizerpro website and, in that regard, it seemed reasonable to consider that the leavepieces were on an internal company page rather than one which was intended for an external audience including the public. The Panel noted Pfizer’s submission that website analytics showed that the first time either of the files had been accessed since they were first published in 2016 and 2017 respectively, was on 12 August 2020 when each file had had a single visit from outside the Pfizer virtual private network; Pfizer believed that was the PMCPA downloading the leavepieces as part of the preparation of this case. Pfizer could not explain how the complainant had accessed the leavepieces prior to the submission of his/her complaint on 11 August 2020 without its analytics being able to detect that the files had been accessed. Nor could the company see any evidence that the files had ever been accessed by anyone, health professional or member of the public, prior to those dates.

In the Panel’s view, it was unfortunate that, despite being withdrawn in 2017 and so unpublished and thus unable to be viewed or downloaded from the Pfizerpro website, the two leavepieces, which now contained out of date prescribing information could still be accessed online in August 2020. The Panel considered that the complainant’s submission that there was no check to ensure that he/she was not a member of the public suggested that when he/she had accessed the leavepieces he/she was not on the live Pfizerpro website. It seemed reasonable in this case to consider the leavepieces as material on an internal company site. On balance, the Panel decided that the two leavepieces, which Pfizer had removed from its website but which had unintentionally, and unknown to Pfizer, remained directly accessible by Google, did not amount to promotion of Ecalta to the public. No breach of the Code was ruled.

In the Panel’s view, this case illustrated that companies should exercise extreme caution and, wherever possible, ensure that promotional material which was withdrawn from use was either removed from the internet or securely hidden from view and thus inaccessible by people outside of the company. Given its comments and ruling above, the Panel considered that, in the specific circumstances of this case, the company had not failed to maintain high standards. No breaches of the Code were ruled including of Clause 2.