A CRO relies solely on paper-based record keeping citing fears of a data breach by a competitor. Is cleanroom data from this CRO submissible to the FDA?

Yes. Despite the high risk for inaccurate transcription of values and fraud, 21 CFR 11 does not prohibit the use of handwritten or paper-based records. The goal of 21 CFR 11 is merely to enable the use of electronic records, not to require them.