The Protection of Genetic Privacy in Biobanking at International Level

This chapter sketches a baseline level of protection for genetic privacy rights in biobanking, against which legal systems, including the General Data Protection Regulation (GDPR), might be compared. This baseline level of protection is provided via identifying principles dealing with the protection of all types of genetic privacy rights, and rights holders, in biobanking in the international framework. The chapter identifies two types of international principles: common international principles—principles identified in a majority of all biobank-relevant international instruments; and emerging international principles—principles identifiable in a majority of biobank-specific international instruments. It also offers a critical analysis of the protection offered under the international framework. This critique does not aim to undermine the legitimacy of regarding identified international principles as offering a baseline level of protection. Rather, it merely aims to highlight that the protection provided has flaws, and thus should not be regarded as definitive or perfect.

Genetic Data, Genome Understanding, and Socially Relevant Information

This chapter discusses the range of types of data which might be subject to genetic analysis to produce socially relevant information. These genetic data include raw genomic data as well as other types of data, such as phenotype data and inheritance data. Genetic analysis of these types of data is currently capable of producing a wide range of socially relevant information, including information concerning identity, genetic relationships, phenotype, health, and social and behavioural traits. It is not the case, however, that each type of genetic data can be subject to only one type of genetic analysis to produce only one type of socially relevant information. Rather, each type of genetic data, particularly genomic data, can be subject to multiple types of genetic analysis. Nor is it necessarily the case that genetic analyses produce socially relevant information which is completely accurate. Rather, the degree of accuracy of information will usually depend on multiple factors. The chapter then looks at the range of parties about whom socially significant information may be produced.

Testing the GDPR in Relation to Biobanking

This chapter looks at when the General Data Protection Regulation (GDPR) applies, rationae materiae, to biobanking—only when the law applies to biobanking can it be expected to provide any protection for genetic privacy rights in biobanking at all. The GDPR's applicability criteria are outlined in Article 2; criteria concern both the types of processing activity covered by the GDPR and the mechanics of processing covered by the GDPR. In relation to the mechanics of biobank processing, the situation is complex. The key question which emerges is which types of biobanking substances can qualify as personal data? The concept of personal data can be usefully broken down into two aspects of any processing operation. First, the substance being processed: to qualify as personal data, a substance must be able to fulfil three criteria. A substance must be ‘information’, it must ‘relate to’ a specific person, and that person must be a ‘natural person’. In the biobanking context, health, lifestyle, and biographical information, sequenced genomic data, and individual research results certainly fulfil these criteria. Second, the link between the substance and a specific individual: to qualify as personal data, a substance must relate to an individual who is ‘identified or identifiable’. All biobanking substances processed in either linked or pseudonymised form will certainly qualify as ‘identified or identifiable’.

Genetic Privacy and Other Interests in Biobanking

This chapter evaluates the concept of genetic privacy and its relationship with biobanking. Genetic privacy is simply a sub-concept of privacy referring to states of separation and exclusivity arising in relation to the processing of genetic data. Genetic privacy rights, then, are simply a subset of privacy rights relating to the processing of genetic data. The chapter then proceeds to map the range of genetic privacy rights engaged by the biobanking process along two axes: the transactional axis—genetic privacy rights held by research subjects; and the relational axis—genetic privacy right held by genetic relatives and genetic groups. Subsequently, it moves to map other types of interests engaged by biobanking, including interests related to the research process and third-party non-research interests in accessing biobank substances. Finally, the chapter offers a rough schematic of the relationships, including conflicts and confluences, between identified rights and interests.

Conclusion

This concluding chapter argues that European data protection law, under the General Data Protection Regulation (GDPR), can and ought to be looked at to play a central role in the protection of genetic privacy in biobanking in Europe. In the first instance, the substantive framework presented by the GDPR already offers an impressive baseline level of protection for genetic privacy. In turn, while numerous problems with this baseline standard of protection are identifiable, the GDPR offers the normative flexibility to accommodate solutions to these problems, as well as the procedural mechanisms to facilitate the realisation of solutions. The interaction between GDPR and biobanking is still, however, in the early stages. Whether this potential is realised now depends on the decisions and actions of regulatory stakeholders in the biobanking space. Their decisions have the potential to optimise or undermine the GDPR as a system for the protection of genetic privacy in biobanking. The biobanking community also have consequential choices as to how they perceive and operationalise the GDPR.

Testing the GDPR in Relation to Biobanking

This chapter explains how the General Data Protection Regulation's (GDPR) substantive provisions apply to biobanking. It breaks provisions down into seven groups—oversight, legitimate processing, data subject rights, data controller obligations, international transfers, sanctions, and derogations—and provides a detailed analysis of the applicability of provisions in each group in turn. The protection offered by the substantive provisions of the GDPR, however, is liable, in relation to certain types of biobanking processing, to vary between European states. Although the GDPR is, in principle, intended to be directly applicable in all states in which it applies, the law does contain several derogation possibilities relevant for biobanking—for example in relation to data subject rights. European states have already taken advantage of these possibilities to pass national laws applicable to biobanking, outlining provisions which deviate from the default standard of protection.

Introduction

This introductory chapter provides an overview of the protection of genetic privacy in biobanking. The fact that genomic research relies on the processing of large quantities of individuals' genomic data has raised new questions as to which forms of privacy right are engaged by research, and as to which privacy rights holders are engaged by research: questions of genetic privacy. Ordinarily, one might look to the law to provide some clue, or image, as to which genetic privacy rights are worthy of protection and as to what an effective and proportionate approach to their protection should look like. In this regard, a brief look at the legal landscape relevant to biobanking in Europe reveals a great quantity of legislation apparently relevant for the protection of genetic privacy in biobanking. This book then takes an in-depth look at the function, problems, and opportunities presented by the General Data Protection Regulation (GDPR) as a framework for the protection of genetic privacy in biobanking in Europe.

Testing the GDPR in Relation to Biobanking

This chapter addresses how the biobanking process—in the instances in which it falls within the scope of the General Data Protection Regulation (GDPR)—is classified under the GDPR's classification systems. These classification systems do not, themselves, constitute substantive provisions; they do not consist of rights or obligations. They are, however, key in determining the types of actors to whom substantive provisions apply and the way in which substantive provisions apply. The chapter begins with a detailed elaboration of the GDPR's two key classification systems: the actor classification system and the personal data classification system. It then describes how the actor classification system applies to actors involved in the biobanking process, focusing on the applicability of the concepts of ‘data subject’, ‘data controller’, and ‘data processor’. Finally, the chapter considers how the personal data classification system applies to personal data processed in biobanking, looking, in particular, at the applicability of the concepts of ‘genetic data’ and ‘data concerning health’.

Do We Need Data Protection at All?

This chapter assesses whether there is any need to consider European data protection law as a framework for the protection of genetic privacy in biobanking in Europe at all. To answer the question, the chapter conducts a thought experiment and examines what the standard of protection in Europe would look like if one were to exclude data protection law from consideration. This is merely a thought experiment, as data protection already plays, and will continue to play, a significant role in the protection of genetic privacy in biobanking in Europe. The exercise is enlightening, however, in showing the extent of flaws in protection in European legal systems stripped of data protection. In this regard, the chapter then maps the protection provided to genetic privacy in biobanking by the EU's, and three European states'—Estonia, Germany, and the UK—legal systems. It then engages in a critical analysis, highlighting the significant inadequacy of the protection provided by these systems excluding data protection law. Finally, the chapter shows why, generally, European data protection law under the General Data Protection Regulation (GDPR) looks a viable solution to address the problems displayed by other approaches.

A Critical Analysis of the Efficacy of the GDPR as a Framework for the Protection of Genetic Privacy in Biobanking

This chapter presents a critical analysis of the efficacy of the General Data Protection Regulation (GDPR) as a framework for the protection of genetic privacy in biobanking. In this regard, it outlines twenty-three problems concerning the standard of protection offered by the GDPR, assessing the degree to which each problem casts doubt on the efficacy of the GDPR. The chapter considers whether there are factors evident which are likely to mitigate the severity of the impact of each problem, as well as whether each problem is subject to resolution——either through the GDPR's internal interpretation and adaptation mechanisms or through external legislation operating in tandem with the GDPR. The analysis demonstrates that the great majority of problems are not as severe as they initially seem and, as a result, do not call into question the efficacy of the GDPR as a framework for the protection of genetic privacy in biobanking. It also shows that all problems which either require a solution, or would benefit from a solution, can be resolved via the GDPR's internal mechanisms or via external law operating in parallel with the GDPR, or both.