Biobanks and GDPR: A Look at the Portuguese Panorama

The need for the existence of biobanks for health research purposes is something of which government authorities have been aware for several years. One year after the full entry into force of the GDPR, the Portuguese legislature has finally passed the law that ensures the full implementation of the data protection regime’s points left open by the European legislature. However, Portugal has also in place a range of legislation regulating the establishment and functioning of biobanks. The regulation of biobanks for research purposes imposes special protection duties on scientific research activity in which biological samples and associated data are used in order to guarantee protection of privacy and confidentiality.

Swedish Law on Personal Data in Biobank Research: Permissible But Complex

This chapter describes the regulatory and organisational infrastructure of biobank research in Sweden, and how the introduction of the GDPR affects the possibilities to use biobank material in future research. The Swedish legislator has chosen a rather minimalistic approach in relation to the research exception in Article 89 GDPR and has only enacted limited general exceptions to the data protection rules. This may be partly explained by the comprehensive right to public access to official documents which gives researchers vast access to information held in registries, albeit conditioned on abiding by secrecy and confidentiality rules. The Swedish legislation implementing the GDPR includes a general exception from the data protection rules in relation to the right to access to official documents, which researchers also benefit from. However, confidentiality rules for different categories of information differ between sectors, which hinders an effective use of the registries in research. The regulatory regime for using biobank and registry data in Sweden thus involves both data protection and secrecy rules, which makes the legal landscape permissible but complex. The operationalisation of the research exception in Article 89 GDPR is analysed against this background. Special attention is given to the possibility to link personal information derived from biobanks with personal information from other data sources, including large national population based statistical registries as well as information from national clinical registers.

The Regulation of Biobanking in Germany

Biobanking in Germany is currently not subject to sui generis regulation. Instead, a plethora of norms from differing areas of law form the bundle of regulation that applies to biobanking. The exact shape and extent of the bundle depends on the exact configuration of the biobank. In the context of data protection, the rather fragmented nature of the regulation is to a certain extent alleviated by the direct impact of the EU General Data Protection Regulation (GDPR). In particular, the federalized system of data protection in Germany is simplified by an overarching set of norms that apply equally across the board. Whilst this is a welcome systematization of this part of the regulation of biobanking in Germany, the exact nature of the implementation of the Regulation raises novel issues in its own right. In this paper, I will outline the fragmented nature of biobank regulation in Germany, illustrate the issues on the basis of Germany’s population biobank NaKo and then discuss some of the more significant issues raised by the GDPR in the context of biobanking.

Access to Biomedical Research Material and the Right to Data Protection in Finland

This chapter describes the Finnish regulatory landscape concerning primarily non-interventional biomedical research and in particular the rights of study subjects from the data protection point of view. The GDPR is just one of many pieces of legislation affecting the rights of individuals, and it allows for significant variation between the EU Member States. Finnish law relating to biomedical research has materially changed in recent years and some changes are still pending. Overall, the legislator has aimed at enhancing opportunities for responsible research and enabling research-related innovation ecosystems, but also implemented quite strict limitations for data processing in balance. It is yet too early to evaluate the effects of the legislatory changes. The chapter is therefore mainly descriptive.

Introduction

The General Data Protection Regulation (GDPR) is already four years old legal instrument, with over two years of practical experience, yet, several central questions on its application, its importance in scientific research, rights of the data subjects, and obligations on the controllers and processors remain uncharted. In this edited volume, questions ranging from the meaning of the GDPR provisions for a particular research project to impact of the GDPR on long term collaborations, when the UK is leaving the EU are is discussed. This chapter sets out the aim of this book and provides an overview of how various contributions interplay to shed light on how the GDPR shapes the research regimes on the use of personal data in biobanking by EU Member States.

Brexit and Biobanking: GDPR Perspectives

At the time we wrote this chapter, we undertook the almost impossible task of providing a legal analysis of an event (Brexit) that had not happened and might never have happened. This chapter nonetheless contributes to the edited collection in that it reports on the then legal position in the UK, and presents an analysis of two possible immediate post-Brexit legal futures, for data protection law as applicable to biobanking in the UK. These post-Brexit futures are the position if the draft Withdrawal Agreement is ratified and comes into force, and the position if it does not (a so-called ‘No Deal’ Brexit). The chapter concludes with some thoughts on possible longer term futures. The main message is the deep uncertainties surrounding Brexit and what it means in both legal form and in practice.

The Impact of the GDPR on the Governance of Biobank Research

Governance of health and genomic data access in the context of biobanking is of salient importance in implementing the EU General Data Protection Regulation (GDPR). Various components of data access governance could be considered as ‘organizational measures’ which are stressed in the Article 89(1) GDPR together with technical measures that should be used in order to safeguard rights of the data subjects when processing data under research exemption rules. In this chapter, we address the core elements regarding governance of biobanks in the view of GDPR, including conditions for processing personal data, data access models, oversight bodies and data access agreements. We conclude by highlighting the importance of guidelines and policy documents in helping the biobanks in improving the data access governance. In addition, we stress that it is important to ensure the existing and emerging oversight bodies are equipped with adequate expertise regarding using and sharing health and genomic data and are aware of the associated informational risks.

Regulatory Environment for Biobanking in Estonia

The regulatory framework for biobanking in Estonia is fragmented. Whilst a specific law applies to the population-wide biobank, other entities engaged in biobanking are subject to rules stemming from various legal sources. In the case of the population biobank, participants give open consent for their data and tissue to be used in genetic research. Most other entities do not have the possibility to obtain open research consent for the use of personal data. However, national data protection law enables the use of personal data in research without the consent of individuals.In contrast, since no stricter requirements are set, open consent can be used when tissue is obtained directly from individuals for research purposes. However, if tissue is initially obtained for other (research) purposes, further research use requires written consent in the case of blood, while due notification will suffice for most other types of tissue.

Research Biobanking, Personal Data Protection and Implementation of the GDPR in France

Since 1978 and the initial French data protection law (Loi n°78-17 du 6 Janvier 1978), consecutive modifications regarding the protection of personal health data, especially in 2004, 2016 and 2018, set up a strict legal regime for processing sensitive personal data, including for research purposes. In recent years, French law has evolved proactively and in parallel with the work of the European Union (EU) on the preparation of what became the General Data Protection Regulation (GDPR), which has been in force since May 2018. This Chapter performs a state-of-art analysis (as of 1 July 2019) of the French legal framework for research biobanks and data protection rules applying to biobanking, in particular those related to data subjects’ rights and Article 89 of the GDPR. Firstly, it provides updated information about the national landscape of active research biobanks in France (Sect. 1). Secondly, it explores how the French law embodies the developments brought by the GDPR and how it envisages individuals’ rights in the context of research biobanking (Sects. 2 and 3). Thirdly, this Chapter analyses existing and potential national exemptions to individuals’ rights, including with regard to Article 89 GDPR, and how France conceives of processing activities of ‘public interest’ (Sect. 4). Finally, the authors address ongoing debates around bioethics law in France and argue for the creation of a specific Act focused on biobanking as a means of integrating, clarifying and developing not only data protection rules but also other activities related to samples, human or not, in a unique, operational and compact act (Sect. 5).

The Italian Way for Research Biobanks After GDPR: Hybrid Normative Solutions to Balance the Protection of Individuals and Freedom of Research

The Italian context of biobanking is made up of a vast number of collections, in some cases well-organised and connected in virtuous networks and in others not identifiable as structured biobanks. From a comparative perspective, Italy can be regarded as a hybrid model, positioned between countries with full and detailed legislation concerning biobanks and those that rely only on guidelines published by national ethics committees or professional societies that have no binding legal value. In countries like Italy where the need for specific regulation is more urgent, the entry into force of the GDPR could have offered a chance to fill the gap in the legislation with regard to biobanking for medical scientific research purposes. This overview highlights the improvements made and the obstacles that persist.