GDPR And Biobanking: Individual Rights, Public Interest And Research Regulation Across Europe

Contents......Page 6
Introduction......Page 9
Part I: Setting the Foundations......Page 16
1 Introduction......Page 17
2 EU and Biobanking: Building a Research Regime in the Data Protection Framework?......Page 19
3 Building Blocks of the GDPR and the Research Regime......Page 21
4.2 Biobank and Biobanking......Page 24
4.3.1 Scientific Research......Page 26
4.3.2 Individual Rights......Page 28
4.3.3 Public Interest......Page 29
4.3.4 Interaction Between Scientific Research, Individual Rights and Public Interest......Page 31
4.3.5 Implications......Page 32
5 Concluding Remarks......Page 33
References......Page 34
1 Introduction......Page 37
2 Personalised Genetics......Page 38
3 The Central Value of Privacy......Page 40
4 Balancing Privacy with Research Interests from a Human Rights Perspective and the Principle of Proportionality......Page 41
4.1 Premise 1: Promote the Free and Secure Flow of Data Across Borders......Page 42
4.2 Premise 2: Make Sure Informed Consent and/or Ethical Approval Covers All Use of Data......Page 44
4.3 Premise 3: Establish Codes of Conduct for Facilitating Joint Research Projects......Page 45
References......Page 47
Part II: GDPR Insights......Page 49
The Impact of the GDPR on the Governance of Biobank Research......Page 50
1 Introduction......Page 51
2 Processing Personal Data for Scientific Research Purposes......Page 52
3.1 Introductory Remarks......Page 53
3.3 Anonymization of Data......Page 54
4.2 Open-Access......Page 55
4.3 Controlled-Access......Page 56
4.4 Registered Access......Page 57
5.1 Data Access Committees......Page 58
5.2 Data Protection Impact Assessment and Appointment of Data Protection Officers (DPOs)......Page 59
5.3 Data Access Agreements and Data/Material Transfer Agreements......Page 61
6 Conclusions......Page 63
References......Page 64
1 Introduction......Page 66
2.1 Substantive Scope of the GDPR......Page 69
2.2 Geographical Scope of the GDPR......Page 70
3.1 Definition of Controller and Processor......Page 72
3.3 Relationship Between Controllers and Processors......Page 74
4.1 Accountability......Page 75
4.2.1 Categories of Personal Data and Lawfulness in Biobanking......Page 77
General Remarks......Page 78
Necessity-Based Model......Page 79
Consent-Based Model......Page 82
4.3 Fairness and Transparency of Data Processing......Page 86
4.4 Purpose Limitation of Data Processing......Page 87
4.5 Data Protection by Design......Page 89
5 Conclusion......Page 90
References......Page 91
1 Introduction......Page 95
2.1 The Right to Be Informed......Page 96
2.2 The Right of Access......Page 99
2.4 The Right to Erasure......Page 100
2.5 The Right to Restrict Processing......Page 101
2.6 The Right to Data Portability......Page 102
2.8 Rights in Relation to Automated Decision Making and Profiling......Page 103
3.1 Limitations......Page 104
3.3 Lawful Derogations......Page 105
4 Conclusion......Page 106
References......Page 107
1 Introduction......Page 109
2 The Special Regime for Processing of Personal Data for Scientific Research Applied to Biobanks......Page 110
3.2 Derogation to the Information Requirements......Page 113
3.3 Derogation to the Duration Requirements......Page 115
4 Possible Appropriate Safeguards When Processing Personal Data for Scientific Research in the Field of Biobanks......Page 117
5 Concluding Reflections......Page 121
References......Page 123
1 Introduction......Page 125
2.2 Ex Ante Assessment Under the GDPR......Page 127
2.3 Prior Notification and Approval Under the GDPR......Page 128
2.4 Ongoing Oversight Under the GDPR......Page 130
2.5 General Oversight Under the GDPR......Page 132
2.6 The Interplay of Actors in the GDPR Biobank Oversight Ecosystem......Page 133
3.1 Introduction......Page 135
3.2 Liability and Compensation Sanctions......Page 136
3.3 Administrative Sanctions......Page 137
3.4 The GDPR’s Sanctions Mechanism in the Biobank Sanctions Ecosystem......Page 138
4.2 The Lack of Clarity in the DPIA Obligation (Problem 1)......Page 140
4.3 The Lack of Obligation to Seek Prior Approval (Problem 2)......Page 142
4.4 The Size of Administrative Fines (Problem 3)......Page 143
5 Conclusion......Page 145
References......Page 146
1 Introduction......Page 149
2.1 The Context: National Biobanks Within European and Global Networks......Page 150
2.2 Overview of the Current Law and Governance Arrangements for Biobanks in the UK......Page 153
2.3.1 Lawfulness of Processing and the UK Biobank......Page 155
2.3.2 Consent as a Basis for Lawful Processing......Page 156
2.3.3 Legitimate Public Interest as a Basis for Lawful Processing......Page 157
2.3.4 Adequacy Decisions, ‘Appropriate Safeguards’ (Standard Contractual Clauses and Binding Corporate Rules), and Special Circumstances as a Basis for Transfer of Data to ‘Third Countries’......Page 158
3 The Political and Legal Processes of Brexit to Date......Page 160
4 The Legal Position for GDPR Aspects of Biobanking Post-Brexit......Page 162
4.1.2 Data Protection Under the EU (Withdrawal) Act 2018......Page 163
(a) Adequacy Decisions......Page 164
(b) Standard Data Protection Contractual Clauses and Binding Corporate Rules......Page 166
(c) Information Exchange and Cooperation......Page 168
(e) General Principles of EU Law......Page 169
4.2.1 Data Protection Law Under the Withdrawal Agreement......Page 170
4.2.2 Other Law Relevant to Biobanking Under the Withdrawal Agreement......Page 174
4.2.3 Domestic Implementation of the EU-UK Withdrawal Agreement......Page 175
4.3.1 The EU’s Position......Page 176
4.3.2 The UK Position......Page 181
5 Conclusion......Page 183
References......Page 184
Part III: National Implementation......Page 188
An Overview of Belgian Legislation Applicable to Biobank Research and Its Interplay with Data Protection Rules......Page 189
1.1 What Is a Biobank......Page 190
1.2 Types of Biobanks and Biobank Networks in Belgium......Page 191
2.1.1 The Act of 19 December 2008 on Human Body Material......Page 194
2.1.3 The Compendium on Biobanks, Issued by the Federal Agency for Medicines and Health Products (FAMHP)......Page 196
2.1.5 ‘Associated Data’ as Personal Data......Page 197
2.1.7 Interplay Between the Belgian Data Protection and Biobank Rules......Page 198
2.2.1 In Theory......Page 200
3.1 General Remarks......Page 203
3.3 The Federal Agency for Medicines and Health Products (FAMHP)......Page 204
3.4 Data Protection Officer......Page 205
4.2 Issues Pertaining to (Presumed) Consent for Obtaining HBM......Page 206
4.3 Issues Pertaining to the Processing of Data Associated to HBM......Page 207
4.4 Issues Pertaining to Information Provided to the Donor of HBM......Page 208
5.2 Allocation of Responsibilities According to Biobanking and Data Protection Rules......Page 209
6 Future Possibilities for Biobanking......Page 211
Figures......Page 212
References......Page 215
1 Introduction......Page 216
2.1 The Danish Biobank Landscape......Page 217
2.2 Collection of Samples......Page 218
2.3 Regulation of Biobank Research......Page 221
3 Individual Rights and Safeguards......Page 223
4 Law in Context: Individual Rights and Public Interest......Page 225
6 Conclusion......Page 226
References......Page 227
1 Introduction......Page 228
2.1 The Estonian Biobank and the Human Genes Research Act......Page 229
2.2 Biobanking Activities Other Than the EBB......Page 230
2.3 Data Protection and Biobanking......Page 231
2.4 Research Oversight......Page 232
3.1.1 The Use of Human Tissue in Research......Page 233
3.1.2 Informed Consent for the Use of Personal Data......Page 234
3.1.3 Use of Personal Data Without Consent......Page 235
3.2.2 Participants of Other Biobanks......Page 237
3.3 Article 89 GDPR and Safeguards Under the DP Act......Page 238
4 Law in Context: Individual Rights and Public Interest......Page 239
5 GDPR Impact and Future Possibilities for Biobanking......Page 241
6 Conclusions......Page 242
References......Page 243
1 Introduction......Page 244
2.1 Biobank Infrastructure......Page 245
2.2 An Overview of the Legal Framework......Page 246
2.3 Legal Foundation for Processing Personal Data in Biobanks and Biobank Research......Page 249
3 Individual Rights and Safeguards Related to Data Protection......Page 250
4 Law in Context: Individual Rights and Public Interest......Page 254
5 GDPR Impact and Future Possibilities for Biobanking......Page 255
References......Page 256
Research Biobanking, Personal Data Protection and Implementation of the GDPR in France......Page 258
2.1 What Is the French Biobanks Landscape?......Page 259
2.2 How Is Biobank Research Regulated in France?......Page 261
3.1 How Research Biobanks Are Integrated Within the Data Protection Framework......Page 266
3.2 Overview of Data Subjects’ Rights in Research Biobanking......Page 268
4.1 Exceptions Regarding Data Subjects’ Rights for Personal Data Processing in Research......Page 271
4.2 The Public Interest Purpose of Processing in French Law......Page 273
5.1 French Specificities......Page 274
5.2 Perspectives Regarding Research and Biobanking......Page 275
References......Page 276
1 Introduction......Page 278
2.1 General Remarks......Page 279
2.2 Germany’s Population Biobank: Nationale Kohorte......Page 280
2.3 Biobanking in General......Page 281
2.4 Data Protection, Privacy and Informational Self-Determination in Biobanking......Page 282
3.1 General Remarks......Page 285
3.3 Constitutional Rights......Page 286
3.4 Data Subject Rights......Page 287
4 Article 89 and the Impact of GDPR......Page 288
References......Page 290
1 Introduction......Page 292
2.1 Biobank Infrastructure: The Greek Reality......Page 293
2.2 Regulatory Framework......Page 298
3 Individual Rights and Safeguards......Page 300
4 Law in Context: Individual Rights and Public Interest......Page 305
5 GDPR Impact and Future Possibilities for Biobanking......Page 306
References......Page 307
1 Introduction......Page 309
2.1 The Italian Biobank Landscape......Page 310
2.2 Regulation of Biobank Research and Collection of Samples......Page 312
3.1 General Remarks......Page 314
3.2 ‘Further Conditions’ and the Role of the National DPA......Page 315
3.3 Balance Between the Lack of Consent and Further ‘Appropriate Measures’ of Protection: Secondary Use of Data and Samples......Page 316
3.4 Pseudonymisation, Minimisation and the Storage of Data and Samples......Page 317
3.5 Special Rules for Genetic Data......Page 318
4 Law in Context: Individual Rights and Public Interest......Page 320
5 GDPR Impact and Future Possibilities for Biobanking......Page 321
References......Page 322
1 Introduction......Page 323
2.1 Biobanks in Norway......Page 325
2.2 Norwegian Regulations......Page 326
3.1 Article 89 and the Right to Information......Page 330
3.2 Consent......Page 332
3.3 Confidentiality Protection......Page 335
3.4 Purpose Limitation......Page 336
4 Law in Context: Individual Rights and Public Interest......Page 338
5 Conclusions......Page 341
References......Page 342
Media......Page 343
1 Introduction......Page 345
2.2 Legal Framework......Page 347
2.3 Collection of Samples......Page 348
2.4 Regulation of Biobank Research......Page 349
2.5 The Portuguese Biobank Landscape......Page 350
3 Individual Rights and Safeguards......Page 352
4 Law in Context: Individual Rights and Public Interest......Page 356
5 GDPR Impact and Future Possibilities for Biobanking......Page 357
6 Conclusion......Page 361
References......Page 362
1 Introduction......Page 363
2.1.1 General Remarks......Page 364
2.1.4 Banks for Reproductive Purposes (Gametes and Embryos)......Page 365
2.1.6 Forensic Investigation Database (DNA Profiles)......Page 366
2.2.2 The National Banks Are as Follows......Page 367
2.2.5 Banks Specialised in Specific Biological Samples......Page 368
2.3 The National Network of Biobanks (Red Nacional de Biobancos)......Page 369
2.4 Applicable Regulatory Framework......Page 370
3.2 The Collection of Samples......Page 371
3.3.4 Pseudonymisation of Data......Page 372
3.5 Incorporation Into the (Clinical) Research Ethics Committees of the Data Protection Officer......Page 373
4 Law in Context: Individual Rights and Public Interest......Page 374
5.1 Biobanking and Samples Research Governance......Page 375
5.3 The Future of Biobanking and of the Related Norms......Page 376
References......Page 377
Swedish Law on Personal Data in Biobank Research: Permissible But Complex......Page 379
2.1 Biobanks in Sweden......Page 380
2.2 Regulatory Framework......Page 381
3.1 Implementing GDPR in Swedish Law: Introductory Remarks......Page 383
3.2 Consent and Processing of Samples from Biobanks......Page 384
3.3 Consent and Processing of Personal Data in Research......Page 385
4.2 Technical and Organizational Safeguards......Page 388
4.3 Further Adaptions on Rules for Informed Consent in Biobank Research......Page 389
5.1 Minimalistic Regulatory Approach, But Hardly a Restrictive View on Research......Page 390
5.2 Further Legislative Reform: Research Databases......Page 391
6.1 Consent and Public Interest......Page 392
6.2 Public Disclosure, Secrecy and International Collaboration......Page 393
References......Page 394
Part IV: Fragmentation and Ways Forward......Page 395
Biobanking Across Europe Post-GDPR: A Deliberately Fragmented Landscape......Page 396
1.1 Background......Page 399
1.2 Method and Limitations......Page 400
2 Biobank Regulatory Environment Across Europe......Page 401
3 Legal Basis for Biobanking. The Place and Role of Consent as One of the Legal Bases for Data Processing in Biobanking: Informed, Broad or None?......Page 403
4.1 Enabling Derogations......Page 408
4.2 Insights in Appropriate Safeguards......Page 411
5 Public Interest......Page 414
6 Conclusion......Page 417
References......Page 418
1 Introduction: Balancing Individual Rights and Public Interest in Biobank Research Post-GDPR......Page 419
2.1 Components for Regulating the Processing of Personal Data in Biobank Research......Page 421
2.2 EU Regulatory Competences in Data Protection, Research and Bioethics......Page 422
2.3 Aligning the GDPR with Other International Obligations of the Member States......Page 423
3 Regulating Safeguards at the National Level: Heterogeneity Remains......Page 425
4 Addressing Regulatory Differences Via Forum Shopping?......Page 426
5 Addressing Regulatory Differences Via Administrative Cooperation and Soft Law Tools......Page 427
6 Concluding Remarks: Can a Level Playing Field for Biobanks Develop?......Page 429
References......Page 431