The GDPR and the research exemption: considerations on the necessary safeguards for research biobanks

The General Data Protection Regulation (GDPR) came into force in May 2018. The aspiration of providing for a high level of protection to individuals’ personal data risked placing considerable constraints on scientific research, that was contrary to various research traditions across the EU. Therefore, along with the set of carefully outlined data subjects’ rights, the GDPR provides for a two-level framework to enable derogations from these rights when scientific research is concerned. First, by directly invoking provisions of the GDPR on a condition that safeguards that must include ‘technical and organisational measures’ are in place and second, through the Member State law. Although these derogations are allowed in the name of scientific research, they can simultaneously be challenging in light of the ethical requirements and well-established standards in biobanking that have been set forth in various research-related soft legal tools, international treaties and other legal instruments. In this paper we review such soft legal tools, international treaties and other legal instruments that regulate the use of health research data. We report on the results of this review, and analyse the rights contained within the GDPR and Article 89 of the GDPR vis-à-vis these instruments. These instruments were also reviewed to provide guidance on possible safeguards that should be followed when implementing any derogations. To conclude, we will offer some commentary on limits of the derogations under the GDPR and appropriate safeguards to ensure compliance with standard ethical requirements

Appropriate safeguards and Article 89 of the GDPR: considerations for biobank, databank and genetic research

The collection and use of biological samples and data for genetic research, or for storage in a biobank or databank for future research, impacts upon many fundamental rights, including the right to dignity, the right to private and family life, the right to protection of personal data, the right to freedom of arts and sciences, and the right to non-discrimination. The use of genetic data and other health-related data in this context must be used in a manner that is rooted in human rights. Owing in part to the General Data Protection Regulation (GDPR) coming into force, the right to the protection of personal data in the context of scientific research has been afforded increasing attention. The GDPR gives effect to the right to data protection, but states that this right must be balanced against other rights and interests. The GDPR applies to all personal data, with specific attention to special categories of data, that includes health and genetic data. The collection, access to, and sharing of such data must comply with the GDPR, and therefore directly impacts the use of such data in research. The GDPR does provide for several derogations and exemptions for research from many of the strict processing requirements. Such derogations are permitted only if there are appropriate safeguards in place. Article 89 states that to be appropriate, safeguards must be “in accordance” with the GDPR “for the rights and freedoms of the data subject”. In particular, those safeguards must ensure “respect for the principle of data minimisation”. Despite the importance of safeguards, the GDPR is silent as to the specific measures that may be adopted to meet these requirements. This paper considers Article 89 and explores safeguards that may be deemed appropriate in the context of biobanks, databanks, and genetic research

Ethical and social reflections on the proposed European Health Data Space

The COVID-19 pandemic demonstrated the benefits of international data sharing. Data sharing enabled the health care policy makers to make decisions based on real-time data, it enabled the tracking of the virus, and importantly it enabled the development of vaccines that were crucial to mitigating the impact of the virus. This data sharing is not the norm as data sharing needs to navigate complex ethical and legal rules, and in particular, the fragmented application of the General Data Protection Regulation (GDPR). The introduction of the draft regulation for a European Health Data Space (EHDS) in May 2022 seeks to address some of these legal issues. If passed, it will create an obligation to share electronic health data for certain secondary purposes. While there is a clear need to address the legal complexities involved with data sharing, it is critical that any proposed reforms are in line with ethical principles and the expectations of the data subjects. In this paper we offer a critique of the EHDS and offer some recommendations for this evolving regulatory space

Legislation of direct-to-consumer genetic testing in Europe: a fragmented regulatory landscape

Despite the increasing availability of direct-to-consumer (DTC) genetic testing, it is currently unclear how such services are regulated in Europe, due to the lack of EU or national legislation specifically addressing this issue. In this article, we provide an overview of laws that could potentially impact the regulation of DTC genetic testing in 26 European countries, namely Austria, Belgium, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, the Netherlands and the United Kingdom. Emphasis is placed on provisions relating to medical supervision, genetic counselling and informed consent. Our results indicate that currently there is a wide spectrum of laws regarding genetic testing in Europe. There are countries (e.g. France and Germany) which essentially ban DTC genetic testing, while in others (e.g. Luxembourg and Poland) DTC genetic testing may only be restricted by general laws, usually regarding health care services and patients’ rights

Allocation of Regulatory Responsibilities: Who Will Balance Individual Rights, the Public Interest and Biobank Research Under the GDPR?

In this chapter, an analysis is undertaken of the division of legislative power in the space created by the GDPR, regarding the balancing of individual rights, the public interest and biobank research. The legislative competences of the EU, international obligations within bioethics, and the regulatory space left for Member States are all examined. The conclusion of the chapter is that in spite of the aim of the GDPR to further legal harmonisation, it is more likely that unity will be brought about through administrative cooperation and soft law tools

Setting the Foundations : Individual Rights, Public Interest, Scientific Research and Biobanking

The principle of conferral tames the EU competence to regulate research in a comprehensive manner, yet furthering research is one of its aspirations. Data protection, however, is an area within which the EU has legislated extensively. During the development of the General Data Protection Regulation (GDPR), an important issue to tackle was how to balance the ambitious EU aspirations and differing stakeholder interests, on the one hand, with limited competences in research regulation, on the other, and how to determine the extent to which data protection could be used as a means to further scientific research in the EU legal order. The outcome is the GDPR multifaceted research regime that sets forth EU policy and opens up for further regulations from the Member States as well as the EU. The research regime that the GDPR has created poses numerous questions. Key among these is, what are the implications of the operationalisation of Article 89 GDPR in biobanking? This chapter sets out some of the underlying tensions in the area and pins down key conceptual foundations for the book. It provides insights into the EU’s interests in the area of biobanking and maps out central elements of the research regime that has been built within the GDPR. Thereafter, it analyses the key concepts used in the book, including biobank and biobanking, scientific research as undertaken under the GDPR, individual rights and public interest. Lastly, it shares some preliminary reflections as starting points for the analysis to come

Legislation of direct-to-consumer genetic testing in Europe: a fragmented regulatory landscape

Despite the increasing availability of direct-to-consumer (DTC) genetic testing, it is currently unclear how such services are regulated in Europe, due to the lack of EU or national legislation specifically addressing this issue. In this article, we provide an overview of laws that could potentially impact the regulation of DTC genetic testing in 26 European countries, namely Austria, Belgium, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, the Netherlands and the United Kingdom. Emphasis is placed on provisions relating to medical supervision, genetic counselling and informed consent. Our results indicate that currently there is a wide spectrum of laws regarding genetic testing in Europe. There are countries (e.g. France and Germany) which essentially ban DTC genetic testing, while in others (e.g. Luxembourg and Poland) DTC genetic testing may only be restricted by general laws, usually regarding health care services and patients' rights.status: publishe

From engaging publics to engaging knowledges: Enacting “appropriateness” in the Austrian biobank infrastructure

While there is consensus on the essential importance of public engagement in further developments of biobanking, the related investigation of public views predominantly focused on the concerns expressed by the publics, and the concrete format of public engagement, without delving into the ways these concerns are constituted. In this paper, we synthetize recent research on public engagement in order to describe the constitution of respective concerns as ‘engagement of knowledges’. By shifting from ‘publics’ to ‘knowledges’, we draw attention to the interaction dynamic through which citizens embed the new knowledge they receive during expert interactions into the stock of knowledge they already possess. Analyzing our recent investigation of public views on biobanking in the form of citizen-expert panels (CEPs) in the Austrian infrastructure of biobanks (BBMRI.at), we trace this dynamic through citizens’ recurrent concerns that the research and consent practices related to biobanking should be “appropriate”