Data Protection and Sample Management in Biobanking - A legal dichotomy

Abstract

Biobanking in Europe has made major steps towards harmonization and shared standards for the collection and processing of data and samples stored in biobanks. Still, biobanks and researchers face substantial legal difficulties in the field of data protection and sample management. Data protection law was harmonized almost 15 years ago while rights in samples fall under the competence of the Member States of the EU. Despite the Data Protection Directive the field of data protection shows a substantial degree of deviation as public health was excluded from the harmonization. Biobanks seem to have substantially fewer difficulties to cope with in terms of the legal requirements in the field of sample management. This paper discusses the legal framework, experiences of different biobanks in Europe and potential ways forward. It also highlights the need for a health economic analysis of the costs and benefits of privacy protection in Europe. At the moment, policymakers seem to build their decisions on an insufficient evidence base which underestimates the potential value of biobanks for European public health. Within the past few years little progress has been achieved with regards to the development of a unified legal framework in Europe, The diversity in the legal system is also reflected in the different approaches of ethics committees towards biobanking. To secure the responsible and effective use of data and samples, more efforts are needed to come up with pathways for a solution.

From patients to partners: participant-centric initiatives in biomedical research

“…First, although consent is regarded as being of fundamental importance, there are no uniform standards of consent across all types of research, and clarity is lacking about the role of the participant’s rights over the resulting data sets and biobanks 3 . Second, the legal, ethical and regulatory requirements may differ between jurisdictions at the regional or national level 4,5 . Third, as whole-genome sequencing gradually becomes routine and as biobanks and data sets are ever more interconnected, it is increasingly difficult to guarantee that individuals can remain anonymous 6,7 .…”

Designing robust clinical trials for orphan drugs

“…They may be linked to collections of biological specimens, which may reduce the time for fi nding biomarkers. Data use and protection of donor privacy in the EU is subject to the Data Protection Directive, EC Directive 95/46/EC, but the collection, storage and sharing of biological samples and application of property rights in the EU and outside 3 is regulated nationally and not yet harmonised despite the international collaborations between biobanks 4 (Chalmers 2011;Haga and Beskow 2008;Schulte in den Bäumen et al 2010;Zika et al 2008).…”

Open consent, biobanking and data protection law: can open consent be ‘informed’ under the forthcoming data protection regulation?

“…On the one hand, the Directive was not designed with biobanks in mind, and it was therefore unclear as to how and when its provisions should be applied. On the other hand, in the absence of European level clarity on the application of the Directive, Member States provided local approaches, which in turn led to a fragmentation of legal approaches across Europe (Schulte in den Bäumen et al 2010 , pp 36).…”

“…Guidance related to one can act as a guideline as to how to interpret the other. In this regard, the Article 29 Working Party have stated that ‘[v]ague or general purposes such as ‘improving users’ experience’, ‘marketing’, ‘IT-security’ or ‘future research’ will – without more detail – usually not meet the criteria of being ‘specific’ [emphasis added] (Schulte in den Bäumen et al 2010 , p 52). Second, there is relevant guidance directly related to the conditions of consent.…”

“…Without justification, this right should not be limited. In essence, the data subject has ‘the right to take a risk’ and to do whatever they want with their data regardless of uncertainty or potential future risk (Schulte in den Bäumen et al 2010 , pp 39–40; Taupitz & Weigel 2012 , pp 265–266). This is exemplified by Article 9(2)(e) which allows the possibility for the data subject to ‘manifestly’ make their data public.…”