Registered access is likely to be suitable as a mechanism for access to data types that are less sensitive and low risk, such as non-stigmatizing health-related data from non-vulnerable individuals who would expect, or have consented to, data sharing for the purposes envisaged.23 This model would focus primarily on ensuring that the data users are *bona fde* researchers. The rationale behind the registered model is that if processing data is not creating high risks of identifability and the users are trusted, then further access review (for instance reviewing the ethical or scientifc aspects of the proposals) would be redundant or disproportionate.

The 'registered access' model hinges on a number of core elements, namely authentication, authorization and attestation. First, the data use applicants should provide personal and professional information within a registration process, including their name, title, position, affliation, email address, institutional website and mailing address for the purpose of authentication. In contrast to a controlled-access model, a registered-access model would not entail verifcation on a case-by-case basis by a DAC of the users' qualifcations. In addition, the applicants should declare that they are 'bona fde' researchers in order to be authorized access. At last, the applicants should agree with the terms and conditions of the data access. Within the registered access model, data users would not need to sign a data access agreement in a paper-based format but could instead agree via clickwrap-type online agreements. Indeed, the procedure for signing data access agreements by DACs,

20Shabani and Borry (2017), pp. 149–156.

21Shabani and Borry (2016), pp. 892–897.

22Woolley et al. (2018), p. 17.

23Dyke et al. (2016), pp. 1676–1680.

and users and their home institution, is administratively heavy and this proposed alternative approach could reduce pressure on DACs and create rapid, open and effcient access to data.

A Registered-access model is only one proposed solution in response to the limitations of the controlled-access model. It is expected that novel governance models will emerge in the coming years in order to address the identifed shortcomings of the controlled-access models, and in line with the principles of responsible data sharing. In addition to emerging governance mechanisms, novel technical solutions are also proposed,24 including the introduction of federated networks in which multiple distributed databases are connected.25 By using federated networks, users would be able to have (a level of) access to data in a protected virtual environment, and each database would be able to monitor data uses in real time. To date, few models of federated data computation have been suggested.26 Considering the limitations of controlled-access models, there is a pressing need for the introduction of such innovative solutions. Concurrently, it is important to ensure the core elements of secure data computational environments are in line with data protection principles.

### **5 Relevant Data Sharing and Access Oversight Bodies and Tools**

### *5.1 Data Access Committees*

The need to establish an extra layer of oversight through DACs is grounded in the nature of data sharing, which allows downstream data uses that are not known at the time of the initial sample and data collection. Therefore, research ethics committees cannot foresee all downstream data uses when they approve the research protocol in the beginning. In that sense DACs are considered as an extra layer of oversight next to research ethics committees, which review the proposals in the beginning of the studies. In particular, DACs are established to receive data access requests from actual users and assess them for the purpose of approving or disapproving their access to data.27 DACs are not mentioned in the GDPR, but their role in governance of data access is important. This can indeed be considered as part of research selfregulation in order to ensure data sharing and use is in line with the overarching principles and the relevant regulations.

24 Joly et al. (2016), pp. 1150–1154.

25Philippakis et al. (2015), pp. 915–921.

26Wallace et al. (2014), pp. 149–157. See also: Ardeshirdavani et al. (2014).

27Lowrance (2012), p. 23.

DACs, function in different ways. As Lowrance illustrates, 'some of these groups are formally constituted, have terms of reference and hold regular meetings. Others, are casual, rarely meeting but existing to be consulted from time to time by the custodian and in a position to address serious problems should any arise'.28

The composition of DACs varies across the institutions. Ideally, such committees should be consisting of internal and independent members with expertise in technical, ethical and legal aspects of processing health and genomic data. Some have suggested establishing two-layer committee is benefcial, namely an advisory committees together with operational access committees. The advisory committees will be tasked with auditing the performance of the operational access committees, while the operational committee will be responsible for reviewing the access requests.

Moreover, the oversight committees, such as DACs and Research Ethics Committees, should be given the opportunity to assess the data access rules on a regular basis, and propose revision of the provisions when needed. This could ultimately strengthening effective operation of the organizational measures under Article 89(1). In addition, transparency of the data access governance could be considerably enhanced if adequate information dissemination policies are adopted. It is expected that the oversight bodies within the institutions provide information about the access review procedure, incoming data access requests and approved and disapproved requests to enhance transparency and facilitate external scrutiny. Furthermore, data access governance models should adopt mechanisms that hold users accountable.

### *5.2 Data Protection Impact Assessment and Appointment of Data Protection Offcers (DPOs)*

The GDPR sets further requirements in terms of governance of data processing when higher risks for the freedoms and the rights of the data subjects are perceived. One of the relevant organizational measures foreseen by the GDPR is to appoint a data protection offcer (DPO) and conduct data protection impact assessment when specifc conditions are met. The biobanks as entities that process health and genomic data should adhere to these provisions.

The Regulation in Article 37 provides a set of rules for designating the DPO when the processing of personal data within institutions meets certain criteria. According to the explanation provided by the European Data Protection Supervisor: 'the main task of the data protection offcer is to ensure, in an independent manner, the internal application of the provisions of the Regulation in his/her institution. The data protection offcer is also required to keep a register of all of the processing operations involving personal data carried out by the institution. The Register,

28Lowrance (2012), p. 23.

which must contain information explaining the purpose and conditions of the processing operations, should be accessible to any interested person.'29 The appointment of a DPO must of course be based on her personal and professional qualities, but particular attention must be paid to her expert knowledge of data protection.

In addition, according to Article 35, a privacy impact assessment is necessary: 'where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purpose of the processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.' Therefore, a broad scope for these data protection impact assessments is expected, which goes beyond compliance with the Regulation and privacy rights and includes consideration of a plethora of individual's fundamental rights. This will therefore provide an opportunity to take into account a broader range of concerns relating to the rights of individuals in processing personal data and not only those that are related to storage and safety. Article 35(b) adds that the data protection impact assessment shall in particular be required in cases where there is 'processing on a large scale of special categories of data referred to in Article 9(1)'.

The controller shall receive a data protection offcer's advice (if he/she has been appointed) when carrying out a data protection impact assessment. Consequently, the data controller shall consult the supervisory authority prior to processing 'where a data protection impact assessment under Article 35 indicates that the processing would result in high risk.'30 Article 35(9) also requires the data controller, where appropriate, to 'seek views of data subjects or their representatives on the intended processing'.

The impact assessment will therefore replace the previous obligation to notify the data protection authority, which was outlined by the Directive 95/46/EC on the protection of individuals with regard to the processing of personal data. This change was welcomed by commentators, who argued against the effectiveness of the previous notifcation requirement. As Townend argues: 'Although data controllers are required to register their activity with the relevant supervisory authorities and that authority has power to investigate and prosecute breaches of the data subject's rights, the sheer amount of processing that goes on within any jurisdiction at any given time makes it impossible for a supervisory authority to be seen as the primary protector in the system'.31 In turn, the new requirements will see a shift towards the accountability of the controllers and reinforce their role in establishing adequate safeguards in the course of the processing, not only limiting it to the outset of the project.32 This could also draw the attention of the data controllers towards the

29European Data Protection Supervisor. https://edps.europa.eu/data-protection/ eu-institutions-dpo\_en.

30Article 36, GDPR.

31Townend (2016), pp. 128–142.

32 de Hert and Papakonstantinou (2016), pp. 179–194.

ethical concerns associated with data processing and take the concerns into account in the design of the processing.

### *5.3 Data Access Agreements and Data/Material Transfer Agreements*

Contractual agreements are essential operational instruments intended to legally bind the parties to specifc rules ensuring adequate individuals' privacy protection throughout personal data processing. Such contracts can take many forms and be labelled differently such as 'Data Access Agreements' (DAAs), 'Data Transfer Agreements' (DTAs) or 'Confdential Data Agreements' (CDAs). Personal data protection measures are also included within other special research agreements, in particular within the so-called 'material transfer agreements' (MTAs) when biological samples are also transferred. In particular, it is widely recommended to include in MTAs provisions regarding samples' quality, transportation, conditions and restrictions of use (e.g. derivations of original material) and storage (biosafety/ biosecurity).

The nature and scope of the contract can vary depending on the internal practices of operators or applicable national legal framework, the requester's processing operation and purposes, the database governance model (cf. supra) and on the crossborder features of the access (intra-EU or including outside-EU elements). For example, where data is managed within a closed controlled system (e.g. digital data analysis platform), an access agreement could take the form of terms and conditions in the view of the applicable regulations. In addition, a decentralized infrastructure could rely on a general Access policy having a contractual value. For example, BBMRI-ERIC33 provides such template while allowing its members to adopt specifc and compliant contractual activities to frame collaborations.34

The legal qualifcation of the parties to such agreements is context-dependent and needs a case-by-case analysis of the role and activities of each stakeholder. Access could be requested in a framework of a research collaboration with the biobank or by an external researcher to conduct an independent research project. Thereby, the contract will defne a controller-processor relationship or a jointcontrollers relationship. This is in line with the GDPR that requires setting up a contract for organizing joint-controllers35 and/or controller-processor relationships36 in terms of duties and rights in processing data.

33BBMRI-ERIC (2018).

34B3Africa, Checklist: For a good governance of transcontinental collaborative biobank research. http://biobanklearning.iarc.fr/course/checklist-elsi/#llms-lesson-locked. Accessed 9 May 2019.

35Article 26, GDPR.

36Article 28, GDPR.

The data access agreements usually include negotiable and non-negotiable provisions. Contracts shall echo and respect the will of the initial donor and facilitate the exercise of the donors' rights. The parties shall commit to respect confdentiality and plan cooperation procedures, in particular regarding personal data breach notifcations. The agreement must also clearly describe any restriction specifed by the initial controller during the deposit of the data/sample in the biobank or imposed by the biobank policy based on a legitimate interest (e.g. regarding onward transfers possibilities, the return of the data/samples or destruction, intellectual property issues). For ensuring proper legal security, agreements must include information about the applicable laws and dispute resolution mechanisms, including out-ofcourt proceedings. Financial provisions could also be included but should not be indexed on the intrinsic personal data or sample value but on the necessary investments performed for ensuring samples or data quality, integrity and FAIRness for example.

In addition, the GDPR is setting specifc conditions when transferring data/and samples to non-EU countries. Accordingly, materials can only be transferred to a third entity in a country that ensures an appropriate level of protection of individuals' rights and freedoms compared to the one guaranteed within the EU. Therefore, such a transfer can be permitted where it is based on an adequacy decision adopted by the European Commission after analysis of a country general and sectorial legislation,37 or where appropriate safeguards are in place.38 This is including the use of binding corporate rules (applying to cross-border personal data transfers in a group of undertaking or a between entities of a multinational enterprise), or of standard contractual clauses adopted by the European Commission39 (provided that they are not modifed, otherwise the competent supervisory authority should be consulted to validate the adapted clauses), the respect of an approved Code of Conduct or the use of an approved certifcation mechanism together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights.

In exceptional circumstances, in the absence of an adequacy decision and of appropriate safeguards a transfer shall take place only if one of the conditions of Article 49 GDPR are met. This includes situations where the data subject has explicitly consented to the transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards, or the transfer is necessary for protecting the vital interests of the data subject, or is necessary for important reasons of public interest recognized in the Union or relevant Member State law (e.g. fght against cross-border public health threats), or is made from a public register intended to provide

37Article 45, GDPR.

38Article 46, GDPR.

39European Commission. Model contracts for the transfer of personal data to third countries. https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries\_en. Accessed 9 May 2019.

information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest.

### **6 Conclusions**

In developing data access rules and governance models biobanks could be assisted by soft law measures, which have traditionally had considerable importance in the feld. It seems that GDPR leaves considerable room to operationalize its provisions through these soft law measures. One area that soft law measure can be useful is in elaborating on what organizational measures should be when processing data under research exemptions. In particular, such measures can provide guidance on the adequate models of data governance, oversight bodies, data access rules and implementation of data protection best practices.

Oversight bodies can be considered as a crucial part under organizational measures. In particular, oversight bodies such as ethics committees and data access committees are in the good place to hold control over the access and use of data. It is important to ensure the existing and emerging oversight bodies are equipped with adequate expertise regarding using and sharing genomic data and are aware of the associated informational risks. In order to achieve this, soliciting the attitudes of the involved parties regarding the associated risks would be necessary. Thereby, the overall governance of personal data processing will go beyond legal requirements and will take into account the pertinent individual or social concerns that may not be explicitly outlined in the legal provisions. That said, DACs often lack adequate tools to keep ongoing oversight on actual use of data once data access has been granted. Such limitations on the oversight on data access should be taken into considerations, when assessing the potential risks and the adequacy of the current oversight tools and mechanisms.

Moreover, the oversight of personal data processing by competent authorities should keep pace with recent developments in the feld of data science, bioinformatics and genetics, among others. The risks associated with emerging technologies and the safeguards in protecting the privacy of data subjects should be treated as moving targets. Otherwise, the safeguards will become obsolete and unable to safeguard data subjects in an adequate fashion.

Finally, increasing cross-border data sharing underlines the importance of the harmonization of legal frameworks concerning personal data protection. One of the main goals of the Regulation has been to achieve this by harmonizing the personal data protection landscape across EU. However, concerns remain regarding the real impact of the Regulation on unifying the national regulations towards processing health and genetic data for research purposes, across Member States. Arguably, the Regulation still leaves room for varying interpretations, for instance, concerning the safeguards that should be established and also in setting further conditions for processing data on the basis of the research exemption provisions. This may challenge development of European sample repositories and data sharing platforms, as different safeguards may be required to be adopted for samples/data collected in different member states.

**Acknowledgements** L.M has received funding from the European Union's Horizon 2020 research and innovation programme under the Marie Sklodowska-Curie grant agreement No 753531.

### **References**

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# **Biobank and Biomedical Research: Responsibilities of Controllers and Processors Under the EU General Data Protection Regulation**

### **Ana Nordberg**

**Abstract** Biobanks are essential infrastructures in current health and biomedical research. Advanced scientifc research increasingly relies on processing and correlating large amounts of genetic, clinical and behavioural data. These data are particularly sensitive in nature and the risk of privacy invasion and misuse is high. The EU General Data Protection Regulation (GDPR) developed and increased harmonisation, resulting in a framework in which the specifc duties and obligations of entities processing personal data—controllers and processors—were defned. Biobanks, in the exercise of their functions, assume the role of controllers and/or processors and as such need to comply with a number of complex rules. This chapter analyses these rules in the light of Article 89 GDPR, which creates safeguards and derogations relating to 'processing for archiving purposes in the public interest, scientifc or historical research purposes or statistical purposes'. It identifes key compliance challenges faced by biobanks as data controllers and processors, such as determining whether the GDPR is applicable and its intersection with other regulations; when a biobank should be considered controller and processor; and what are the main duties of biobanks as data controllers and processors and options for compliance.

### **1 Introduction**

Biobanks, broadly understood, play a central role in contemporaneous medical and biomedical research. For its part, scientifc biomedical research is essential in modern developed societies and serves the realisation of important fundamental rights, namely the right to life and health care.1 Cutting-edge health research increasingly

A. Nordberg (\*)

Lund University, Faculty of Law, Lund, Sweden e-mail<EMAIL_ADDRESS>
© The Author(s) 2021 61

S. Slokenberga et al. (eds.), *GDPR and Biobanking*, Law, Governance and Technology Series 43, https://doi.org/10.1007/978-3-030-49388-2\_5

1Article 2 'Right to Life'; Article 35 'Right to health care', Charter of Fundamental Rights of the European Union *OJ C 326, 26.10.2012, p. 391–407.*

relies on large amounts of genetic, clinical and behavioural data. These data are particularly sensitive and enjoy increased legal protection,2 thus creating complex intersections between fundamental values. Data protection law has a long history in Europe, and unlike other jurisdictions such as the USA it is based on the principle that personal data processing is prohibited unless explicitly allowed under a specifc legal basis.3 The latest data protection development in the EU is the GDPR,4 which replaced the previous framework set forth by the Data Protection Directive.5

The present chapter focuses specifcally on the duties of biobanks as data controllers and data processors under the GDPR. The GDPR has created an increasingly harmonised framework as to the duties and obligations of entities which retrieve, store and analyse personal data, i.e. data controllers and data processors. Biobanks, in their typical operating functions, assume the roles of controllers and processors of personal data. From the perspective of biobank compliance with the duties and obligations imposed by EU data protection law, relevant key changes include: (1) higher penalties for contravention; (2) new requirements for appointment of a data protection offcer (DPO) when an entity processes signifcant amounts of sensitive data; (3) recognition of genetic data as sensitive personal data; (4) strong promotion of a privacy by design approach; (5) new direct obligations imposed on data processors; (6) broader territorial scope, now expanding to non-EU entities which process EU citizens' data; (7) time limitation on the storage of data; (8) specifc permission for broad consent for scientifc research; (9) exemption from some individual data subject rights concerning data 'for archiving purposes in the public interest, scientifc or historical research purposes or statistical purposes'.6

Whether or not biobanks assume the roles of data controllers and/or data processors for GDPR compliance purposes will largely depend on their actual functions, manner of operating and whether the specifc tasks can be considered data processing of personal data. In order to contextualise the debate on the duties of biobanks as data controllers and processors, it should be briefy mentioned that data protection rules intersect with the general regulatory frameworks applicable to biobanking activities in the EU and EU Member States. Among the European biomedical community, biobanking terminology tends to vary.7 There is therefore

2The right to privacy is a fundamental right linked to the notions of human dignity, equality and autonomy. See for example Article 7 'Respect for private and family life; Article 8 'protection of personal Data'; Article 21 'Non-discrimination' EU Charter of Fundamental rights.

3Dove (2019).

4Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, *OJ L 119, 4.5.2016, p. 1–88.*

5Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, *OJ L 281, 23.11.1995 P. 31 – 50.*

6Article 9(2)(j) GDPR; Morrison et al. (2017), pp. 693–703.

7Fransson et al. (2015), pp. 22–28; Watson (2014), pp. 163–164; Hewitt and Watson (2013), pp. 309–315; Shaw et al. (2014), pp. 223–227.

neither a common understanding of what a biobank is nor agreement on a taxonomy of different types of biobanks. Legislation across EU Member States refects the diffculties in establishing precise legal defnitions of biobanks and biobanking activities.8 At the national level, regulative approaches to biobanks refect the pluralism of ethical, research and legal traditions and have their roots in signifcant socio-political, cultural and religious normative diversity.9 Only a minority of EU Member States have specifc legislation on biobanks.10 The majority either do not have any domestic legislation11 or rely on non-specifc existing laws, often accompanied by soft law instruments, such as ethical guidelines, to regulate biobanks.12 Lack of EU harmonisation and diversity of solutions, and in some cases vague and dispersed legislation, are all considered problematic for the development of biobanking activities.13

Overall, biobanks are quite diverse in terms of features such as the number, type and nature of samples, population covered, type of associated information, purpose and activities developed (e.g. sample hosting, processing and curation). These specifc features infuence the intersections between legal regulation of biobanking activities (mainly national) and the EU data protection framework and have practical implications for compliance with the obligations imposed by the GDPR on controllers and processors of personal data. There is a lack of specifc, harmonised EU legislation on biobanks and biobanking activities. Existing EU regulation applicable to biobanks and biobank research is dispersed through a number of areas of law, including data protection, clinical trials14 and tissue regulation.15 An exhaustive analysis is outside the scope of this chapter. However, it can be noted for example the complex interplay between clinical trials regulation and the GDPR.16

8Beier and Lenk (2015), pp. 69–81; Briceño Moraia et al. (2014), pp. 187–212.

9Penasa et al. (2018), pp. 241–255.

10Belgium, Estonia, Finland, Hungary, Latvia, Lithuania, Portugal, Spain, Sweden and UK.

11Bulgaria, Croatia, Czech Republic, Malta, Romania, Slovakia.

12Austria, Cyprus, Denmark, France, Germany, Greece, Italy, Luxembourg, the Netherlands, Poland, Republic of Ireland and Slovenia. See Beier and Lenk (2015). See also: Nicola (2015), pp. 800–815; Sandor et al. (2009).

13 In this sense, see a for example Penasa et al. (2018), with further references to national commentators defending the introduction of specifc codifed legislation in their respective jurisdictions.

14Directive 2001/20/EC of the European Parliament and of the Council of 4 April 2001 on the approximation of the laws, regulations and administrative provisions of the Member States relating to the implementation of good clinical practice in the conduct of clinical trials on medicinal products for human use, OJ L 121, 1.5.2001, p. 34, soon to be replaced by entry into effect of Regulation 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC, OJ L 158 27.05.2004, p. 1–76 [hereinafter Clinical Trials Regulation].

15Directive 2004/23/EC of the European Parliament and of the Council of 31 March 2004 on setting standards of quality and safety for the donation, procurement, testing, processing, preservation, storage and distribution of human tissues and cells, *OJ L 102, 7.4.2004, p. 48–58.*

16See European Data Protection Board, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art. 70.1.b)), Adopted on 23 January 2019.

This chapter examines the obligations imposed by the GDPR on biobanks in their role as controllers or processors of human personal data. After this introduction which sets out the contextual background of the application of data protection norms to biobanking activities, Sect. 2 addresses the material and geographic scope of applicability of the GDPR concerning biobanking activities. Section 3 then examines the concepts of controller and processor, their relationships and how these apply in a biobanking context. Section 4 analyses the duties of biobanks as data controllers and processors by reference to general data processing principles and the related duties imposed on biobanks, including obligations to respect data protection rights of data subjects. Adopting the perspective of biobanks as controllers and processors of data, it addresses possible compliance routes, with particular emphasis on rules concerning data processing of health and genetic data and exemptions provided for data processing 'for archiving purposes in the public interest, scientifc or historical research purposes or statistical purposes'.17 Section 5 will conclude this chapter with a general summary of the main points addressed.

### **2 GDPR and Biobanking Activities**

### *2.1 Substantive Scope of the GDPR*

Data protection obligations of biobanks depend largely on their geographical establishment, location of data subjects, functioning, tasks performed and whether these allow their classifcation as controllers and/or processors of personal data under the EU jurisdiction. In other words, in order to determine whether in a specifc situation a biobank has to comply with the GDPR rules, it is necessary to establish whether it falls both under the substantive and the geographic scope of application of the Regulation.

In substantive terms, the GDPR applies to data processing activities and these are defned broadly and generally, which means that in practice they will include most biobanking activities and related research. Any activity involving personal data, performed either by automated or manual means, is in principle subject to the GDPR. This includes, for example, 'collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction'.18

Data protection rules only apply to personal data, which means information relating to an identifed or identifable living, natural person. The concept of identifable natural person is broadly defned and identifcation does not need to be immediate and direct. Data will still be personal if an individual can be identifed by

17Article 9(2)(j) and Article 89(1) GDPR.

18Article 4 (2) GDPR.

reference to an identifer, for example, name, number, IP or physical address, or specifc physical, physiological, genetic, mental, economic, cultural or social descriptors.19 The concept of personal data only applies to living persons, and therefore *prima facie* it will not apply to samples obtained from deceased individuals. However, personal data of living relatives can be inferred from historical samples, thus arguably when inferences are established concerning, for example, the health of a living relative, such might constitute personal data processing under the GDPR.

### *2.2 Geographical Scope of the GDPR*

Biobanks often collect, receive, keep or analyse transnational samples or data, which raises the question of the geographic scope of applicability of data protection rules. Generally, there are two factors that are relevant to determine the territorial scope of application: the establishment criterion, and the targeting criterion.20 These will be further examined below.

Concerning the establishment criterion, the European Data Protection Board (EDPB) recommends consideration of three aspects: (a) establishment in the EU; (b) processing of personal data carried out 'in the context of the activities of' an establishment; and (c) application of the GDPR to the establishment of a controller or a processor in the EU regardless of whether the processing takes place in the EU or not.21 The GDPR has a broad scope of applicability as it does so regardless of where the data processing activities are conducted and to any processing of personal data done by a controller or a processor with an establishment in the EU.22 Recital 22 clarifes that 'establishment implies the effective and real exercise of activity through stable arrangements'.23 Factual elements and not legal formalities are the determining factor to assess whether a data controller or processor has an establishment in the EU. In some circumstances, the GDPR rules also apply even if the controller or processor is not established in the EU as long as the data subject is located in the EU. In a biobank context, whether the data processing is considered carried out in the context of the activities of an establishment does not depend necessarily on whether the processing in question is carried out 'by' the biobank itself.24 Assessment will have to be made on a case by case basis. For example, in cases of data and sample sharing, the activities of a biobank in a Member State and the data processing activities of a third party (data controller or processor) outside the EU may be inextricably linked, and thereby may

19Article 4 (1) GDPR.

20EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Adopted on 16 November 2018.

21EDPB Guidelines 3/2018, p. 4–7.

22Article 3 (1) GDPR.

23Recital 22 GDPR.

24Article 3(1)

trigger the applicability of EU data protection law even if the biobank by itself does not have an active role in the data processing.25 Finally, the place of processing is not relevant in determining whether or not the data processing, carried out in the context of the activities of an EU biobank, falls within the scope of the GDPR. For example, when samples and information are collected outside the EU and later the data are processed by a biobank operating in an EU Member State or when a clinical trial is conducted outside the EU by a branch or subsidiary not legally distinct from an EU entity which determines the purpose and means of the data processing carried out on its behalf.26

In regards to the targeting criterion, Article 3 contains international private law rules that extend the jurisdiction of the GDPR to data controllers and processors not established in the EU and regardless of where the data processing activities take place. The connecting factor here is the location of the data subject and the purpose of the data processing activities. The GDPR applies to data subjects located in the EU27 independently of their legal status concerning nationality or residence.28 The second cumulative jurisdiction connecting factor concerns the type of data processing activities. Article 3(2) GDPR defnes these as:

Biobanking activities may involve offering goods or services, such as where tissues and living materials are preserved as a service, for example, preservation of stem cells present in the umbilical cord or preservation of gametes and embryos for future use in an IVF context. The EDPB considers that it is necessary to have an actual 'connection between the processing activity and the offering of good or service, but both direct and indirect connections are relevant and to be taken into account'.29

The second type of activity that triggers the application of the GDPR to controllers or processors not established in the EU is the monitoring of data subject

25EDPB Guidelines 3/2018. See: Judgment of the Court (Third Chamber) 1 October 2015, Case C-230/14, Weltimmo s. r. o. *v* Nemzeti Adatvédelmi és Információszabadság Hatóság, Digital Reports: ECLI:EU:C:2015:639 para. 25, and Judgment of the Court (Grand Chamber), 13 May 2014, *Google Spain SL and Google Inc. v Agencia Española de Protección de Datos* (AEPD) *and Mario Costeja González*, Case C-131/12, *Digital reports:* ECLI identifer: ECLI:EU:C:2014:317, para. 5.3.

26Adapted from EDPB Guidelines 3/2018, p. 8.

27Article 3 (2) GDPR, see also Article 8 EU Charter where the right to data protection is not limited to 'citizens but intended for 'everyone'.

28Recitals 2, 14 and 24 GDPR.

29EDPB Guidelines 3/2018, p. 21. see also Recital 23 GDPR and CJEU case law based on Regulation 44/2001 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters, for example, Joined Cases C-585/08 and C-144/09: Judgment of the Court (Grand Chamber) of 7 December 2010 (references for a preliminary ruling from the Oberster Gerichtshof (Austria))—Peter Pammer v Reederei Karl Schlüter GmbH & Co KG (C-585/08) and Hotel Alpenhof GesmbH v Oliver Heller (C-144/09), *OJ C 55, 19.2.2011, p. 4–5.*

behaviour as far as their behaviour takes place within the Union.30 These are two cumulative criteria. The nature of the processing activity that can be considered as behavioural monitoring is further specifed in Recital 24, which focuses exclusively on the monitoring of a behaviour through the tracking of a person on the internet. However, the EDPB considers that tracking through other types of network or technology involving personal data processing should also be taken into account, for example, through wearable and other smart devices. In a biobanking research context, monitoring may occur in longitudinal studies involving multiple samples and health information retrieved over time or where data subject information is regularly updated. However, it is not clear whether this represents behaviour monitoring since the spirit of the GDPR elucidated in Recital 24 GDPR clearly points to commercial monitoring of consumers. Regardless of this, since health and genetic data enjoys additional protection, there is good reason to understand that health monitoring can also be included and will thus trigger the application of the GDPR.

### **3 Notion of Controller and Processor in Biobanking**

### *3.1 Defnition of Controller and Processor*

In the GDPR, the duties of data controllers and processors have been framed as positive obligations which emanate from the individual rights of data subjects,31 for example, the rights to information, access, rectifcation, erasure and blocking, and to object to the processing of personal data. From a compliance perspective, this means that the frst and foremost important task is to ensure a full understanding of the role each intervenient in biobanking research assumes for data protection purposes.

The legal concepts of controller and processor are established in Article 4 (7) and (8) GDPR as follows:

'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specifc criteria for its nomination may be provided for by Union or Member State law;

'processor' means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

These defnitions have been transplanted without modifcation from the Data Protection Directive32 and have their origin in a similar text in the Council of

30Article 3(2)(b) and Recital 24 GDPR.

31See Chapter, Staunton C (2019) Individual rights in Biobank research under the GDPR.

32*Directive 95/46/EC*. The concept of 'controller' was adopted with a few modifcations from the Council of Europe's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Strasbourg, 28/01/1981 (CoE ETS 108).

Europe's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data33 concluded in 1981. Although the wording appears relatively straightforward, in practice it may not be so simple to assert who is the entity responsible for determining the purposes and means of data processing and identify the (various) entities processing data on behalf of a controller. This is due to contemporaneous organisational differentiation and complexity in both the public sector and private industrial fabric. The scope of these concepts was clarifed by Opinion 1/2010 of the Article 29 Data Protection Working Party (WP29).34 This soft law instrument analysed each operative concept of the defnitions or its three main building blocks: (1) the personal aspect; (2) the possibility of pluralistic control; and (3) the essential elements to distinguish the controller from other actors— 'determination' of 'purpose' and 'means'.35 Controller and processor are independent functional EU concepts to be concretely determined by reference to the factual reality. This means that the type of activities of a biobank will have a bearing on whether and what entities are considered controllers and processors.

A controller is defned by its function and ability to decide on the purposes of processing and the means used. This role is based on a notion of control which can stem from any form of legal entitlement, including both explicit and implicit legal competence or from factual infuence. The controller is also defned by its ability to determine the substantive content of the data processing. This ability must not be absolute: there is room for discretion and delegation. Whoever makes a de facto determination of the 'purpose' of processing is a controller while concrete methodologic issues concerning the choice of 'means' of processing can be delegated. In short, in a biobanking context the controller is whichever entity decides on issues pertaining to those substantial questions which are essential to the core of lawfulness of processing, for example, decisions on the legal basis for processing (e.g. consent or an exception), length of time a biological sample and related data are to be stored and who has access to the personal data processed.

The concept of processor is dependent on the organisational decisions and structure of the controller. The GDPR establishes two basic conditions for qualifying as processor: being a separate legal entity and processing data on behalf of a controller. Since, the controller decides either to process data within the organisation or to delegate all or part of the processing activities to an external entity, generally, processing data 'on behalf' means serving someone else's interest and is linked to the general concepts of 'delegation' and 'representation'. A processor implements

33CoE ETS No.108. This convention, was the only international legally binding instrument on the protection of private life and personal data open to any country in the world, and has been revised by the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CoE ETS No. 223), 128th Session of the Committee of Ministers, Elsinore, 17–18 May 2018.

34Opinion 1/2010 issued by reference to the data protection directive, remains valid since these defnitions transited unchanged to the GDPR.

35Opinion 1/2010.

instructions and decisions of the controller at least with regard to the purpose of the processing and the essential elements of the means.

### *3.2 Joint-Controllers and Joint-Processors*

Data processing responsibilities may be borne by any natural or legal person and if shared will give rise to the notion of joint-controllers and joint-processors. In biobanking practice, situations involving putative joint-controllers and joint-processors present challenges, in particular when different entities submit samples and data to a biobank and/or when such data are shared, used and re-used by a diverse number of research institutions. The jurisprudence of the CJEU supports a broad concept of controller. In *Wirtschaftsakademie*36 the Court of Justice of the EU (CJEU) ruled on joint-controllers, reaffrming the broad concept of controller previously established in *Google Spain.*37 The court based its ruling on the criteria of whether a processor contributes, in the specifc context, to determining, jointly with the main controller, the purpose and means of processing the personal data.38 Applying this reasoning to a biobanking research context, both biobanks, researchers and entities conducting, sponsoring or fnancially supporting research, may be considered data controllers either by themselves or jointly. Their role differentiation and attribution will depend on the contractual relationships and de facto organisation of the research activities. Any entity which processes data on behalf of the controller will be considered a data processor. These activities comprise 'collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction'.39

### *3.3 Relationship Between Controllers and Processors*

Controllers are responsible to ensure that those entities that process the data comply with data protection rules. Contractual relationships established between biobanks and research institutions or commercial companies should set up an allocation of tasks, rights and obligations between the parties, including provisions concerning

36 Judgment of the Court (Grand Chamber) of 5 June 2018, *Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH*, Case C-210/16, OJ C 260, 18.7.2016, ECLI:EUC:2018:388.

37 Judgment of the Court (Grand Chamber), 13 May 2014, *Google Spain SL and Google Inc. v Agencia Española de Protección de Datos* (AEPD) and Mario Costeja González, Case C-131/12, *Digital reports:* ECLI identifer: ECLI:EU:C:2014:317.

38C-210/16 *Wirtschaftsakademie*.

39Article 4(2) GDPR.

the purpose of processing, type of personal data and categories of data subject involved. Among other specifc subjects, data processing contracts should address the issue of transfers of data to countries outside the EU or to international organisations.40 Contracts should also include clauses on subcontracting of data processing activities as processors are precluded from subcontracting without the controller's prior written agreement.41

Territorial scope is also relevant here as often biobanking activities are conducted in collaboration with international research institutions and repositories. Firstly, the EDPB takes the view that the existence of a relationship between a controller and a processor does not necessarily trigger the application of the GDPR to both if one is not established in the Union. This means that 'when it comes to the identifcation of the different obligations triggered by the applicability of the GDPR, the processing by each entity must be considered separately'.42 Secondly, when an EU biobank acting as a controller uses a processor located outside the EU, it will be necessary for the controller to ensure by contract or other legal act43 that the processor will conduct its activities in accordance with the GDPR. This will include imposing on the processors by contract clauses all the relevant obligations placed by the GDPR on processors, and thus extending by contractual means the GDPR scope of application to processors outside the EU. Thirdly, the opposite situation—a biobank processing data on behalf of an institution/controller outside of the EU—is also a recurrent one. In such cases, while the provisions of the GDPR do not apply to the data controller, the biobank, as a processor established in the EU, will still continue to be required to comply with the GDPR obligations imposed on data processors provided that such activities are carried out in the context of its activities.44

### **4 Duties of Biobanks as Controllers and Processors**

### *4.1 Accountability*

Biobanks are responsible and accountable for compliance with data protection rules in their various activities as data controllers, for example, in receiving, holding or distributing biological samples or materials and associated data.45 This means that biobanks in their capacity as data controllers are responsible for implementing the appropriate technical and organisational measures both to ensure compliance and to be able to demonstrate compliance with GDPR principles and rules.

40Article 26(3) GDPR.

41Article 26(2) GDPR.

42EDPB 3/2018, p. 9.

43Article 28(3) GDPR.

44EDPB 3/2018, pp. 10–11.

45Article 5(2) GDPR.

As seen above, the accountability obligations of biobanks also include exercising a supervisor function and ensuring that researchers and entities in the position of personal data processors follow data protection rules.46 If several entities are in the position of data controller, they become joint-controllers. For reasons of legal certainty, joint-controllers have the additional responsibility to determine in a transparent manner the allocation of the shared responsibilities for compliance.

Data protection rules establish the rights of data subjects and impose corresponding duties on controllers and processors. These comprise both the general duty to assure compliance with general principles of data protection stemming from the principle of accountability and specifc duties pertaining to the factual relationship and conduct towards data subjects in the course of data processing activities. General data protection principles include: (1) lawfulness, fairness and transparency; (2) purpose limitation; (3) data minimisation; (4) accuracy; (5) storage limitation; and (6) integrity and confdentiality.47

The principle of 'accountability' inverts the burden of proof, imposing on biobanks acting in the capacity of data controllers the responsibility for demonstrating that all data processing activities are conducted lawfully, fairly and in a transparent manner in relation to the data subject.48 'Lawfulness' of data processing activities is the fundamental basis for compliance with all other duties of controllers and processors under EU data protection law. If data are processed unlawfully, compliance with other duties and obligations will not preclude eventual sanctions. This means that, in the absence of legitimate grounds for data processing, all ensuing biobanking activities will be tainted by the unlawfullness of data processing. Because the right to data protection and privacy are fundamental rights protected by the EU Charter, the legal consequences of unlawful data processing may even expand beyond data protection sanctions. For example, it may hinder the ethical acceptance of the research for patentability purposes.49 Once lawfulness of processing has been established, biobanks and biobank researchers will have to ensure effective compliance with the other principles of data protection mentioned above and the associated duties imposed on data controllers and processors. 'Purpose limitation' means that personal data can only be processed for specifed, explicit and legitimate purposes. Further processing outside the initial purpose/conditions is generally not allowed. An exception is made for 'processing for public interest, scientifc or historical research or statistical purposes'.50 'Data minimisation' means that processing activities are required to be adequate and relevant to the purposes, and the privacy intrusion is limited to the minimum necessary to achieve such purposes.51 The principle of accuracy imposes the duty to take reasonable steps to ensure that inaccurate or

46Article 28(1) GDPR.

47Article 5 GDPR.

48Article 5(2) GDPR.

49Nordberg and Minssen (2016), pp. 138–177; Hellstadius and Schovsbo (2018).

50Article 5(1)(b) GDPR.

51Article 5(1)(c) GDPR.

out of date information is rectifed or erased.52 'Storage limitation' refers to the duty to anonymise or erase data once it is no longer necessary for achieving the original purposes. This principle is also an object of limitation if the personal data are processed solely 'for archiving purposes in the public interest, scientifc or historical research purposes or statistical purposes' provided that the processing is subject to appropriate technical and organisational measures to safeguard the rights and freedoms of data subjects.53 Finally, 'integrity and confdentiality' of personal data against unauthorised or unlawful processing, as well as accidental loss, destruction or damage, is to be ensured by the use of appropriate technical or organisational measures.54

### *4.2 Lawfulness of Data Processing*

### **4.2.1 Categories of Personal Data and Lawfulness in Biobanking**

It is critical to consider data types and their relevance for determining the concrete duties and compliance obligations of data controllers and processors. Unlike data subjects, not all personal data are born equal. Some types of informational content are liable to cause greater intrusion in the data subject's personal private sphere and/ or have a higher risk of being misused for discriminatory practices or outcomes. The rapid development and availability of DNA sequencing, big data techniques and artifcial intelligence (AI) has in recent years changed biomedical research and biobanks. Biological samples are now accompanied by personal data that can be aggregated and correlated through data mining techniques in a variety of ways. Such personal data may originate from health and medical records but also from research and clinical trials and other sources. It may include genetic and genomic data and other epistemological biomedical information but also environmental, lifestyle or social data.

As mentioned, processing personal data is only allowed under specifc grounds and stricter rules apply concerning processing of special categories of personal data, including health data and genetic data.55 It is therefore important, as a matter of compliance, that biobanks distinguish between non-personal and personal data but also between general personal data and special categories of personal data.

The concept of health data is defned in the GDPR as 'personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status'56 and this includes 'all data pertaining to the health status of a data subject which reveal information

52Article 5(1)(d) GDPR.

53Article 5(1)(e) GDPR.

54Article 5(1)(f) GDPR.

55Article 9 GDPR.

56Article 4(15) GDPR.

73

relating to the past, current or future physical or mental health status of the data subject'.57 Health data include both information derived from health records and 'information derived from the testing or examination of a body part or bodily substance, including from genetic data and biological samples'.58

Genetic data means 'personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular from an analysis of a biological sample from the natural person in question',59 in particular, 'chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained'.60 The GDPR imposes obligations on data controllers and processors with a focus on regulating data processing from the perspective of lawfulness of such processing. However, it does not regulate what types of derivative information can be obtained (correlations and inferences) nor what types of uses of data are permissible. Particularly problematic data uses, such as predictions and correlations based on big data analytics and AI, are still only timidly regulated.61 The type of research activities developed by each biobank will have a bearing on determining the most suitable legal basis to rely upon for compliance with the principles of lawfulness, fairness and transparency. In any case, this decision must be made beforehand since controllers have the duty to inform individual sample donors/owners of the legal grounds allowing the data processing before collecting or in any way processing data.62 Because new data processing technologies such as big data analytics allow category jumping inferences, it will often be the case that all data will become personal data, if not immediately then at least in the future. Moreover, the use of biological samples will equate to actual or potential genetic data and health data, and thus a cautionary approach would lead to generally considering that most data processed by biobanks and biobanking research are likely to pertain to one of the special categories of personal data.

### **4.2.2 Modalities for Lawful Data Processing in Biobanking**

General Remarks

Ensuring the lawfulness of data processing is the most essential duty of controllers and processors. In ensuring lawfulness, choosing an appropriate legal basis for processing the data is of utmost importance and has to be performed prior to the

57Recital 35 GDPR.

58Recital 35 GDPR.

59Article 4(13) GDPR.

60Recital 35 GDPR.

61Article 22 GDPR.

62Article 7 GDPR.

collection of data. The GDPR contains several legal basis for data processing. These can be conceptualized as two main models for lawfulness of data processing in biobanks and bio-banking research: (a) consent-based model, and (b) necessitybased model. Depending on the ground for lawfulness, different obligations will be imposed on biobanks in the capacity of either data controllers or data processors. In order to simplify the compliance analysis, in this section it will be assumed that most human data processed by biobanks or in biobanking research are special categories of personal data (e.g. health data and genetic data), and thus attention will focus on the lawfulness grounds established in Article 9 GDPR.

### Necessity-Based Model

Generally, the processing of special categories of personal data, such as genetic and health data, is prohibited. However, biobanks can choose to rely on the exceptions and exemptions provided in Article 9(2) GDPR and so implement either a consent or necessity-based model or a mixture. Among the various exceptions conferring lawfulness of processing, of particular interest for biobanks is data processing justifed by the necessity 'for archiving purposes in the public interest, scientifc or historical research purposes'63 and processing justifed by the necessity 'for reasons of public interest in the area of public health'.64 This data processing model can be suitable where obtaining consent is not possible or excessively burdensome (for example, when data is re-purposed and contact information is missing or outdated), or when consent is insuffcient, redrawn or denied. The defnition of 'scientifc research purposes' is broadly constructed and includes 'technological development and demonstration, fundamental research, applied research and privately funded research'.65

In biobanking research, re-use and repurposing of data has become a necessity where new digital technologies offer increased possibilities to cross-reference large quantities and types of data from multiple sources (big data analytics), including health and medical records. However, data have to be collected 'for specifed, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes'.66 This means that the lawfulness of data processing has to be established prior to the data collection and is connected to the purpose for which the data were collected. The result of this is that a necessity-based model may offer advantages to biobanks and in certain circumstances be the preferred option to establish lawfulness since repurposing of data for archiving or research purposes is generally presumed compatible with the original purpose as long as the controller

63Article 9(2)(j) GDPR.

64Article 9(2)(i).

65Recital 159 GDPR. The recital mentions specifcally 'studies conducted in the public interest in the area of public health'.

66Article 5(1)(b) GDPR.

demonstrates respect for individual rights and freedoms of the data subject and implements appropriate safeguards, such as pseudonymisation (unless this is impossible or impairs the archiving or research purposes).67

Under Article 9(2)(j), processing of health and genetic data without consent is possible for scientifc research purposes provided that processing is: (a) necessary for scientifc research purposes; (b) proportionate to the aims pursued; (c) and respects the essence of the right to data protection.68 These requirements will be relatively simple to fulfl in the case of biobanking activities directly connected with a specifc research project aimed at studying a serious medical condition. However, concerning biobanking activities not directly linked to a specifc research project or where such a link is less immediate or evident, data controllers will need to carefully justify that the use of the data is necessary and proportionate. In any case, the essence of the data protection right must be respected. This means that all processing activities must respect the general principles of data protection: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confdentiality; and accountability.

Article 9(2)(i) GDPR allows Member States to establish the lawfulness of data processing for public interest reasons in the area of public health. Provided that a legal basis exists and specifc measures to safeguard the rights and freedoms of data subjects and the confdentiality of health records are enacted, samples collected in the course of medical treatment might be stored in biobanks and made available for research, alongside patient records. However, a non-consenting data subject is unlikely to collaborate and provide additional samples or necessary specifc information, thus affecting the ability to monitor an individual's health over time or study the health impact of specifc lifestyle or social and environmental factors. Because patient records, even if standardised and comprehensive, are often of limited interest to researchers, the consent-based model will remain vital in any research project where collaboration of the data subject is imposed by methodological considerations.

Processing of data under a necessity framework also implies special obligations to safeguard the rights and interest of data subjects, in particular, the use of technical measures to ensure respect for the principle of data minimisation, including the default use of either pseudonymisation or complete anonymisation if the research proposed can be achieved in that manner.69 All rights of data subjects and respective duties imposed on controllers and processors are to be observed, including specifc national limitations on the processing of health and genetic data,70 unless a derogation from data protection rights is established either by EU or national law.71 Concerning genetic, biometric and health data, Member States are given additional

67Data sharing and repurposing data is a very important issue for biobanking. See below Sect. 4.4.

68Article 9(2)(j) GDPR.

69Article 89(1) GDPR.

70Article 9(4) GDPR.

71Article 89(2) GDPR.

room for manoeuvre and are allowed to introduce more stringent requirements and impose further obligations on data controllers and processors which may amount to further limitations on the processing of these special categories of data.

Article 89 GDPR gives Member States additional leeway to enact specifcations and derogations from the rights of data subjects when lawfulness is based on a necessity framework.72 Exemptions to the duties of controllers and processors may be provided in national law concerning the information requirements73 and rights to rectifcation,74 to erasure,75 to restriction of processing,76 to data portability77 and to object when processing personal data 'for archiving purposes in the public interest, scientifc or historical research purposes or statistical purposes'.78 These derogations from the rights of data subjects have a subsidiary nature and are only admissible as far as the data subject rights render impossible or seriously impair the achievement of the 'scientifc or historical research purposes or statistical purposes'.79 Derogations also have to be specifed and accompanied by appropriate safeguards as to the general principles of data protection. In particular, all exemptions must follow data minimisation, proportionality and necessity principles.80

Biobanks may be able to use these exemptions in national law. However, the question of applicable jurisdiction has to be carefully considered, in particular the possibility that a data set might include individual data which are subject to different national exemptions and complementary rules concerning, for example, the use of genetic data.81 If the legal basis for lawfulness is necessity for research under Article 89(2) GDPR, exemptions to the duties of controllers and processors may be provided in national or EU law concerning: (1) the right of any person to obtain from the controller confrmation as to whether or not their personal data are being processed, and the right to information concerning such processing;82 (2) the right to rectifcation;83 (3) the right to restrict processing;84 and (4) the right to object to processing.85 Where biobanks serve as repositories and data processing is justifed for archiving purposes in the public interest under Article 89(3) GDPR, exemptions

72See Chapter Duguet A-M, Herveg J 'Safeguards and derogations relating to processing for scientifc research: Article 89 analysis for biobank research'.

73Article 15 GDPR.

74Article 16 GDPR.

75Article 17 GDPR.

76Article 18 GDPR.

77Article 20 GDPR.

78Article 21 GDPR.

79Article 89(1) GDPR.

80Recital 156 GDPR.

81For an overview of existing national legislation see: Penasa et al. (2018); p. 252; Briceño Moraia et al. (2014).

82Article 15 GDPR.

83Article 16 GDPR.

84Article 18 GDPR.

85Article 21 GDPR.

established in EU or national law may also extend to the controller's obligation to notify any restriction or erasure of personal data to each third party to whom the data has been disclosed86 and the data subject's right to data portability.87

The right of data subjects to request erasure of their personal data cannot be subject to national derogations under Article 89 GDPR. However, Article 17 GDPR does exempt data processing activities for archiving purposes 'in the public interest, scientifc or historical research purposes or statistical purposes' in accordance with Article 89(1) GDPR88 provided that erasing the data is likely to render impossible or seriously impair the achievement of these objectives.89 If the data are essential but can be fully anonymised, then such an option should prevail. Controllers are under an obligation to justify the refusal to erase and to disclose information about the specifc use of the data in a specifc project.

### Consent-Based Model

When a necessity-based lawfulness basis cannot be established, biobanks will need to resort to a consent-based model in order to avoid data protection liability. It is also a solid strategy through which to build trust and ensure recruitment of research participants while fostering the willingness of participants to provide accurate data, be monitored over time and provide multiple samples and data entries and allow multi-purpose processing.

The literature shows that prior to the GDPR Member States had different frameworks for consent.90 Taking into account the GDPR fexibilities, the situation is likely to be maintained, at least insofar as additional specifc requirements and regulatory oversight are concerned. Under the GDPR, the type of consent necessary for data processing is defned as necessarily being freely given, purpose specifc, informed and unambiguous.91 In order to be legally binding, consent does not need to be given in the form of a signed written document but should be given by a clear affrmative act. Documented oral statements and electronic means are allowed but controllers should avoid 'silence, pre-ticked boxes or inactivity' since only affrmative consent is legally binding.92

Compliance with the principle of fairness and transparency imposes that preformulated consent forms must be written in a manner that is intelligible and easily accessible to the data subject using clear and plain language.93 The use of legal or

86Article 19 GDPR.

87Article 20 GDPR.

88Article 17(3)(d).

89Article 17(3)(d).

90Kaye et al. (2016), pp. 195–200.

91Article 4 11) GDPR.

92Recital 32 GDPR.

93Recital 42 GDPR.

technical terms should be avoided and, if applicable, translated into the native language of the data subjects. The standard for consent is 'free and informed consent'. Documents or information provided orally should contain clear mention of the identity of the controllers and the purpose of the data processing. Consent will not be valid if the data subject has no genuine or free choice or if refusal or withdrawal of consent is detrimental to the data subject.94 This would be the case for multipurpose consent without the possibility to separately consent to different processing purposes or if broad consent is demanded for access to treatment or a service and the data processing exceeds what is necessary for fulflling such goals (e.g. deposit and conservation of biological materials for future use: blood, stem cells, ova, sperm, embryos, etc.).95

Often in biobanking activities samples and information originate from outside the EU. In some cases, local cultural and legal traditions may result in different frameworks, rules and procedures for consent.96 EU data protection rules are based on the EU Charter right to data protection97 and have an extensive territorial application. Thus, if the controller or processor is established in the EU, reliance on local law or customary social norms is not possible and individual data subject informed specifc consent or another legal ground for data processing remains necessary under the GDPR.

Consent should also be specifc and cover every purpose and all processing activities carried out for each purpose.98 The legislators acknowledged that in the case of data used for scientifc research it is often diffcult to identify beforehand all possible data processing purposes and so this opened the door to broad consent. In this sense, Recital 33 clarifes that broad consent—defned by reference to certain areas of scientifc research—can be accepted if procedures comply with 'recognised ethical standards for scientifc research', for example, through an ethical board review.99 WP29 pointed out that Recital 33 does not necessarily mean that specifc consent is not necessary but rather that as an exception and if research purposes cannot be specifed at the time of data processing (sample collecting), it is possible to obtain valid consent and only describe the purpose in a more general manner. However, it also alerts us to the fact that 'when special categories of data are processed on the basis of explicit consent, applying the fexible approach of Recital 33 will be subject to a stricter interpretation and requires a high degree of scrutiny'.100

94Recital 42 and 43 GDPR.

95 In such cases, specifc national legislation may contain more strict rules.

96For an overview see for example: De Vries et al. (2017).

97Article 8 EU Charter.

98Recital 32 GDPR.

99See Marelli and Testa (2019), pp. 496–498.

100Article 29 Working Party, Guidelines on Consent under Regulation 2016/679, last Revised and Adopted on 10 April 2018.

The notion of dynamic consent101 is indirectly accepted. On the one side, data subjects have several rights that can be exercised over a period of time: right to rectifcation of inaccurate personal data and to add supplementary information to incomplete data;102 right to erasure;103 right to restriction of processing;104 right to data portability;105 and right to not be subject to a decision based solely on automated processing.106 On the other side, the re-purposing of data will require informing the data subject and renewed consent. Dynamic consent models offer biobanks the possibility to allow data subjects to exercise their rights to object to specifc types of data processing, specifc purposes, projects or users while simultaneously maintaining consent to a broad range of processing activities. These also simplify procedures for consent for further processing purposes and improve fairness and transparency of data processing. However, it should be noted that overall repurposing of data in biobanking remains a complex matter subject to specifc national regulations107 and where determining if the new use is compatible with the consent provided may not be easy to ascertain.108

Biobanks as data controllers have a duty to implement technical measures to assure that data subjects can, on request, receive the personal data provided in a structured, commonly used and machine-readable format and transmit those data to another controller.109 It is debatable whether data portability duties apply only to raw data or also to established correlations, probabilities or predictions, for example, a diagnosis. As long as a person is identifable then the information is considered personal data and thus subject to the GDPR.110 Inferred data and derived data, such as the outcome of an assessment regarding the health of a user, are, according to WP29, excluded from the right to data portability.111 Furthermore, this information

107See: Tassé (2016), pp. 207–216; Kondylakis et al. (2017), pp. 282–292.

111Article 29 data protection working party, Guidelines on the Right to data Portability, adopted on 13 December 2016.

101Kaye et al. (2015), pp. 141–146.

102Article 16 GDPR.

103Article 17 GDPR.

104Article 18 GDPR.

105Article 20 GDPR.

106Article 22 GDPR.

108See the landmark Italian case concerning the acquisition by United Kingdom–based commercial company Tiziana Life Sciences Plc of Shardna an Italian genomic biobank (Tribunal of Cagliari, Sentenza n. 1569, 6 June 2017) described in Marelli & Testa n.101; see also recent Clinical Research Development Ireland (CRDI) 'Submission to the Data Protection Commission on the topic of the General Data Protection Regulation in relation to Biobanking'(3 May 2018), signed by 28 Representatives of Irish Research Institutions. Available: https://www.crdi.ie/wp-content/ uploads/2018/06/CRDI\_Submission\_GDPR-and-Biobanking.pdf.

109Article 20 GDPR.

110Article 4 (1) GDPR defnes an identifable person as 'one who can be identifed, directly or indirectly, in particular by reference to an identifer such as a name, an identifcation number, location data, an online identifer or to one or more factors specifc to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person'.

may constitute a trade secret or be copyright protected and proportionality arguments may arise, while specifc contractual or patient rights statutory provisions may provide further obligations.

In the context of big data analytics, where data are obtained from a plurality of sources, the controller always has general information duties that may be diffcult to comply with, including providing individual information concerning categories of data, origin, legal basis and purpose of processing and use in automated decisionmaking.112 These duties are waived if providing information to data subjects proves impossible or involves a disproportionate effort, and where the processing is for scientifc research purposes and compliance with such duties would render impossible or seriously impair the research.113 Either way, repurposing of data must always have a legal basis; either it has to be covered by original consent or an exception.

Consent can be withdrawn and the data subject can request that further processing is restricted or that the data is erased. The right to erasure, known as the right to be forgotten, is often considered a potential challenge. However, research activities are protected if the data are necessary for research and their erasure would 'render impossible or seriously impair the achievement of the objectives of that processing'.114 This is not a complete exemption; an erasure request must still be complied with if under the specifc circumstances that individual's personal information is not essential and can be erased without compromising the entire study. In any case, if the data are not erased due to being essential, it might have to be erased from other research projects and cannot continue to be processed in the future unless another ground for processing exists.

Finally, consent to participation in scientifc research activities in clinical trials is subject to specifc legislation—the Clinical Trials Regulation (CTR).115 GDPR principles and other rules remain applicable to data processing in the context of clinical trials.116 Consent for data processing in the context of biobanking samples and data originated or procured for clinical trials will also follow the GDPR rules and should not be confused with informed consent for participation in clinical trials and/or medical treatment.117 Informed consent for these activities is regulated by specifc frameworks and follows a different legal reasoning.118 As explained by the EDPB in Opinion 3/2019, the provisions on informed consent in the Clinical Trials

112Article 14(1) GDPR.

113Article 14(5) GDPR.

114Article 17(3)(d) GDPR.

115Articles 28–35, Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC, *OJ L 158, 27.5.2014, p. 1–76.*

116See the recent, European Data protection board, Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art. 70.1.b)) Adopted on 23 January 2019.

117 Idem, para 15.

118Minssen and Rajam (2019); Chico (2018), p. 116.

Regulation119 respond primarily to core ethical requirements of research involving humans subjects and derive from the Helsinki Declaration. The obligation to obtain informed consent of participants in a clinical trial is primarily required to ensure respect for the right to human dignity and the right to integrity of individuals under Articles 1 and 3 of the Charter of Fundamental Rights of the EU and is not an instrument for data protection compliance.120

This means that informed consent obtained for clinical trials may not be suffcient for data processing purposes. In particular, a 'clear situation of imbalance of powers between the participant and the sponsor/investigator will imply that the consent is not 'freely given' in the meaning of the GDPR'121 (e.g. when a participant is not in good health, belongs to an economically or socially disadvantaged group or is in any situation of institutional or hierarchical dependence). Therefore, consent will not be the appropriate legal basis in most cases and other legal bases than consent must be relied upon.122 Biobanks storing samples or data obtained or used in clinical trials have to conduct a separate assessment on the legal basis of data processing to rely upon and eventually obtain consent for initial or further biobanking activities, unless the so-called presumption of compatibility provided under Article 5(1)(b) GDPR can be relied upon under the specifc circumstances.123

### *4.3 Fairness and Transparency of Data Processing*

Although biobanks operating under the framework for lawfulness established under Article 89 'Interest for scientifc research-based model' are exempted from a number of specifc obligations, the principle of transparency imposes an obligation to inform data subjects at the time data are obtained of the following: (1) identity and the contact details of the controller and, where applicable, of the controller's representative; (2) contact details of the DPO; (3) purposes and legal basis of the processing; (4) recipients or categories of recipients of the personal data; and (5) whether the controller intends to transfer personal data to a third country or international organisation, and the existence or absence of an adequacy decision by the Commission, or reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.124

In addition to this information, biobanks acting as data controllers also have a duty to provide to the data subject at the time personal data are obtained additional information to ensure fair and transparent processing, namely, (1) length of time

119CTR Chapter V, Article 28 e sq.

120EDPB Opinion 3/2019, para 16.

121EDPB Opinion 3/2019, para 20.

122 Idem.

123EDPB Opinion 3/2019, para 29-32.

124Article 13(1) GDPR.

data will be stored (either a fxed date or criteria used to determine it); (2) details about the right to lodge a complaint with a supervisory authority; and (3) the existence of automated decision-making, including profling and meaningful information about the logic involved, as well as the signifcance and the envisaged consequences of such processing for the data subject.125

Although the rule is that data subjects have the right to object to automated decision-making and profling, automated decisions and profling (e.g. diagnostic, epidemiologic studies, categorisations of genetic risk, etc.) based on special categories of data, such as health and genetic data, are not prohibited. In fact, these can be acceptable if based on explicit consent for specifed purposes or if based on the necessity of the processing for reasons of substantial public interest.126

If the ground for data processing is consent, biobanks as data controllers are also required to provide information on the existence of the right to request access to and rectifcation or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability. Biobanks will also be obliged to inform data subjects that they have the right to withdraw consent at any time, and that this will not affect retroactively the lawfulness of previous processing. These obligations will not subsist if data is processed based on other grounds.127

### *4.4 Purpose Limitation of Data Processing*

Data sharing is increasingly necessary for scientifc research, and there is a growing international trend towards open science,128 with major funding agencies and scientifc journals imposing data sharing policies.129 Such policies may implicitly result in imposing the need to share or make public available research data outside the EU. In their turn, EU initiatives also place considerable emphasis on open research data and open access to scholarly publication and communication and reuse of scientifc information.130

125Article 13(2) GDPR

126Article 13(2)(f), Article 22(4) and Article 9(2 (a) and (g) GDPR.

127Article 13(2) GDPR.

128Groves and Godlee (2012), p. e4383.

129Taichman et al. (2017), pp. 63–65; National Institutes of Health (NIH) (2003); Wellcome Trust (2017); European Commission DG for research and Innovation (2017).

130Commission Recommendation of 17 July 2012 on access to and preservation of scientifc information (2012/417/EU); see also Declaration of the Budapest Open Access Initiative https://www. budapestopenaccessinitiative.org/read; Berlin Declaration on Open Access to Knowledge in the Sciences and Humanities https://openaccess.mpg.de/67605/berlin\_declaration\_engl.pdf; The ECHO Charter https://echo.mpiwg-berlin.mpg.de/policy/oa\_basics/charter, and the Bethesda Statement on Open Access Publishing http://legacy.earlham.edu/~peters/fos/bethesda.htm.

Biobanking research by its nature involves the possibility to re-use and repurpose collected samples and information in several research projects. New digital technologies offer increased possibilities to cross-reference large quantities and types of data from multiple sources. The interpretation of the principle of purpose limitation has become a central issue in biobanking as both data sharing and data repurposing raise considerable data protection and ethical issues;131 a balance needs to be achieved with the protection of the rights of data subjects.

The principle of purpose limitation ensures that as a rule all data must be 'collected for specifed, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes',132 and it can be particularly controversial to apply in the context of biobanking sharing and re-use of research data. Subsequent uses may rely either on consent or another ground for lawfulness; both these grounds have to be established at the time a biological sample, tissue or information is collected and further processing has to be compatible with the purpose for which the personal data are initially collected.133 If the lawfulness of data processing is based on necessity for archiving purposes in the public interest, scientifc or historical research, the re-purpose of data for archiving or research is generally presumed compatible with the original purpose as long as the controller demonstrates respect for the individual rights and freedoms of the data subject and implements appropriate safeguards, such as pseudonymisation (unless this is impossible or impairs the archiving or research purposes).134 However, the presumption appears to only apply if it is the same type of research or research project, for example, the EDPB does not think that it necessarily applies to clinical trials data reuse.135 Moreover, if the data processing is based on another lawfulness ground, then compatibility can never be presumed and it is either necessary to establish that the specifc research conducted is compatible with the original purpose or predict and establish at the time of data collection several possible specifc, explicit and legitimate data purposes.

When biobanks intend to further process the personal data for a purpose other than that for which the personal data were collected, information must be provided to the data subjects prior to that further processing concerning such further processing and its purpose, as well as any other relevant information.136 Moreover, often biobanks will store and process data that was not obtained directly from data subjects but instead was originally collected from a third party, for example, biological samples obtained in a clinical setting or use of health records. In such cases, and in

131For an overview on open questions see: Global Forum on Bioethics in Research (2018).

132Article 5(1)(b) GDPR.

133Article 6(4) GDPR. See with adaptations Article 29 Data Protection Working Party Opinion 03/2013 on purpose limitation Adopted on 2 April 2013.

134Article 5(1)(b) and Article 89(1) GDPR; Recitals 157 to 160.

135See EDPB Opinion 3/2019 para 28, recognizing that further guidance in this respect is necessary. 136Article 13(3) GDPR.

the absence of more specifc national or EU legislation,137 information duties subsist in accordance with Article 14 GDPR. There are, however, some exceptions: compliance with information duties is not required if the data subject already has the information. Regarding processing based in public interest and research purposes, there is no duty to provide information if this has been proven to be impossible or would involve a disproportionate effort, or if it is likely to render impossible or seriously impair the objectives of the biobanking activity. The biobank neverthelesss must take appropriate measures to protect the data subjects' rights and freedoms and legitimate interests, including making the information publicly available.138

### *4.5 Data Protection by Design*

As controllers, biobanks are also responsible to implement measures leading to 'data protection by design and default'. Data protection by design implements the principle of data minimisation and is imposed under a standard of reasonability taking into consideration a number of factors, such as the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing.139 Appropriate technical measures include pseudonymisation140 but also measures for ensuring that personal data are only used if necessary for a specifc purpose. This means that all data processed must be relevant for a specifc research question. The data minimisation obligation also applies to ensure that the amount of personal data collected, the extent of their processing, the period of their storage and who is granted access is linked and necessary for the purpose of data processing.141 Generally, biobanks acting as data controllers are always responsible for implementing appropriate technical and organisational measures to ensure compliance with data protection rules. Compliance may be demonstrated inter alia by specifc data protection policies, adherence to approved codes of conduct142 or through use of approved certifcation mechanisms.143

137Article 14(5)(c) and (d) GDPR 'obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or where the personal data must remain confdential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.'

138Article 14(5)(a) and (b) GDPR.

139Article 25(1) GDPR.

140 Idem. Cf. notion of pseudo-anonymisation in Article 4(5) GDPR with different understandings in other normative sources see: Phillips et al. (2017), pp. 483–496.

141Article 25(2) GDPR. On compliance strategies See: Holub et al. (2018), pp. 97–105.

142Article 24 and 40 GDPR.

143Articles 24 and 42 GDPR.

### *4.6 Data Stewardship*

Biobanks are also entrusted with data stewardship duties. These are formulated as the principles of data accuracy, storage limitation, integrity and confdentiality. Data controllers have the obligation to keep records of all processing activities. This obligation is related to the principle of transparency and has the purpose of guaranteeing compliance with data subjects' rights and preventing controllers from alleging insuffcient knowledge based on defcient records as a defence.144 Biobanks acting as controllers are also responsible for guaranteeing the security of data processing activities,145 cooperating with data protection authorities (DPA);146 and notifying the DPA of any data breaches within 72 h147 and each data subject provided that there is a high risk to their rights and freedoms. Data controllers should conduct data protection impact assessments (DPIAs),148 implement measures to mitigate the risks discovered and consult with data protection authorities where such DPIAs determine a high risk that cannot be mitigated.149 Biobanks process special categories of personal data and therefore DPIAs are mandatory.150 Controllers and processors may also be responsible for jointly designating a DPO.151 This duty will apply to biobanks and biobank researchers insofar as their core activity entails processing large amounts of special categories of personal data.152

### **5 Conclusion**

The recent reform of data protection rules in the EU is in several ways a positive step in the direction of balancing individual rights and ensuring that scientifc research and innovation in a data-driven economy are not hindered. A number of exemptions and exceptions are provided for research activities, with Article 89 GDPR making it possible for Member States to adopt further exceptions and exemptions. While this has a positive side, it also favours forum shopping, creates diffculties in pan-European studies and risks reducing harmonisation and transforming the GDPR almost into a de facto *directive* as far as the scientifc research context is concerned.

144Article 30 GDPR.

145Article 32 GDPR.

146Article 31 GDPR.

147Article 33 GDPR.

148Article 35 GDPR.

149Article 36 GDPR.

150Article 35 (3) (b) GDPR.

151Article 37 GDPR.

152Article 37(1)(c) GDPR.

Its broad scope of geographic application expands the application of GDPR to many data processing situations that have a connection with the EU even when the data are not processed in the EU, i.e. either through the data controller or data processor being considered established in the EU or when the data pertain to data subjects in the EU. Local data protection rules might no longer be considered suffcient and, given the level of international collaboration in the feld of biobanking, the GDPR rules might become a *de facto* international data protection standard.

The main restriction imposed on data controllers and processors is the duty to ensure the lawfulness of such activities. The GDPR contains two main legal bases for data processing of interest to biobanks: consent-based model and necessitybased model. It will remain critical to carefully consider which to apply to each data set because combining data sets based on different lawfulness grounds may generate increased compliance complexity.

Finally, the GDPR maintains a regulatory approach based on types of data (personal and special) and general lawfulness grounds for processing. It does not provide specifc rules for particular activities of data processing and types of data uses. Legal persons data are left subject to national laws as the GDPR rules only applies to natural persons data and there is no differentiation between types of more or less intrusive uses. It does not clearly differentiate between raw data and inferred data and derived data. Neither does it consider the privacy impact of cumulative or network effects of data aggregation and cross-reference.

Compliance with the GDPR presents challenges for biobank and biobank researchers using advanced digital technologies. The use of big data analytics has brought tremendous benefts to scientifc research, particularly in the feld of genetics. Developments in this area include cost-effective sequencing of entire genomes and the possibility to share and combine multiple sources of complementary data. The very nature of research using big data analytics in general and genetic data in particular suggests that compliance may be onerous and diffcult to implement in research protocols and institutional procedures. As we move deeper into a digitalised and data-driven society, particularly problematic data uses will require further clarifcation and improved approaches to data protection. Growing use of AI and big data analytics in biobanking activities means that special attention to compliance procedures will be necessary and that in the long term further legal developments and interpretative guidance should be expected.

### **References**

Groves T, Godlee F (2012) Open science and reproducible research. BMJ 344:e4383

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# **Individual Rights in Biobank Research Under the GDPR**

### **Ciara Staunton**

**Abstract** The coming into force of the General Data Protection Regulation (GDPR) on 25 May 2018 has brought about considerable changes in how data may collected, stored and used. Biobanks, which require the collection, use and re-use of large quantities of biological samples and data, will be affected by the proposed changes. In seeking to require 'data protection by design', the GDPR provides data subjects with certain individual rights. They are, the right to be informed, the right of access, the right to rectifcation, the right to erasure, the right to restrict processing, the right to data portability, the right to object and rights in relation to automated decision making and profling.

This chapter will consider each of these individual rights in turn and discuss the impact on biobank research. In particular, it will discuss the challenges that are now facing biobanks in upholding the individual rights, the limits of these rights in light of the technical realities of biobanks, and the potential impact that they may have on the collection, sharing, use and re-use of biological data and material.

### **1 Introduction**

The General Data Protection Regulation (GDPR) seeks to strengthen the protection of personal data and it makes explicit provision for certain personal rights for data subjects: the right to information (Article 13 & 14), the right of access (Article 15), the right to rectifcation (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to data portability (Article 20), the right to object, (Article 21) and the right regarding automated individual decisionmaking (Article 22). The rights are intended to enhance the autonomy and control that a data subject has over the processing of their personal data, and as such, could control and limit the use of a data subjects' personal data.

C. Staunton (\*)

The author would like to thank Drs. Edward S Dove and Deborah Mascalzoni for comments on an earlier draft of this paper and Dr. Carmen Swanepoel for discussion on aspects of this paper.

Middlesex University, School of Law, London, UK

Institute for Biomedicine, Eurac Research, Bolzano, Italy e-mail<EMAIL_ADDRESS>
S. Slokenberga et al. (eds.), *GDPR and Biobanking*, Law, Governance and Technology Series 43, https://doi.org/10.1007/978-3-030-49388-2\_6

Biobanks are repositories that store large quantities of biological samples and data. The data may be in the form of information that a data subject may have given the biobank themselves, or it may be data that is derived from a biological sample. In the processing of this data, biobanks will now need to consider and uphold the individual rights under the GDPR. Biobanks are often involved in collaborative research projects requiring the transfer of data across borders, but differing legal rules can slow down and hinder cross-border transfer. In response, there have been calls for a harmonisation of rules at an international level1 or development of a global governance of biobanks that is based on key principles and norms.2 As such, the GDPR should be welcomed as it seeks to harmonise data protection legislation across the EU, while also facilitating the free movement of personal data across Member States (Article 1). On the face of it, a regulation that promotes the sharing of data and harmonisation of legislation in this realm should support collaborative transnational research.

These individual rights can however be derogated either directly by the biobank or through Member State derogations under Article 89 if the data is to be used for scientifc research, potentially negating the rights of data subjects. Thus, when biobanks are processing data for research purposes they may not have to follow the rights of data subjects where to do so would impair research. The exact scope of these rights will depend on derogations that may be invoked either directly by biobanks, or through Member State derogations. These derogations will be examined in Chapter 'Safeguards and derogations relating to processing for scientifc purposes: Article 89 analysis for biobank research' by Anne-Marie Duguet and Jean Herveg. This chapter will consider the individual rights of data subjects provided by the GDPR. Each right will be discussed in turn and the possible impact that they may have on biobanks.

### **2 Individual Rights and the Impact on Biobank Research**

### *2.1 The Right to Be Informed*

The importance of public trust in biobanks has been well documented3 and inherent in this trust is transparency in the use and re-use of personal data. The right to information contained in Article 13, (information to be provided when personal data is collected from the data subject), and Article 14 (information to be provided when data has not been obtained directly from the research subject), strengthens the principle of transparency.

1 International Bioethics Committee (2015).

2Chen and Pang (2015), p. 113.

3Lipworth et al. (2019), pp. 119–132; Johnsson (2013), p. 142.

Article 13(1) and Article 14(1) details certain information that must be provided to the data subject when their data is collected. The data subject must be provided with information about the data controller, a data protection offcer if applicable, the purpose of the research and its legal basis, the legitimate interests if processing is based on Article 6(1)(f), the recipients of the data, if it is intended to transfer the data to a third country, and the safeguards in place to protect their data in that country. In addition to this, under Article 13(2) and Article 14(2) a data subject must also be told about the duration of the storage of data, criteria to determine duration if it is not known, the right to withdraw if consent is the lawful basis of processing, and the right to lodge a complaint with a supervisory authority. Similarly, under Article 13(3) and Article 14(4), if a data controller intends to process the personal data for research that was not intended at the time of data collection, the foregoing information must be provided to the data subject prior to the further processing of that data.

Thus, irrespective of whether a biobank itself collects data from a data subject or obtains data through other means (e.g. from residual samples or from another biobank), it must provide the data subject with the foregoing information. The difference is that this information must be provided at the time of collection if the biobank itself collects the data, or within 1 month if it obtains the data through other means (Article 14(3)). If a biobank intends to use personal data for research that was not envisaged at the point of data collection, they must inform the data subject in advance of the research if no exception applies.

It is important to note that the right in Articles 13 & 14 is for information purposes only. For ease of compliance with Articles 13 & 14, consent forms should detail the information outlined in Article 13(1)&(2) and Article 14(1)&(2) (where consent is the lawful basis of processing), but the right to information should not be confused with informed consent. The right to information does require biobanks to envisage at the outset who it may collaborate and share the data with, as well as the possible duration of the research.

Article 13 and 14 do provide for instances when the right to information does not apply. Under Article 13, the right to information does not apply when 'the data subject already has the information' (Article 13(4)). The exceptions under Article 14 are wider and are particularly pertinent for research: where the provision of information would prove impossible for research purposes; where it would constitute a disproportionate effort, in particular for research; where provision of the information would seriously impair or make the objectives of the processing (i.e. the research) impossible (Article 14(5)(b)).

If a biobank seeks to rely on the exemption under the impossibility scenario, they would have to clearly demonstrate that the research would be impossible. This could apply if individual data subjects are uncontactable, but it is unclear whether a lack of contact information is suffcient on its own as a basis to rely on impossibility, or whether reasonable efforts should be made to contact data subjects. In any case, such an exemption would apply on a case-by-case basis and would be burdensome. It is thus more likely that any exemption to the right to information for biobanks would fall under grounds of disproportionate effort under Article 14(5)(b).

In determining what could constitute a 'disproportionate effort', Recital 62 states that the number of data sets, the age of the data, and any appropriate safeguards should be taken into consideration. Biobanks will generally have very large data sets; thus, provided there are appropriate safeguards in place under Article 89(1),4 biobanks could be granted an exemption to the right to information when they have not collected the data under Article 14(5)(b). To rely on this exemption, biobanks should conduct a data protection impact assessment (DIPA) to balance the effort of informing data subjects with the risks to the research, and this should be documented.5 This DIPA should be carried out before relying on this exemption and following Article 35(7), the assessment should include a systematic description of the envisaged processing operations and the purposes of the processing, including where applicable, the legitimate interest pursued by the controller; an assessment of the necessity and proportionality of the processing operations in relation to the purposes; an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data.6

The right to information does seem to be potentially limited in the context of research under Article 14(5)(b) when data was not collected from the data subject. As will discussed in the following sections, the exercise of other rights is contingent on data subjects being aware of the processing of their personal data, thus the right to information is important in the exercise of their other rights and any limits on the right to information could impact other rights. However, Article 13(1)(e) requires data subjects to be informed about 'the recipients or categories of recipients of the personal data'. A narrow interpretation of this provision would require biobanks to simply inform data subjects about those to whom the biobank itself shared data. On the other hand, when one considers the importance of transparency in the processing of personal data, it could be suggested that biobanks have an obligation to inform data subjects about all those to whom the data has been shared with, irrespective of whether they shared the data themselves. In reality, this would likely constitute an undue burden on biobanks, particularly when one considers the importance of research in the GDPR. The principle of accountability most likely requires a biobank to be transparent in its own processing of personal information. Thus, under Article 13(1)(e) a biobank will likely only be obliged to inform a data subject about any third party to whom it has shared personal data. Biobanks must thus ensure that they have systems or a register in place that documents all data transfers.

4See Chapter 'Safeguards and Derogations Relating to Processing for Scientifc Purposes: Article 89 Analysis for Biobank Research'.

5Art 29 WP (2018), ICO (2018).

6For more on DIPA's see Dara Hallinan's contribution in Chapter, 'Biobank Oversight and Sanctions under the General Data Protection Regulation'.

### *2.2 The Right of Access*

In a further effort to promote transparency, Article 15 provides the data subject with the right to access information about their personal data, including confrmation as to whether a data controller is processing their personal data and the purpose; other recipients of their personal data, including to third countries (and the safeguards in place); where the data controller obtained the data when the data was not collected from the data subject; and the expected storage period or the criteria to determine the storage period. Under this right, data subjects can access information regarding the research projects that their data is used in, and other biobanks or researchers with whom the data may have been shared.

A data subject is unlikely to be able to exercise their right of access without knowledge that the data controller was processing their data. The right of access is thus dependent upon the right to information and it would be unlikely that a data subject would be in a position to exercise their right to access if a biobank invoked an Article 14(5) exception.

Importantly for research, Article 15(3) provides that the data subject has a right to access a copy of their personal data that is being processed. This can include genetic data, results of particular tests, and results of research and may include information about genetic mutations, conditions that may be inherited and passed onto their children, and conditions that the data subject may be predisposed or susceptible to. To fulfl their obligations under the GDPR, a biobank will be required to provide the data subject with the raw data, but not an interpretation of that genetic data. Meeting this requirement may be tricky considering the wider evolving debate on communication of incidental fndings.7 A right to access thus does not equate to a right to feedback of fndings, if requested, but biobanks are now legally required to provide data subjects with access to their data which can include raw genetic data. Direct to consumer (DTC) genetic testing companies have faced criticisms for making raw genetic data available to its consumers. DTC companies do generally include a disclaimer that the information has not been validated for accuracy, nor do they provide an interpretation of the data, but the risks of possible inaccuracy and false positives have been highlighted.8 Biobanks will now be in a similar position whereby may be legally required to return raw genetic data if requested, without any obligation of the interpretation of that data. Thus arguably biobanks can no longer have a 'no returns' policy, but in returning such data, they must make it clear that they have not interpreted the data and any such interpretation should be done by a trained genetic counsellor.

7De Clercq et al. (2017), pp. 128–131; Wolf et al. (2012), pp. 361–384.

8Tandy-Connor et al. (2018).

### *2.3 The Right to Rectifcation*

The right to rectifcation provides the data subject with the right to have inaccurate personal data corrected and incomplete data to be completed. This rectifcation must then be communicated to any other recipient who has received the data, unless it involves a disproportionate effort (Article 19). This right is linked with the principle of transparency under Article 5(1)(d) that requires that personal data be accurate, kept up to date and every 'reasonable step' be taken to rectify any inaccuracy.

Genetic and genomic research is rapidly evolving, but genome sequencing and genetic testing may lead to results that are of uncertain signifcance or relevance and this uncertainty is inherent in genomic research. Uncertainty does not equate to inaccuracies, and biobanks will only be required to update any inaccurate information. This rectifcation must be communicated to any third party that has been provided with the data. Similar to Article 15, a data subject will likely only be in a position to exercise that right if they have been informed that their data is being processed. However, unlike Article 15, this obligation to notify third parties can be limited if it would prove to be impossible or require a 'disproportionate effort'. Assessments of 'disproportionate effort' will need to be carried out and determined on a case-by-case basis, and should be recorded in the interests of transparency. Rectifcation of data that has formed part of research results that is published will most likely be considered disproportionate, if not impossible.

### *2.4 The Right to Erasure*

Article 17 (a)–(f) describes when the right to erasure (more commonly known as the right to be forgotten) may be invoked, but in the context of biobanks, the right to erasure is most likely to be invoked under Article (a)–(c), namely that the personal data is no longer required for the purposes for which it was obtained (Article 17(a)), the data subject withdraws consent where consent is the lawful basis for processing (Article 17(b)), and the data subject objects to the processing under Article 21(1) (discussed below) when public interest or legitimate interest is the lawful basis of processing (Article 17(c)). Thus, data subjects can invoke a right to erasure when the research has been completed, they withdraw their consent (where consent was the lawful basis of processing), or they object to the public interest or legitimate interests as the basis for the use of their research. Data subjects have the right to request the erasure of their personal data from all data controllers that are processing their data under Article 17(2). Biobanks thus must communicate with those they have shared the data of this request for erasure.

Upon receipt of a request for erasure, a biobank will be required to erase all personal data that they have about that data subject and, as discussed, inform all other subsequent data controllers about this request. The data must then be removed from ongoing research and will not be used in any future research or shared with other

data controllers. The erasure of the retrospective use of data is more challenging as the data may have formed part of published results, and it such erasure is likely to be challenging in practice if not impossible. As noted by Melham et al 'past uses of data and samples cannot be undone'.9

This right to erasure is, however, limited. First, similar to other rights, invoking the right to erasure pre-supposes that a data subject is aware of the processing of their personal data. As earlier discussed, this is only likely to occur where data was collected from the data subject. Second, Article 19 states that data controllers do not have to communicate to those with whom it has shared personal data a request for erasure if it is impossible or would involve a disproportionate effort. Similar to Article 16, what is considered to be disproportionate will depend on the circumstances of the case and the reasons for any decisions should be recorded. Third, Article 17(3)(c) states that a request for erasure and notifcation to other controllers processing the data does not have be complied with if processing is in the publics' interest in the area of public health under Article 9(2)(h) and (i), subject to Article 9(3). Thus, a biobank can be exempt from a request to erasure if the research is for the purposes of preventive or occupational medicine, protect against serious crossborder threats to health, or ensure high standards of quality and safety of health care, medicinal products or medicinal devices.

Finally, Article 17(3)(d) states that a request for erasure does not have to be complied with if the processing is for research purposes, subject to the safeguards in Article 89(1), where fulflment of the right to erasure would 'render impossible or seriously impair the achievement of the objectives of that processing'. Thus, subject to Article 89(1) safeguards, a biobank processing personal data for research purposes would not have to comply with a request for erasure.

The right to erasure is signifcantly limited in the research context. Biobanks that are seeking to be exempt from any request for erasure should conduct an assessment, make a record of its assessment and communicate its decision to the data subject, in the interests of transparency.

### *2.5 The Right to Restrict Processing*

Article 18 gives the data subject the right to restrict the processing of their personal data on a number of grounds: if they are contesting the accuracy of the data; if the processing is unlawful and the data subject opts for restriction of data processing over the erasure of data; if the data is no longer needed for processing but the data subject requires it for a legal purpose; or if the data subject has objected to the processing of data under Article 21(1) (to be discussed below). Although in the biobank context its practical impact may be limited, if the right to restriction is invoked on one of those grounds, the biobank can continue to store the data, but they can no

97

9Melham et al. (2014).

longer process the data. Thus, there will be no obligation on the data controller to remove or erase the data from previously published results. As such, the right to restriction applies to both current and future research.

Similar to Articles 15, 16 and 17, a data subject can only exercise this right if they are aware that their data is being processed for research. Furthermore, it is also limited by Article 19, and therefore the biobank is under no obligation to inform subsequent data controllers about this notice of rectifcation if it would prove to be impossible or involve a 'disproportionate effort'.

### *2.6 The Right to Data Portability*

In keeping with the aim of giving data subjects greater control over their personal data, under Article 20, data subjects have the right to data portability. For biobanks, this will mean that data subjects can now move their data from one biobank to another, in circumstances where they have provided the data to the biobank. The biobank must make this data available in a 'structured, commonly used and machinereadable format' to another biobank that the data subject may have selected. That transfer can either be carried out by the data subject or they can require the biobank to make that transfer. As the transfer must be made 'without hindrance from the controller', there is an obligation to put in place measures to facilitate such a transfer. Interoperable formats are encouraged, but this does not extend to requiring controllers to adopt systems that are technically compatible with other organisations (Recital 68).

This right only applies in circumstances where the following conditions have been met: the data subject has provided the data controller with the data, consent is the lawful basis of processing and the processing is carried out by automated means (Article 20(1)). Thus, if a biobank is processing data for research on any other legal basis, they will not be required to comply with a request under Article 20. Equally, the use of shared data, irrespective of the legal basis of processing, will not be subject to Article 20. This right will have limited applicability in the biobank context as the Art 29 Working Party makes it clear that 'inferred data and derived data are created by the data controller'. Thus any data derived from a biological sample will not come under the defnition 'provided by the data subject'.10

In circumstances where a data subject seeks to enforce their data portability right, exercise of Article 20 does not amount to erasure and is not a withdrawal of consent. Rather, it is a transfer of data only and the Article 29 Working Party has made it clear that the data controller can continue to process the data after a transfer has been made.11 This means that under Article 20, biobanks will be required to transfer the data if requested, but can continue to use the data in current and future

10Art 29 WP (2017).

11Art 29 WP (2017).

research. The biobank to which the data subject originally gave and consented to the use of their personal data in research can continue to use that data after Article 20 has been invoked.

### *2.7 The Right to Object*

Article 21 provides data subjects with the right to object to the processing of their data if the lawful basis of processing is either public interest (Article 6(1)(e)) or legitimate interests (Article 6(1)(f)). Thus, if a biobank is relying on either of these claims as the lawful basis of processing, a data subject can object to the use of their data in the research. The impact of the right to object for a biobank is that it can no longer use that data for research purposes, but does not amount to an erasure of data.

In practice, the exercise of this right could be limited for biobank research. Similar to Articles 15–18, exercise of this right will only be possible where the data subject is aware that their data is used for research. In circumstances where the data subject is aware of such use, Article 21(1) states that the data controller can continue to process data if they can demonstrate 'compelling legitimate grounds' that override the rights of the data subject. Article 21(6) also states that while a data subject can object to processing of data for research purposes under Article 89(1), this right can be derogated from where the processing is in the public interest.

Furthermore, although a data subject does have the right to object to the processing of data for research pursuant to Article 89(1), a data controller can continue to use the data for research purposes if it is necessary 'for reasons of public interest'. Recital 45 states that health purposes could come within the meaning of 'public interest' and Pormeister argues that due to the importance of research in the GDPR, research that benefts society such as genetic research could be a legitimate claim on which to continue processing.12

### *2.8 Rights in Relation to Automated Decision Making and Profling*

Finally, under Article 22, a data subject has the right not to be subject to a decision solely on automated decision making, which includes profling, if this produces 'legal effects' on the data subject, or 'signifcantly affects' them. Profling is defned in Article 4(4) as 'any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's

12Pormeister (2017), p. 141.

performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements'.

Profling is commonly used in biobank research as samples and data can be classifed according to certain characteristics (e.g. age, sex, disease profle). Artifcial intelligence can help researchers analyse and sequence DNA much quicker, enabling researchers to interpret and turn it into clinically actionable knowledge.13 They can predict the odds of an individual developing a disease or how they may respond to a particular drug or therapy. The use of Artifcal Intelligence (AI) and machine learning in genomic research is likely to increase as it assists in the analysis of increasingly complex data sets.14