Research on human biological samples taken from a living person, and which may be linked to that person, must obtain ethical approval before it can be conducted.32 Such a review is conducted by the Swedish Ethical Review Authority. The requirement also applies to research conducted on samples that are collected outside healthcare, and thus outside the scope of application of the Biobank Act. For samples taken within healthcare, rules on consent are made complicated by multiple consent rules since the collection and storage of samples for treatment and other medical purposes are also regulated in the Patient Act.33

Further, according to the Biobank Act, samples may not be used for purposes other than those covered by prior information and consent without the donor being informed and consenting to the new purpose, unless permission has been granted by the Swedish Ethical Review Authority.34

### *3.3 Consent and Processing of Personal Data in Research*

As seen above, consent is of primary importance in the Biobank Act. Somewhat in contrast to the heavy reliance on consent in that Act, according to the GDPR consent is only one of several available legal grounds for processing personal data in research.35 The Swedish legislator has not enacted a general rule regulating research in the context of the GDPR, but the issue was discussed in the preparatory works (an important source of law in the Swedish legal tradition) to the Data Protection Act. The government has stressed that the legal basis for processing personal data in a public context is normally public interest under Article 6(1)(e).36 The public interest is spelled out in legal documents governing public authorities and other organizations, as required in GDPR Article 6(2). In general, this requirement is recognized as the principle of legality whereby governments must operate. If processing of personal data is necessary to fulfl the general commission or a specifc task of the government organization, then public interest becomes the relevant legal basis for the processing. Legal documents may include laws, ordinances, government

31Articles 13 and 14 GDPR.

32 4 § p. 3 and 6 § Ethical Review Act (2003: 460 [Lag (2003:460) om etikprövning av. forskning som avser människor Act].

33Chap. 4 Patient Act (2014:821) [Patientlag].

34Chapter 3, Section 5 Biobank Act.

35 a. 6.1a of the General Data Protection Regulation (EU) 2016/679 (GDPR).

36Government Bill 2017/18:105 New Data Protection Law [Ny dataskyddslag], p. 49.

decisions and instructions to public agencies as well as some decisions made by public agencies, such as permissions granted by the Swedish Ethical Review Authority.37

A general commission to perform academic research was established in the Higher Education Act.38 The ordinance applies to higher education institutions for which the Government is the accountable authority, which includes the majority of Swedish research universities. This means that the legal ground for research under this Act is public interest and not consent. In many cases also research conducted by private entities qualifes if the research is regulated by any of the legal documents types listed above or based on a government or government agency decision. In some cases private entities conduct research that does not fall under the Act, for example, some of the research by pharmaceutical companies. When that occurs, the processing of personal data may be allowed by consent or under Article 6(1)(f), i.e. legitimate interest, which entails a case-by-case weighing between the controller's legitimate interest of processing and the registered subject's right to privacy protection. In general, the Swedish interpretation of the GDPR puts a strong emphasis on public interest as the default legal ground for processing personal data in research and other publicly-motivated activities.

This also applies to the processing of special categories of personal data (sensitive personal data) as regulated in Article 9.(2)(g). The Ethical Review Act requires that research in Sweden on categories of personal data listed in Article 9.1 GDPR as well as criminal convictions and offenses must be approved by the Swedish Ethical Review Authority.39 Accordingly, the Act provides the legally based safeguard required for research performed in Sweden.40 The ethical approval of a research project sometimes requires consent as a safeguard, but the legal basis of processing is normally public interest, as discussed above. The traditional requirement for consent in the area of medical studies may therefore be waived under special circumstances, including practical considerations when processing historical data collected across long time periods or very large volumes of data from national registries.

The collection and preservation of samples in biobanks, as well as their general availability for medical treatment and research purposes, is based on mandatory consent according to the Biobank Act as described above. In line with this, for research on biological material from a living person, the Ethical Review Act also prescribes mandatory consent.41

As mentioned above, the GDPR offers a defnition of consent in Article 4(11), which is further elaborated in Recital 42. When consent is used, that defnition should be followed. It is almost identical to earlier defnitions based on the Swedish

37 Ibid., pp. 56–59.

38 2 § Higher Education Act (1992:1434) [Högskolelag].

39 3 and 6 §§ Ethical Review Act.

40Note that ethical permits cannot be received, and hence not used as safeguards, for research conducted outside of Sweden. In that case, some other safeguard must be in place.

41 17 § Ethical Review Act.

Personal Data Act which implements the EU Data Protection Directive.42 But processing of genetic data has now been added to what is considered to be special categories of data (Article 9(1) GDPR, in Sweden referred to as 'sensitive personal data'43). Hence, consent must be freely given, specifc, informed, unambiguous and, in the case of sensitive personal data, explicit. It should be based on a statement or a clear affrmative action. The person providing consent must be given suffcient information before making the decision.

The possible scope of consent given for research has been widely discussed.44 Article 4(11) GDPR states that consent must be specifc and explicit. Swedish medical and social research is frequently based on large data collections preserved over long time periods. Modern epidemiological theories highlight the necessity of very long follow-up periods to investigate the effects of sometimes inherited individual properties and long term exposures to risks starting far back in time. This is relevant, not least for medical research using biological samples. The need to be more open to a broad description of the fnal purpose of the research is acknowledged in Recital 33 of the GDPR. At the current point in time, the practical importance of Recital 33 for how consent can be obtained for research has not been defnitively resolved in Swedish law.

A couple of additional remarks regarding the requirement of explicit consent for sensitive data are needed. According to the current Swedish interpretation, this additional requirement does not exclude consent given orally or by a clear affrmative action, such as knowingly participating in a clinical study.45

Further elaboration is needed with respect to the possibility to collect samples and derive data from them for widely defned research purposes. An exception to the rules in Article 5.1(b) GDPR on specifc purposes is found in the Biobank Law, which allows for the long-term preservation of biobank samples in repositories together with data on the sample providers. The samples and data may only be used for the purposes for which they have been collected and received consent, unless it is for a research purpose which has been approved by the Swedish Ethical Review Authority or is located within an approved clinical trial.46

42Personal Data Act (1998:204 [Personuppgiftslag)].

43Government Bill 2017/18:105 New Data Protection Law [Ny dataskyddslag], p. 75.

44A summary of the national discussion can be found in the Governmental Inquiry (SOU) 2017:50 Processing of Personal Data for Research Purposes [Personuppgiftsbehandling för forskningsändamål], pp. 168–171.

45Governmental Inquiry (SOU) 2017:50 Processing of Personal Data for Research Purposes [Personuppgiftsbehandling för forskningsändamål], pp. 175–176.

46Chap. 3, 5 § Biobank Act.

### **4 Individual Rights and Safeguards**

### *4.1 General Legislation on Derogations from GDPR Rights in Swedish Law*

As mentioned above, in addition to the rights described in Chapter 3 of the GDPR, individuals are protected by the Public Access to Information and Secrecy Act47 for any information held by a public authority. This law is based on the constitutional Freedom of Press Act48 and provides strong protection against unwarranted disclosure of personal information from offcial records.

In addition, Sweden has enacted a Data Protection Act which lays down general complementary rules to the GDPR. Initially, a specifc Act for research data was planned49 but in a rather late stage of the legislative process rules concerning processing personal data for research were included in the Data Protection Act instead. With this approach, the possibility to make research exemptions and derogations has been implemented in a minimalistic manner, relying on the rules in the GDPR to be applied directly or with already-existing Swedish rules that correspond to the allowable derogations. The government has been delegated the power to enact further regulations to implement exemptions under Article 89.2 GDPR, though no such rules have been enacted as of Summer 2020. The view taken has been that existing national legislation suffcient covers the needs, while being in accordance with the GDPR. Some small and predominantly formal changes have been made in a number of laws and ordinances pertaining to specifc registries in the social and medical sector which are frequently used by researchers. As an example, the existing national legislation provides a possibility for a donor to withdraw consent for use of the sample at any time. If the withdrawal applies to all types of use, the sample must be destroyed or anonymized immediately.50

### *4.2 Technical and Organizational Safeguards*

According to Article 89.1 GDPR, safeguards must be included to protect personal data in research. In the case of sensitive personal data, such safeguards have to be based on legislation. Procedures for informed consent in biobanking and in research, and requirements for ethical approval, were discussed above (Sects. 3.2–3.3). In the proposed law on processing personal data in research it was initially planned to explicitly state that the existing procedure for ethical review was a legal requirement

47The Public Access to Information and Secrecy Act (2009:400)] [Offentlighets- och sekretesslag].

48Freedom of the Press Act (1949:105) [Tryckfrihetsförordning].

49Governmental Inquiry (SOU) 2017:50 Processing personal data for research purposes [Personuppgiftsbehandling för forskningsändamål].

50Chapter 3, 6 § Biobank Act.

for sensitive data in order to strengthen pseudonymization as a preferred safeguard and to make the possibility to opt out from a research project a non-disputable right. In the end, however, the corresponding rules in the GDPR were seen as providing suffcient levels of protection with respect to the right to object to processing and the option to use pseudonymization as a safeguard. In addition, the Swedish Ethical Review Act was considered to already meet the requirement of being a legally grounded safeguard for sensitive personal data. The Swedish Data Protection Act includes a general safeguard rule for purpose limitations in research according to which researchers may only use personal data collected for research purposes to take action vis-a-vis the data subject, if there are particular reasons for the vital interests of the data subject.51 Further, the so-called 'Life Gene Act', enacted as a response to regulatory diffculties to collect information for a major long term research infrastructure project named Life Gene, states that a data controller must limit the electronic access to personal data to what each person needs to be able to fulfl his or her work tasks in relation to the register.52 Direct access to personal data in the register is forbidden.53

### *4.3 Further Adaptions on Rules for Informed Consent in Biobank Research*

As mentioned above, all research on human biological samples, sensitive personal data and personal data on criminal offenses must obtain ethical approval before being conducted.54 Further, the Biobank Act requires specifcally informed consent for collecting and storing samples.55 With the proposed Biobank Act, it is suggested that the rules for information, consent and withdrawal in healthcare and research should be applied to biobanks. Accordingly, the Data Protection Act, the Patient Data Act 56 and the Ethical Review Act for research on identifable biological samples should be applicable also for samples stored in biobanks.57 No rules for consent were therefore proposed to be included in the new Biobank Act. According to the proposal, the Patient Act would give the patient a right to be informed and a right to either withdraw the sample or limit the allowable use of the sample.58

51Chap. 4, 1 § Data Protection Act.

52 10 § Act on Certain Registries for Research on what Inheritance and the Environment Mean for Human Health [Lag (2013:794) om vissa register för forskning om vad arv och miljö betyder för människors hälsa ('Life Gene Act')].

53 11 § 'Life Gene Act'.

54 6 § Ethical Review Act.

55 3 Chap. 1 § Biobank Act.

56Patient Data Act (2008:355). [Patientdatalag].

57Governmental Inquiry (SOU) 2018:4 Biobanks of the Future [Framtidens biobanker], p. 274.

58 Ibid., p 284 and Patient Act (2014:821) [Patientlag].

The obligation to inform and the right to object to processing in the Patient Data Act does not meet the general GDPR requirement of valid consent. It is not based on a statement or a clear affrmative action but instead requires action by the data subject if he or she wishes to be excluded. But the rule does correspond to the right to object to or restrict processing stated in Articles 18 and 21 GDPR. The Patient Data Act strengthens this right by removing the limitation of the right to object included in Article 21(6) GDPR so that it applies to all patient data, except to those that fall under the communicable diseases legislation on public health hazards.59

### *4.4 Proposals for Further Legislation*

Two further legislative Acts have been proposed but not yet enacted, namely, as mentioned above, a new Biobank Act,60 and further, an Act that provides long-term regulation of research databases.61 Both would be important for regulating the processing of personal data for healthcare and other population-based registries in research, as well as for the creation of a national biobank register where samples can be traced for utilization in research and combined with other clinical data.

### **5 Law in Context: Individual Rights and Public Interest**

### *5.1 Minimalistic Regulatory Approach, But Hardly a Restrictive View on Research*

As seen above, the Swedish legislator has taken a minimalistic approach when it comes to implementing exemptions for handling personal data for research purposes. No general exemptions have been introduced. Instead, the Swedish legislator has chosen to rely on the GDPR directly and on general Swedish law already in place. This could be interpreted as an indication that Swedish law is restrictive in relation to the use of personal data in research, but this is not a correct conclusion.

First, the preparatory works for implementing rules on processing of research data clearly state that the exemptions in the GDPR are to be applied in Sweden.62 As described above, according to the government much of the previously-existing Swedish legislation provides such exemptions. The motive for not including any further exemptions is thus that they are already in place and are GDPR-compatible.

59Chap. 2 and 3, Communicable Diseases Act [Smittskyddslag (2014:168)].

60Governmental Inquiry (SOU) 2018:4 Biobanks of the Future [Framtidens biobanker].

61Governmental inquiry (SOU) 2018:50 Right to Research [Rätt att forska].

62Governmental Bill (prop.) 2017/18:298 Processing personal data for research purposes [Behandling av. personuppgifter för forskningsändamål], pp. 116, 120, 124 and 128.

Further, it may be argued that the wide access to personal data via Swedish public registries in itself calls for a high level of protection for the data subjects concerned.

Second, as mentioned above, academic research is widely seen as a public interest laid down in the law,63 which makes it the basic legal ground for research that uses personal data in the feld of public health as well as in other areas. This extends to much research carried out also by private research entities64 which otherwise would have to rely on consent or legitimate interest.65 Hence, public interest opens up the possibility to use large databases with personal data collected over long time periods in health-related research.

Third, Sweden has a long tradition of keeping registries with information on identifed persons and deceased individuals for the entire or large parts of the population. Statistics Sweden, a government agency producing offcial statistics, keeps at least 40 registers that are interesting for research. The National Board of Health and Welfare keeps some 15 registers on health, healthcare and social services, such as the national cancer register, the national patient register, the causes of death register, etc. The county councils collaborate around a system of clinical care registers (socalled healthcare quality registers). Currently, there are over 100 clinical registers in different felds that have attained certifcation as national registers and are partly intended for research use. All of these resources can be used together with biobank data in research.66

As mentioned above, since 1947 all Swedish residents have been assigned a PIN, a personal identifcation number, that applies to all sectors of society and is used by private as well as government organizations as a common mean of identifcation. The PIN consists of a date of birth and an additional four digits. This provides a fertile ground for register-based research, which can include personal data from biobanks if there is a system whereby biobank data can be found and combined with other register-based data. This would make it possible to combine data from all the registers on the individual level and make retrospective cohort studies of a number of important health problems. Such a searchable national register of biobanks holdings is being proposed as part of the new biobank legislation but has not yet been implemented.

### *5.2 Further Legislative Reform: Research Databases*

There are currently three legislative Acts in force providing possibilities for researchers to build research databases based on personal data from public registries for research purposes which can be used for several purposes within a broadly

63Governmental Bill (prop.) 2017/18:298 Processing personal data for research purposes [Behandling av. personuppgifter för forskningsändamål], p. 34. In the case of research the appropriate regulation is found in 2§ Higher Education Act (1992.1434).

64Governmental Bill (prop.) 2017/18:298 Processing personal data for research purposes [Behandling av. personuppgifter för forskningsändamål], pp. 35–36.

65Article 6(1)(f) GDPR.

66 https://www.registerforskning.se/en/.

specifed feld of research.67 A recent governmental inquiry proposed a new Act on research databases which may replace these Acts. The inquiry pointed out that Sweden has a world-leading position in terms of statistics about living conditions and health, and that the proposed Act could provide a stronger regulatory framework to promote an effective use of existing registers and databases in research adapted to modern database and data protection technology. This would make it possible to build new infrastructure for research within broadly defned subject matter areas consisting of both new data and data collected from the public registers. It is proposed that the instrument of ethical review be expanded so that universities can be granted permissions to build national research databases which are accessible exclusively for research and not available for other purposes. The inquiry recommends as an additional safeguard to use remote access to such national research databases when possible instead of distributing a great number of copies of personal data fles across the research community. Similar proposals have been discussed in neighbouring countries but have not, to the knowledge of the authors, been proposed as legislation.

As mentioned above, a national biobank register intended for tracing samples collected in Swedish biobanks is also being proposed, which would be accessible for researchers.68 Efforts have been made to develop comprehensive patient-oriented medical records which would also be accessible for researchers.69

### **6 Future Possibilities for Biobanks in Research**

### *6.1 Consent and Public Interest*

The future role of consent is a matter of uncertainty in the context of biobank research where the handling of samples legally based on consent has to go hand in hand with the processing of personal data in research based on public interest. A similar problem exists in how the pharmaceutical and medical technical industry can obtain permission to collect and keep data for partly proprietary research purposes, given that the basis for processing and preserving data in this area is also based on consent at the time of data collection. The consent given in both these contexts is a general purpose consent, which is at odds with the GDPR principles. The interpretation of Recital 133 on the scope of consent for research processing

67Act on Certain Registers for Research on what Inheritance and the Environment Mean for Human Health [Lag (2013:794) om vissa register för forskning om vad arv och miljö betyder för människors hälsa], Act on Forensic Psychiatry Research Register [Lag (1999:353) om rättspsykiatriskt forskningsregister], and Act on Processing of Personal Data at the Institute for Evaluation of Labour Market and Education Policy [Lag (2012:741) om behandling av. personuppgifter vid Institutet för arbetsmarknads- och utbildningspolitisk utvärdering].

68Governmental Inquiry (SOU) 2018:4, Future Biobanks [Framtidens biobanker], p. 229.

69Governmental Inquiry (SOU) 2018:4, Future Biobanks [Framtidens biobanker], p. 307.

will be of importance here, as well as the reliance on public interest as the basis for the processing of large data holdings preserved over long time periods where renewed consent becomes impossible in practice.

### *6.2 Public Disclosure, Secrecy and International Collaboration*

Beyond the GDPR and the proposed national laws on biobanks and research databases, the Freedom of the Press Act and the Public Access and Secrecy Act establish important rules governing the access to offcial documents, including personal data held by the authorities. The secrecy rules of statistical authorities and healthcare providers differ. This has created legal obstacles for the possibility to use a national biobank register to search for samples and combine them with clinical information from healthcare or clinical registers, which has not yet been resolved. The Public Access and Secrecy Act seems to limit the possibility to make the wide searches in population registries that are necessary to fnd matching cases in morbidity/mortality registries and biobanks in order to build relevant research databases for cohort studies of the biological and social determinants of health.

In addition, the Public Access and Secrecy Act may make it more diffcult to achieve the cross-country free fow and exchange of data within the EU that is a goal of the GDPR.70 The exchange of personal data for research purposes with third countries is still curtailed by this Act as well, since it requires a guarantee that Swedish law on freedom of information and secrecy will be upheld in the country receiving the personal data. The enactment of the GDPR did not change this fact as it respects existing national legislation in this area.71

The matter is further complicated by the diffculty to create international agreements that will extend GDPR data protection rules to territories outside the EU. For instance, this applies to research collaboration with the USA. It has not been granted an 'adequacy decision' demonstrating that appropriate data protections are in place, which would enable transfers to proceed without additional justifcation or safeguards.72 The US-EU Privacy Shield does not serve that purpose for public agencies since it is focused on commercial transfer.73 US authorities are not able to agree to all of the contractual provisions set forth by European counterparts due to statutory conficts with US legislation.74 Whether the derogations listed for important reasons of public interest in 49(1)(d) GDPR would apply to some specifc transfers of research data without the receiving country's adherence to the GDPR has not yet been suffciently explored.

70Recital 5 and Article 1(3) GDPR.

71Recital 154 and Article 86 GDPR.

72Article 45 GDPR.

73EU-US Privacy Shield Framework Principles issued by the U.S. Dept of Commerce and approved by the EU Commission on February 2, 2016.

74Personal communication with Robert Eiss, legal expert National Institutes of Health (NIH), USA.

### **7 Concluding Remarks**

In conclusion, the Swedish regulatory framework for allowing the use of health data for research is, on the one hand, rather permissive, giving researchers wide access to registries, but, on the other hand, a bit ambiguous. No specifc legal basis for processing personal data in research has been introduced in law, but the government has indicated that this is not needed given the legal context that already exists in which public interest is the default.

In general, the research exemptions in the GDPR have not been implemented in a clear and unequivocal manner in Swedish law, thus leaving researchers with an imprecise and ambiguous framework. Lastly, several governmental inquiries have been undertaken over the years, and these have made proposals for clearer and, to some extent, less burdensome regulations for biobanking and register-based research. As of Summer 2020, these have not been enacted. To what extent the GDPR has affected the policy choices of the Swedish legislator is therefore uncertain.

### **References**

Cramer K (2016) What is a LIMS?. sapiosciences.com

Hirschfeldt J (2017) Free access to public documents – a heritage from 1766. In: Lind A-S, Reichel J, Österdahl I (eds) Transparency in the future – Swedish openness 250 years. Ragulka, Visby

Reichel J (2018) Public access or data protection as a guiding principle in the EU's composite administration? An analysis of the ReNEUAL model code in the light of Swedish and European case law. In: Wahlgren P (ed) 50 years of law and IT, Scandinavian studies in law. Jure, Stockholm

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# **Part IV Fragmentation and Ways Forward**

# **Biobanking Across Europe Post-GDPR: A Deliberately Fragmented Landscape**

**Olga Tzortzatou, Santa Slokenberga, Jane Reichel, Andreia da Costa Andrade, Carla Barbosa, Sofe Bekaert, Evert-Ben van Veen, Carlos M. Romeo-Casabona, Katharina Ó. Cathaoir, Gauthier Chassang, Annelies Debucquoy, Jean-Jacques Derèze, Laurent Dollé, Sonja Eaker Fält, Radek Halouzka, Mette Hartlev, Michael Hisbergues, Nils Hoppe, Isabelle Huys, Els Kindt, Anne Kjersti Befring, Lukasz Kozera, Dorota Krekora-Zajac, Teodora Lalova, Michaela Mayrhofer, Anastassia Negrouk, Jakub Pawlikowski, Simone Penasa, Kärt Pormeister, Emmanuelle Rial-Sebbag, Anastasia Siapka, Tom Southerington, Magnus Stenbeck, Maja Šutalo, Marta Tomasi, Peggy Valcke, and Ruth Vella Falzon**

O. Tzortzatou (\*)

Biomedical Research Foundation of the Academy of Athens, Athens, Greece e-mail<EMAIL_ADDRESS>
S. Slokenberga Faculty of Law, Uppsala University, Uppsala, Sweden e-mail<EMAIL_ADDRESS>
J. Reichel Stockholm University, Faculty of Law, Stockholm, Sweden e-mail<EMAIL_ADDRESS>
A. da Costa Andrade · C. Barbosa University of Coimbra, Law Faculty, Biomedical Law Institute, Coimbra Area, Portugal e-mail<EMAIL_ADDRESS>
S. Bekaert

Department of Public Health and Primary Health Care, Faculty of Medicine and Health Sciences, Ghent University, Ghent, Belgium e-mail<EMAIL_ADDRESS>
E.-B. van Veen MLC Foundation, Hague, Netherlands e-mail<EMAIL_ADDRESS>
C. M. Romeo-Casabona University of the Basque Country Faculty of Law, R.G. Chair in Law and the Human Genome, Bilbao, Spain

K. Ó. Cathaoir · M. Hartlev University of Copenhagen, Faculty of Law, Copenhagen, Denmark e-mail<EMAIL_ADDRESS><EMAIL_ADDRESS>G. Chassang Université Paul Sabatier Toulouse 3, Toulouse, France Infrastructure Nationale Biobanques, Institute for Public Health, Clinical Research Department, Paris, France Plateforme "Ethique et Biosciences", Genotoul Societal, Toulouse, France e-mail<EMAIL_ADDRESS>A. Debucquoy BBMRI.be, Belgian Cancer Registry, Brussels, Belgium e-mail<EMAIL_ADDRESS>J.-J. Derèze UZ Leuven, Leuven, Belgium e-mail<EMAIL_ADDRESS>L. Dollé Université Libre de Bruxelles, Department of Pathology, Brussels, Belgium e-mail<EMAIL_ADDRESS>S. E. Fält Regional Biobank Centre in Uppsala Örebro healthcare region, Uppsala, Sweden e-mail<EMAIL_ADDRESS>R. Halouzka Masaryk Memorial Cancer Institute, Brno, Czech Republic e-mail<EMAIL_ADDRESS>M. Hisbergues Infrastructure Nationale Biobanques, Institute for Public Health, Clinical Research Department, Paris, France

e-mail<EMAIL_ADDRESS>
N. Hoppe CELLS - Centre for Ethics and Law in the Life Sciences, University of Hannover, Hannover, Germany e-mail<EMAIL_ADDRESS>
I. Huys Clinical Pharmacology and Pharmacotherapy, Department of Pharmaceutical and Pharmacological Sciences, KU Leuven, Leuven, Belgium e-mail<EMAIL_ADDRESS>
E. Kindt · P. Valcke Centre for IT and IP Law (CiTiP), KU Leuven, Leuven, Belgium e-mail<EMAIL_ADDRESS><EMAIL_ADDRESS>
A. K. Befring Law Faculty, University of Oslo, Oslo, Norway e-mail<EMAIL_ADDRESS>
L. Kozera BBMRI-ERIC, Graz, Austria e-mail<EMAIL_ADDRESS>D. Krekora-Zajac Univeristy of Warsaw, Institute of Civil Law, Warsaw, Poland e-mail<EMAIL_ADDRESS>
T. Lalova Department of Pharmaceutical and Pharmacological Sciences, KU Leuven, Leuven, Belgium

Centre for IT and IP Law (CiTiP), KU Leuven, Leuven, Belgium e-mail<EMAIL_ADDRESS>
M. Mayrhofer BBMRI-ERIC, Graz, Austria e-mail<EMAIL_ADDRESS>
A. Negrouk International Policy Offce, European Organisation for Research and Treatment of Cancer, Brussels, Belgium e-mail<EMAIL_ADDRESS>
J. Pawlikowski Department of Ethics and Medical Law, Chair of Social Medicine, Lublin, Poland e-mail<EMAIL_ADDRESS>
S. Penasa · M. Tomasi University of Trento, Trento, Italy e-mail<EMAIL_ADDRESS><EMAIL_ADDRESS>
K. Pormeister University of Tartu, Law Faculty, Tartu, Estonia

E. Rial-Sebbag Infrastructure Nationale Biobanques, Institute for Public Health, Clinical Research Department, Paris, France

Plateforme "Ethique et Biosciences", Toulouse, France e-mail<EMAIL_ADDRESS>
A. Siapka Centre for IT & IP Law, Faculty of Law, KU Leuven, Leuven, Belgium e-mail<EMAIL_ADDRESS>
T. Southerington University of Turku, Hospital District of Southwest Finland, Finnish Biobank Cooperative – FINBB, Turku, Finland e-mail<EMAIL_ADDRESS>
M. Stenbeck Karolinska Institutet, Department of Clinical Neuroscience, Division of Insurance Medicine, Stockholm, Sweden e-mail<EMAIL_ADDRESS>
M. Šutalo Law Offce Maja Šutalo, Zagreb, Republic of Croatia e-mail<EMAIL_ADDRESS>
R. Vella Falzon University of Malta, Valetta, Malta e-mail<EMAIL_ADDRESS>**Abstract** This chapter seeks to provide insight into the ways in which Member States leveraged the regulatory discretion afforded to them by the GDPR. Specifcally, it reviews the biobank regulatory environment; whether and how derogations under Article 89(2) GDPR are enabled; the legal basis for scientifc research and the role of consent in biobanking post-GDPR; the balance between individual rights and public interest in national law; and fnally, the GDPR's impact and future possibilities for biobanking. In exercising self-determination, Member States can, to a certain extent, align data protection requirements with their values and aspirations. Such alignment, though, could jeopardize collaborative research. In light of the need to bridge divergent legal and ethical requirements at a national and supranational level, the role of Research Ethics Committees (RECs) might prove to be essential.

### **1 Introduction**

### *1.1 Background*

The GDPR has had considerable impact on biobanking. Despite foreseeing rather stringent measures to ensure that personal data are adequately protected and placing strict obligations on controllers, the GDPR has relaxed the regulation of research in two important ways. First, through lawfulness requirements for data processing, including the conditions set forth in Article 9(2) GDPR for lifting the prohibition of health and genetic data processing. Second, through derogations from certain individual rights under Article 89 GDPR. These requirements, possibilities and further regulatory opportunities offered by the GDPR co-exist with and relate to national regulatory frameworks on biobanking.

Even though the GDPR is a regulation and, therefore, establishes a uniform framework across national legal orders, Member States' ability to maintain existing or even introduce new national exceptions allows the preservation of the fragmented landscape of biobanking law in Europe. The GDPR offers several lawfulness avenues in the form of legal grounds for data processing that lift the general prohibition of genetic and health data processing. Particularly important among these are broad consent - a possibility offered by Article 6(1)(a) in conjunction with Articles 9(2)(a) and 7 and as guided by Recital 33. The application of these provisions does not, in principle, require further implementing measures by the Member States. Furthermore, Article 9(2)(j) GDPR grants the possibility to adopt either national law or EU law that permits processing of health and genetic data for research purposes without the data subject's consent, provided that such processing is proportional to the aim pursued, respects the essence of the right to data protection and is accompanied by suitable and specifc measures to safeguard the data subject's fundamental rights and interests.1 Therefore, should there be a law in place providing

1Article 9(2)(j) GDPR.

these guarantees, even broad consent to the processing of health and genetic data for research purposes might not be necessary.

The derogations from individual rights under the research regime set forth in the GDPR have two limbs: one that relies on the direct applicability of GDPR and does not require further implementation measures, but requires compliance with Article 89(1) GDPR; and another that provides EU/EEA Member States with the possibility to derogate from four rights foreseen in the GDPR on the condition that a national law is in place and that the requirements of Article 89(1) GDPR are met (notably, adequate safeguards are in place) and in so far as such rights are likely to render impossible or seriously impair the achievement of the specifc purposes, and such derogations are necessary for the fulflment of those purposes. These rights are enshrined in Articles 15, 16, 18 and 21 GDPR. Additionally, the GDPR enables further regulatory opportunities for research falling within the domain of public interest.

The opportunities that the GDPR has created for research raise questions on whether they have been operationalized nationally and what implications they create for collaborative research between EU/EEA Member States. This chapter seeks to provide insight into the fragmented landscape and the research-related implications of GDPR implementation across Member States. It is not an exhaustive comparison of GDPR implementation across these countries. Rather, it reviews the legal basis for data processing, with a particular emphasis on consent, and examines the national application of Article 89(2) GDPR, specifcally, whether derogations from Articles 15, 16, 18 and 21 GDPR are enabled and what safeguards are in place. Additionally, it considers what, if any, consideration for balancing individual rights and public interest has been advanced nationally. Thereafter, it considers implications for scientifc research in the area of biobanking.

### *1.2 Method and Limitations*

To provide a pan-European overview of the GDPR's impact on the biobanking regulatory framework, experts in health law and/or data protection law, commonly with experience in the area of genetic and genomic research and biobanking, were invited to contribute their insights with respect to the following issues:

Additionally, BBMRI-ERIC2 prepared and circulated a research-facilitator tool in the form of a screening table, based on which national laws were screened for

2More information on BBMRI-ERIC infrastructure can be found at http://www.bbmri-eric.eu/.

further details related to the operationalization of the GDPR in the national context. The experts who participated in the study represented nineteen EU/EEA countries: Belgium, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Ireland, Italy, Latvia, Liechtenstein, Malta, the Netherlands, Norway, Poland, Portugal and Spain. Each collaborator's answers along with the BBMRI-ERIC hosted table constituted a national report, and all data were analyzed, summarized and grouped into categories based on similarities or signifcant differences. The authors of these national studies have subsequently verifed the accuracy of this work. All collaborators are co-authors of this study.

### **2 Biobank Regulatory Environment Across Europe**

In the absence of a supranational actor with competence and authority to regulate biobanking and set uniform, comprehensive and binding requirements within and across borders, it falls on the national legal orders to regulate biobanking with due regard to their external commitments.3 To identify the approach that national legal orders have taken with respect to regulating biobanks, the hereinafter analysis reviews national regulatory frameworks and governance approaches.

There are countries that have opted for a sector-specifc legislation for biobanking research. Among these are Spain, where the Act on Biomedical Research4 has devoted specifc chapters to biobanks; Portugal, where the Biobank Act for Research Purposes has been in place since 2005;5 and Latvia, where the Human Genome Research Law was adopted in 2002 and came into effect in 2004. Parallel to biobanking regulations, in all countries participating in the present study, national and European laws on privacy and personal data protection, namely Convention 108 and the GDPR, apply collectively. This is certainly the case for Belgium. With a network of biobanks that are linked to public institutions such as hospitals, universities and research centers, it has a number of European and Belgian provisions which regulate biobanking activities. Most notably, there is the Belgian Act on the Procurement and Use of Human Body Material (Act on HBM)6 and the Royal Decree of 2018,7

3Slokenberga et al. (2017).

4Ley de Investigación Biomédica, LIB, 14/2007, de 3 de julio 2007.

5Article 19/1 of Law 12/2005 defnes biobanks as 'any repository of biological samples or their derivatives, with or without limited storage life, whether using prospective harvesting or previously harvested material, or being obtained as part of routine health care, whether in screening programs, or for research purposes, which must include personally identifed, identifable, anonymized or anonymous samples'.

6Act of 19 December 2008 regarding the procurement and use of human bodily material destined for human medical applications or for scientifc research applies.

7Royal Decree of 9 January 2018 on biobanks, in implementation of Article 22 of the Act of December 2008.

which provides the legal basis for the entry into force of the provisions on biobanks contained in the Act on HBM and further specifes their application.

However, even where a biobank Act is in place, other laws apply concurrently. For example, Finland's regulatory framework for obtaining and using tissue and data from biobanks and other such repositories for research comprises mainly the Biobank Act, the Data Protection Act,8 the Act on the Secondary Use of Social and Health Care Data,9 and the Act on the Medical Use of Human Organs, Tissues and Cells10. Of particular interest is Estonia, where the national Biobank EBB11 is regulated by a sector-specifc Act, as opposed to other tissue collections and biobanks in the country which are regulated by a combination of provisions on biomedical research.12 Sweden has two specifc Acts on research databases, the Act on Certain Registers for Research on what Inheritance and the Environment Mean for Human Health and the Act on Forensic Psychiatry Research Register, which both apply to biobanks.

Other countries, such as France, Germany, Denmark, Greece,13 Croatia,14 Czech Republic, Ireland,15 Liechtenstein, the Netherlands and Poland,16 regulate biobanks through a combination of national provisions on biomedical research and data protection, without a lex specialis on biobanks. In the absence of a specifc biobank Act, ethical, technical and scientifc guidelines supplement the regulation of biobanks.17

Italy's approach could be characterized as an 'hybrid model', since the national Data Protection Authority (DPA) issued in 2016 two specifc Authorizations concerning the processing of genetic data and the processing of personal data for

8Code 1050/2018. www.fnlex.f/f/laki/alkup/2018/20181050.

9Code 552/2019. www.fnlex.f/f/laki/alkup/2019/20190552.

10Code 191/2001 www.fnlex.f/f/laki/kaannokset/2001/en20010101\_20130277.pdf.

11Order no 177 of the Government of the Republic of Estonia, Sihtasutuse Eesti Geenivaramu Asutamine, adopted 13 March 2001.—RTL 2001, 37, 512.

12Human Genes Research Act (HGRA), RT I 2000, 104, 685. Offcial English translation. https:// www.riigiteataja.ee/en/eli/518062014005/consolide.

13Tzortzatou (2015).

14See the Law on Protection of Patients' Rights (offcial gazette 169/04, 37/08), Law on Implementation of General Regulation on Data Protection (offcial gazette 42/18), Ethical Codex of the Institute for Medical Research and Occupational Health.

15See the Section 5(1), Data Protection Act 2018 (Section 36(2)) and Health Research Regulations 2018 (S.I. No. 314 of 2018).

16E.g. in the case of Poland, the Polish biobanks guidelines of good practices or standards of conduct are based on international, European and other regulations and recommendations created by international organizations (such as BBMRI-ERIC and ISBER). For more information on Biobanking in Poland, see also, Witoń et al. (2017).

17See for example in the case of France the Good clinical practices in clinical trials on medicinal products for human use Décision du 24 novembre 2006 fxant les règles de bonnes pratiques cliniques pour les recherches biomédicales portant sur des médicaments à usage humain, JORF 30 novembre 2006, texte n°64.

scientifc research, which include specifc provisions for biobanking research.18 The Malta BioBank has two main arms, the Clinical Bank and the Population Bank.19 Apart from the GDPR, which has been transposed into Maltese law by means of the Data Protection Act, no specifc law regulates research, except for the Clinical Trial Regulation and laws regulating higher education and health. The biobank's governance is regulated by the Statute for the Centre for Molecular Medicine and Biobanking.

Finally, Biobank Norway is a national infrastructure of biobanks which includes consented population-based and disease-specifc clinical biobanks, and offers access to unparalleled longitudinal health data in health registers.20 Biobanks and personal data are regulated in different laws. The Personal Data Act regulates the processing of personal data when these relate to specifc biological material, while public biobanks are regulated by the Treatment Biobank Act and the Health Research Act.

As seen above, the approaches taken to biobanking regulation vary across Europe, with most countries choosing not to introduce a sector-specifc piece of law into their domestic legal order. However, where countries have opted for such specifc instruments, these do not suffciently address all the issues arising from biobanking research, especially those related to the processing of participants' personal data. Hence, national law still needs to be applied in conjunction with the GDPR and other sources of European/international law.

### **3 Legal Basis for Biobanking. The Place and Role of Consent as One of the Legal Bases for Data Processing in Biobanking: Informed, Broad or None?**

Participants' written and informed consent has undeniably been the most common legal basis upon which the processing of health and genetic data for biomedical research on humans has been legally justifed. However, the scope of consent differs substantially across the countries included in the current study, which obstructs the transfer of data across borders within the framework of collaborative projects. The informed consent procedure has been heavily criticized as the route least likely to enhance research participants' autonomy in biobanking, given the large amount of samples and data that need to be stored and processed for long periods of time and, most importantly, for research purposes unknown at the time of their collection. In contrast to the informed consent model, which originates in clinical practice and has a longstanding tradition in the feld of medical law that aims to protect

18The contents of the two Authorisations that were deemed compatible with the GDPR were, more recently, collected in Document No 146 of 2019, concerning the processing of special categories of data.

19More information can be found at the Biobank's website https://www.um.edu.mt/biobank.

20See more information can be found at the Biobank's website at https://www.ntnu.edu/ biobanknorway.

individuals from research interventions, the broad consent model is arguably best suited to biobanking research.21

The critical question regarding consent is how countries chose to delineate its scope. Recital 33 is the only place in the GDPR where broad consent is implied, stating that 'data subjects should be allowed to give their consent to certain areas of research'.22 Still, nowhere in the regulation is broad consent explicitly established. It is, therefore, of particular comparative interest how Member States used their granted discretion to introduce further conditions for health and genetic data processing (Article 9(4) GDPR), and, more specifcally, what approach they adopted in regards to the scope of consent. Nonetheless, as noted in the introduction of this chapter, it is not precluded that broad consent could be directly applied by invoking the provisions of the national law, unless a Member State, following the discretion left under Article 9(2)(a) or 9(4) GDPR, precludes the use of consent as a means to lift the prohibition of health and genetic data processing.

Belgium established the controller's obligation to inform data subjects about the anonymization of their personal information and the reasons for which the exercise of their rights would render the achievement of the objectives impossible or seriously impede them from the time of the data collection. Prior to the data collection, according to the Belgian Privacy Act and without prejudice to the GDPR provisions on the controller's responsibilities, including those on record keeping, the controller shall add specifc elements to the registration of processing activities for purposes of scientifc research. As stated in the law, these requirements consist in the justifcation of the use of the data, which may or may not be pseudonymized; the reasons why the exercise of the data subject's rights threatens to render the achievement of the objectives impossible or seriously impedes them; and, if applicable, the data protection impact assessment, when the data controller processes special categories of data for the purposes of scientifc or historical research or statistical purposes.

The Irish legislation normally requires data subjects' explicit consent to the processing of special categories of data for research. The Health Research Regulations (2018) defne consent broadly as for the purpose of specifed health research, either in relation to a particular area or more generally in that area or a related area of health research, or part thereof. Specifc measures must be taken to safeguard personal data, including: limitations on access; strict time limits for the erasure of personal data and mechanisms to ensure this; targeted training; logging mechanisms; designation of a data protection offcer (where not mandatory) and, where processing health-related data, a requirement that the processing is undertaken by a health practitioner or a person bound by an equivalent duty of confdentiality; pseudonymization and encryption. The Health Research Regulations list further measures, such as appropriate governance structures. Researchers can apply for an exemption

21Dynamic consent, have also been proposed as the suitable way for individuals to consent to their data process, when it comes to biobanking research activities, see also Steinsbekk et al. (2013).

22More information on broad consent can be found at: https://www.nature.com/articles/ ejhg2012282, https://journals.plos.org/plosmedicine/article?id=10.1371/journal.pmed.0050192, https://www.sciencedirect.com/science/article/pii/S1470204506706180, https://www.nature.com/ articles/ejhg2012282, https://journals.sagepub.com/doi/pdf/10.1177/096853320901000201.

when they are 'of the view that the public interest in carrying out the research signifcantly outweighs the public interest in requiring the explicit consent'.

Croatia leaves no room for broad consent to medical research. The Croatian Law on Patients Protection states that consent to medical research has to contain detailed explanations of involved procedures and risks.23 In the Czech Republic, the legislator laid down no further specifc conditions for consent to medical research, adopting the informed consent approach elaborated in the GDPR. In the case of Latvia, the Human Genome Research Law requires specifc consent.24 Furthermore, this consent shall be documented on a form approved by the Cabinet.25 These rules have not been amended since the GDPR entered into force. Nonetheless, work on a new law regulating biobank research has commenced and could lead to a different approach to consent. In Spain, the data subject's consent is required. However, the reuse of personal data for health and biomedical research shall be considered lawful if consent was obtained for the frst use. Furthermore, scientifc studies may be carried out without the consent of those concerned for public health reasons and in situations of exceptional relevance and seriousness to public health. Interestingly, in France, the law functions on the basis of opt-out consent (non-opposition), although opt-in consent can be required under special laws. Consent to several purposes is accepted, where these are clearly, intelligibly and explicitly presented to the individuals, who can opt for or refuse each one.26

In Portugal, consent may cover several areas of research. This is an improvement compared to the specifc consent previously required. However, consent can only be waived in exceptional cases, where samples are used retrospectively, or when the consent of the persons concerned cannot be obtained due to the number of data or individuals, their age or other comparable reasons. In these cases, data and biospecimens can only be processed for scientifc research purposes or for the collection of epidemiological or statistical data.

Along the same lines, but with an even broader scope, the Finnish Biobank Act allows research participants to give their informed consent to the storage and use of samples (to be) taken from them, to the purpose of biobank research, to the transfer of their personal information (to researchers) and to linking personal data from

23Law on Protection of Patients' Rights (offcial gazette 169/04, 37/08)—Article 19.

24Section 10(1) states 'Before a person participates in the genetic research, a doctor shall issue to the person written information regarding: 1) the purpose, content and duration of the genome research project; 2) potential risks; 3) the right to freely express his or her consent and to revoke it at any time; and 4) a possibility to perform genetic research outside of Latvia'. Human Genome Research Law, Latvijas Vēstnesis, 99 (2674), 03.07.2002.

25Cabinet (of Ministers) holds the executive power. Provisions on the specimen of the gene donor consent form and the procedure for its completion and storage Provisions on the specimen of the gene donor consent form and the procedure for its completion and storage. Latvijas Vēstnesis, 128 (3076), 13.08.2004.

26See also the referentials adopted by the CNIL (Méthodologies de Référence, MR) specifying data protection rules in research contexts and specifcally MR001 (regarding health research requiring prior informed consent), MR003 (regarding health research that does not require consent) and MR004 (regarding research that do not involve human persons, studies and evaluations in health).

other sources and other processing of samples and information obtained with the samples to the extent required by biobank research. Furthermore, the Biobank Act does not require a new consent to the use of biospecimens and associated data by each research project. The Biobank Act is being reviewed, however, and it is expected that the legal bases for processing by the biobank will be Articles 6(1)(e) and 9(2)(g) instead of consent (draft government bill for a new Biobank Act, May 2018), while the Data Protection Act already provides that, under certain conditions, processing personal data for scientifc research is lawful based on 6(1)(e) and that the restrictions of Article 9(1) will not apply.

In Italy, data subjects' consent to the processing of health data for scientifc research is not necessary when the research is carried out on the basis of (national or EU) law, in line with Article 9(2)(j) GDPR, including when the research is part of a biomedical or health research program, provided that an impact assessment pursuant to Articles 35-36 GDPR is conducted and published. Furthermore, consent is not necessary when, due to specifc reasons, informing the interested parties is impossible or involves disproportionate effort, or risks making it impossible or seriously impairing the achievement of the aims of the research. In such cases, the data controller shall take appropriate measures to protect the rights, freedoms and legitimate interests of the interested party, and the research program should receive the favorable opinion of the competent Research Ethics Committee (REC) at a territorial level which must be submitted for preventive consultation to the Garante.

In a similar vein, Germany allows biomedical research to be conducted after data subject's informed consent, which is freely given and easily withdrawn, has been provided. However, public interest, instead of consent, may be used as the legal basis for processing special categories of personal data in the context of scientifc research, if appropriate safeguards for the legally protected interests of data subjects are implemented. Such safeguards may consist of anonymizing personal data as quickly as possible, taking measures to prevent unauthorized disclosure to third parties, or processing them in an organizationally and spatially separate manner from other tasks.

In implementing GDPR, Sweden has not introduced any specifc rule providing a legal basis for processing personal data in research. Existing rules on research conducted by public and private entities have been deemed suffcient. In particular, Sweden has two specifc Acts on research databases providing the legal basis for researchers to access data without further consent, under certain conditions and after ethical approval, namely the Act on Certain Registers for Research on what Inheritance and the Environment Mean for Human Health and the Act on Forensic Psychiatry Research Register. Both have been adapted to the GDPR requirements. When processing is not based on informed consent, there will be a different legal basis for research conducted by public research entities (public interest as legal basis) and private ones (commonly, legitimate interest as legal basis). The Netherlands has taken further steps by adopting an opt-out approach when the personal data come from a health care provider, as the patient should not have objected to such use for research. When seeking consent is impossible and the research serves a public interest which cannot be fulflled without these data, then research is permitted as long as appropriate guarantees are in place. Concerning Denmark's Data Protection Act,27 it includes a provision on the processing of personal data for scientifc and statistical purposes without the data subject's consent. Consequently, the Act makes use of the options provided by Article 9(2)(j) and Article 89 GDPR. It is a precondition that the research project is of signifcant societal interest, and safeguards are outlined in the Act.

Similarly, Norway's Personal Data Act dictates that special categories of personal data can be processed without data subject's consent if it is necessary for archiving purposes in the public interest, scientifc or historical research purposes or statistical purposes.28 This requires that the beneft to society as a whole clearly exceeds the disadvantages experienced by the subject whose personal data is processed without consent. Furthermore, processing must be subject to appropriate safeguards in accordance with Article 89(1) GDPR. It is required that the controller confers with the data protection offcer to make sure that such safeguards are in place. Norway also predicts that in the future, and under certain conditions, broadbased consent will be adopted for research on human biological material and personal health data.29 When using biological material and health-related personal data, the broad consent must defne the research purposes, and new consent may in specifc cases be requested by the competent REC if the conditions for use of broad consent need to be specifed.

The Estonian Data Protection Act takes quite a liberal approach to the research use of personal data beyond informed consent. Processing personal data in research without consent is permissible in line with GDPR requirements as long as the data are pseudonymized or any other equally effective method is followed, but (upon certain conditions) also when the data enables identifcation of the individual.30 Likewise, Liechtenstein and Greece allow the processing of special categories of data for the abovementioned purposes without consent if such processing is necessary for those purposes and the processor's interests outweigh those of the person concerned, given that specifc measures are in place. Greek law, specifcally refers to data pseudonymisation and encryption, DPO designation and data access restriction on behalf of the data processor and/or controller, as such measures.

Similarly, the Maltese Data Protection Act implementing the GDPR provides a derogation for scientifc or historical research purposes provided that adherence to the GDPR provisions would be likely to render impossible or seriously impair the achievement of those purposes and the data controller reasonably believes that such derogations are necessary for the fulfllment of those purposes. In these cases,

27Act no. 502 of 23 May 2018 on supplementary provisions to the regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

28See PDA sections 8 and 9.

29See the chapter of Norway.

30However, it is worth noting that in the case of the Estonian Biobank (EBB), exceptionally broad consent remains as it was prior to the GDPR the legal basis for the use of data for research, something that can be regarded as an exercise of the discretion referred to in Recital 33 GDPR. See further Kärt Pormeister (2018).

processing for scientifc or historical research shall be subject to appropriate safeguards for the data subject's rights and freedoms, including pseudonymization and other technical and organizational measures in order to ensure respect for the principle of data minimization. The conditions imposed for processing in the feld of public health have been made applicable to processing genetic data and biometric data. Hence, the controller must consult with and obtain prior authorization from the Commissioner. The Commissioner in turn must consult with a REC.

As a review of the national approaches demonstrates, different possibilities for lifting the prohibition of Article 9 GDPR to process health and genetic data have been operationalized in the national legal orders. Often, several possibilities coexist, in particular, a consent-based approach with a public interest-based approach or similarly regulated approach, following which the consent requirement may be misapplied or derogated from. When these derogations apply, in some countries a legal requirement to consult RECs emerges.

### **4 Derogations from Individual Rights Under Article 89(2) Subject to Article 89(1)**

### *4.1 Enabling Derogations*

Article 89(2) GDPR enables Member States to lay down derogations from data subjects' rights to access, rectifcation, restriction of processing and objection when personal data are processed for scientifc purposes. Such discretion is subject to safeguards as set out in Article 89(1), but its boundaries are not clearly defned by the Regulation. At the same time, the non-binding Recital 156 highlights that Member States also retain the ability to provide specifcations and derogations from the rights to erasure and data portability. Moreover, Recital 41 indicates that 'where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to requirements pursuant to the constitutional order of the Member State concerned' provided it is clear, precise and foreseeable. Hence, what follows examines whether and how Member States did actually make use of this margin of maneuver and establish specifc exceptions to the rights found in Articles 15, 16, 18 and 21 GDPR.

To begin with, it can be noted that seven of the countries participating in the study, specifcally, Croatia, Germany, Greece, Malta, the Netherlands, Portugal and Sweden refrained from prescribing further derogations in their GDPR adapting legislation. The Dutch implementing Act did not embed the right to object (Article 21 GDPR) as a research exemption. According to the same Act, research institutions acting as data controllers are allowed not to give effect to Articles 15 (access), 16 (rectifcation) and 17 (erasure) GDPR.31 Germany and Greece are slightly more

31See article 44 of the Dutch implementing Act.

specifc when it comes to overriding the right to access for research purposes by adding that in such cases the provision of information should involve disproportionate effort. Finland lists specifc safeguards that are required for the derogations to apply (appropriate research plan, designated responsibilities, confdentiality32), including additional safeguards in case of special category personal data (DPIA provided to national supervisory authorities or compliance with an appropriate and approved code of conduct). It also enacted derogations from the controller's obligations to provide information to the data subject under Article 13 and Article 14.

The Italian Legislative Decree 101/2018 mentions, in particular, derogations from the right to rectifcation, noting that in exercising data subjects' rights pursuant to Article 16 GDPR the rectifcation and integration of data are noted without modifying the latter when the result of these operations does not produce signifcant effects on the result of the research. In Liechtenstein, under certain conditions, limitations are also possible with regard to the right to data portability of Article 20 GDPR.

Latvia adopted the Personal Data Processing Law that enables a general derogation when research is carried out in the public interest. It states that 'if data are processed for scientifc or historical research purposes in the public interest, the rights of a data subject specifed in Articles 15, 16, 18, and 21 of the Data Regulation shall not be applied, insofar as they may render impossible or seriously impair achievement of the specifc purposes, and derogations are necessary for the achievement of such purposes'.33 This derogation is not aligned with the key law regulating human genome research, and consequently, until a new Act is adopted and the current one repealed, or until the current law is amended, these derogations might have limited effect. A similar approach was adopted by Denmark. The Danish Data Protection Act specifcally states that Articles 15, 16, 18 and 21 GDPR do not apply to data processed for scientifc or statistical purposes.

In the Czech Republic, the Act on Personal Data Processing allows for derogations from data subject rights when personal data are being processed for scientifc research pursuant to Article 89(2) GDPR. Specifcally, it states that the data subject's rights to access, rectifcation, restriction of processing and objection to processing apply adequately or can even be postponed if this is necessary and proportional to the fulfllment of the purpose of processing. It also states that the right to access shall not apply if processing is necessary for scientifc research and the provision of such information would involve disproportionate effort. However, several national legislators merged derogations from data subjects' rights for research purposes with those for reasons of public interest, or focused only on the latter. Portugal posits the anonymization of data as an additional condition under which derogations for the sake of public interest or research purposes are allowed. The legislation to be proposed in Portugal states that in processing data for purposes

32Biobank Act Section 16 specifcally requires that the biobank samples and data must be pseudonymised by a code replacing direct identifers, and the code key must be stored separately.

33Personal Data Processing Law, Latvijas Vēstnesis, 132 (6218), 04.07.2018.

of archiving in the public interest, scientifc or historical research or offcial statistical purposes, the rights of access, rectifcation, restriction of processing and opposition are superseded when their exercise is impossible, namely when the data collected are anonymized, or liable to seriously hinder the attainment of the aforementioned objectives.34

In addition to acknowledging the possibility of derogations for research purposes, Italy and Malta regulate further obligations of data controllers and rights of data subjects when such derogations occur.

More specifcally, Italy provides that ethical rules, to be approved by the Italian Personal Data Protection Authority, may indicate the cases in which the rights listed in Articles 15, 16, 18 and 21 of the GDPR can be limited, pursuant to Article 89(2) of the same Regulation. The Maltese Data Protection Act provides that processing for scientifc or historical research purposes, shall be subject to appropriate safeguards for data subjects' rights and freedoms, including pseudonymization and other technical and organizational measures, to ensure respect for the principle of data minimization. When such purposes can be fulflled by processing, which does not permit, or no longer permits, the identifcation of data subjects, those purposes shall be fulflled in that manner. Furthermore, controllers must consult with and obtain prior authorization from the Commissioner when they intend to process genetic data, biometric data or data concerning health for statistical or research purposes in the public interest. The Commissioner must, in turn, consult with a REC.

Of comparative interest is also the way in which national laws treat derogations from the right to object. Norway dictates exceptions from the right to access to information, the right to rectifcation and the right to restriction of processing, but the national legislator argues that there is no need for further exceptions. As a result, there is no exception or extension of the scope of derogations with regard to the right to object. Equally, the Dutch GDPR Implementation Act did not embed the right to object as a research exemption, although research institutions are allowed not to give effect to Articles 15, 16 and 17 GDPR.

In Italy, derogations from the right to object are permitted when processing is necessary in the public interest. Contrary to the countries examined above, this is the only right for which research and public interest merge in the Italian law. Malta takes a different approach regarding the right to object, which may be overridden when personal data are processed for purposes of academic expression. However, neither the Maltese Data Protection Act35 nor the GDPR offer any guidance on what is considered 'academic expression', making it unclear whether scientifc and health research would fall under this provision. In the UK, where controllers reasonably require further information and have informed the data subject of that requirement, they are not obliged to comply with the data subject's notice not to process their data unless this further information has been provided. Finally, both in Ireland and Greece when processing data for scientifc research purposes, the rights

34Legislation to be proposed.

35Chapter 586 of the Laws of Malta.

of the data subject under Articles 15, 16, 18 and 21 GDPR are restricted to the extent that is necessary and the exercise of the rights would be likely to render impossible, or seriously impair, the achievement of the research.

Overall, the Member States are split between enabling and not enabling derogations from individual rights under Article 89(2) GDPR and the extent to which these derogations are enabled. The fragmentation of the regulatory landscape might have further implications for collaboration, and could open up the possibility of forum shopping. How Member States address this issue will be reviewed in the concluding analysis of this chapter.

### *4.2 Insights in Appropriate Safeguards*

Derogations from the rights indicated in Article 89(2) GDPR, namely Articles 15, 16, 18 and 21 GDPR, not only require the existence of a national law, but are also subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specifc purposes, and such derogations are necessary for the fulflment of those purposes. Therefore, it is clear that derogations are possible. What is less clear is whether the relevance of appropriate safeguards and case-by-case assessment likewise needs to be established by law, or whether direct applicability and effect of the GDPR provisions will suffce. The formulation of the provision in Article 89(2) GDPR is rather ambiguous, but could be argued to be related to national law. Therefore, this section reviews how the requirement for safeguards is approached nationally.

Article 89(1) GDPR generally refers to 'safeguards and technical measures' that need to be in place to assure lawful processing of the special categories of personal data, and indicates that '[t]hose measures may include pseudonymization (…)'. Pseudonymization in Article 4(5) GDPR is defned as the 'processing of personal data in such a manner that the personal data can no longer be attributed to a specifc data subject without the use of additional information'. Such additional information should be kept separately and be subject to technical and organizational measures so that the personal data can not be attributed to an identifed or identifable natural person. This explicit introduction of pseudonymization aims at minimizing risks against data subjects and is especially considered an appropriate safeguard when processing is conducted for research purposes based on Article 89(1) GDPR. Yet, according to Recital 28 GDPR, data controllers are not prevented from applying other technical measures in order to comply with their data protection obligations. In fact, this requirement is rather to be approached as an obligation, given that data controllers are bound by the duty to ensure that subjects' personal data are adequately safeguarded, and this duty applies regardless of whether a Member State has regulated safeguards in any further way.

This study has showed the national legislators' preference for pseudonymization when it comes to choosing among other measures for enhancing privacy. It is worth mentioning that, until the GDPR entered into force, other terms were also used in practice across Europe, such as 'anonymized data', 'coded data', 'codifed data', 'linked data', 're-identifable data', 'masked data', 'de-identifable data', in order to describe what now falls under the general term 'pseudonymized data'. Consequently, the latter are for the frst time in a data ptotection piece of legislation distinguished from the 'anonymous data', meaning those unable to identify the subject.36

In terms of what constitutes pseudonymization, the majority of countries included in this study do not provide further defnitions of the term, which means that Article 4(5) GDPR applies as it stands. In particular, Croatia, Czech Republic, Finland, France, Greece, Norway, Portugal, Sweden, Latvia and Liechtenstein refrain from further specifying pseudonymization, whereas Germany, Ireland and Malta repeat the defnition offered by the GDPR. Interestingly, before the advent of the Regulation, Norway used to defne pseudonymous data as indirectly identifable ones, while now pseudonymization is considered to encompass all means of deidentifcation. In Finland, the Data Protection Ombudsman is unequivocal in classifying pseudonymized data as personal data universally. Concerning the French legislation, the implementation of pseudonymization is presumed in order to preserve confdentiality, although previous iterations of the law referred to it as coding. In Spain, both defnitions of data coded and of biological sample coded are provided by the Spanish Biomedical Research Law.37

Where most national laws present slight differentiations is the distinction between anonymization and pseudonymization as well as the relation between the two. Specifcally, the Belgian legislator grants priority to the use of anonymous data. Only if controllers cannot achieve their research purposes should they turn to pseudonymous data. If the research objective remains unattainable even with the usage of pseudonymized data, then data controllers are allowed to process nonpseudonymized ones. In choosing among different methods of pseudonymization and anonymization, data controllers beneft from the guidance of a data protection offcer, when such person has been designated, who advises with regard to the suitability of these methods for data protection.

In Portugal, no priority is attributed to either anonymization or pseudonymization. More specifcally, 'anonymization or pseudonymization' is selected when the target goals can be reached through either of these. This corresponds with the Portuguese empirical reality, given that, in practice, biomedical researchers and

36Nevertheless, the longstanding use of above terms such as 'anonymized data', has led to confusion many researchers who are now progressively starting to familiarize themselves with the 'pseudonymous' as opposed to 'anonymous' data. This can be clearly refected in the study protocols were most often researchers refer to 'anonymized codifed data' instead of the right term which is 'pseudonymized data'.

37The Spanish Biomedical Research Law of 2007 provided following terms: 'Data coded or reversibly dissociated: data not associated with an identifed or identifable person because the information has been replaced or unlinked identifes that person by using a code that allows for the inverse operation' (Article 3 (k)).

'Biological sample encoded or reversibly dissociated means a sample not associated with an identifed or identifable person as a result of the replacement or disassociation of that person information that identifes that person by using a code that allows reverse operation' (Article 3(r)).

scientists have been implementing coding techniques as a way to reconcile the protection of data subjects' privacy with the deduction of satisfactory research outputs. Interestingly, in regards to anonymization, the Greek law further states that the data controller must anonymize the data as soon as the scientifc purposes permit so, unless this is contrary to the legitimate interest of the data subject. In addition, it predicts that until anonymization takes place the features that can be used to correlate details of personal or actual situations of an identifed or identifable individual, must be stored separately. These features can be combined with individual details only if it is required by the research or statistical purposes. Furthermore, the Greek law also indicatively refers to the data controller's and/or data processor's data access restriction, the data encryption and the DPO designation, as additional safeguards when it comes to the processing of specifc categories of data for scientifc purposes. In regards to scientifc publications containing personal data, these can take place either after the data controller obtains the explicit written informed consent of the data subject or after the controller pseudonymizes the data, in case no consent is obtained, however, the publication is necessary for the presentation of the scientifc research results.

Italy demands that the Italian DPA provides for further conditions under which genetic, biometric and health-related data can be processed, namely encryption and pseudonymization techniques, minimization measures, specifc methods for selective access and any other measure necessary to safeguard the rights of those concerned.38 In all these cases, the Italian regulations interpret these terms based on the volume of data processed, the nature, object, context and purposes of the processing, and denote methods of rendering data not directly traceable to the concerned parties but identifable only when necessary.

In the Czech Republic, pursuant to the Act on Personal Data Processing, if it is consistent with the purpose of personal data processing (scientifc research), the personal data referred to in Article 9(1) GDPR should be processed in a form which does not allow the identifcation of the data subject. This does not apply when legitimate interests of data subjects prevent this.

In contrast, Norway clearly advances pseudonymization over anonymization. Norway used to defne pseudonymous data as 'indirectly identifable' ones, while now pseudonymization is considered to encompass all means of de-identifcation that meet certain requirements for whomever has access to the key. Provided that data subjects' identity is suffciently protected or pseudonyms are being applied, data controllers can proceed with processing data for health research. Requiring that all data used in research be anonymous is deemed unrealistic, as it would impede controlling and verifying research outcomes. Moving on to the Netherlands, it is still unclear how pseudonymization is perceived. Before the GDPR, the DPA issued

38The same formulation, i.e. encryption or pseudonymization techniques, was also adopted in the General Authorisation 9/2016 concerning the processing of personal data for scientifc research purposes and in the General Authorisation 8/2016 concerning genetic data treatment, and can now be found in the Document No. 146 of 2019, concerning the processing of special categories of data.

a decision mentioning that pseudonymization does not per se lead to anonymization, which has regrettably opened up space for diverse, inconclusive interpretations regarding the connection between pseudonymous and anonymous data.

The NHS Health Research Authority in the UK clarifed that personal data, which have been pseudonymized (e.g. key-coded), fall under the remit of the GDPR depending on how diffcult it is to attribute the pseudonym to a particular individual. This echoes the provisions of Recital 26 GDPR which posits that if pseudonymized data could be attributed to a natural person by the use of additional information, then they should be considered to be information on an identifable natural person. Furthermore, data that have been anonymized are excluded from the scope of GDPR, with the act of anonymization being viewed as data processing.

Finally, a few Member States examined pseudonymization in relation to thirdparty transfers. In Denmark, the Data Protection Authority is authorised to issue general rules on the transfer of data processed for research purposes to third parties, with pseudonymization being among the possible requirements in the preparatory works. At the same time, in France, pseudonymization is indicated as obligatory before transferring data to non-EU countries.39

Overall, even though Member States conformed in their incorporation of pseudonymization, this newly-suggested measure is still ambiguously phrased and examined in relation to other alternative technical measures, which raises questions about its suffciency in eliminating risks to data subjects' rights. Given that whether a set of data is considered anonymized or pseudonymized will determine the applicability of the GDPR provisions at each instance, it is vital that the defnitions, characteristics and legal status of these techniques are further illuminated. Regarding the states that have opted for enabling the derogations but have not further specifed them in their data protection legal frameworks, it is too early to conclude that these safeguards do not exist. They could be included in research-specifc regulations adopted at a later stage or interpreted in light of the pre-GDPR research regulations, for example, as rules on coding and decoding of the samples under the Human Genome Research Law in Latvia. Moreover, even if the national law does not refer to or specify applications of safeguards in any way, controllers are not released from their obligation to ensure compliance with the GDPR.

### **5 Public Interest**

Beneft sharing from research, return of the results, incidental fndings and intellectual property policies are means to ensure a balance between the protection of participants' interests, on the one hand, and the promotion of the public interest, on the other. Specifcally, when it comes to biobanking, public interest has long been debated as one of the suitable legal bases for processing special categories of

39See reference 11, and specifcally the CNIL Reference methodologies MR001 and MR003.

personal data as per Article 9(2)(j) GDPR and in opposition to consent.40 Furthermore, as elaborated by Slokenberga in the introductory chapter, classifying biobanking as public research enables further derogations from individual rights.41 It is crucial to see how national legislators chose to handle the abovementioned provision, which stands in close relation to Article 89(1) GDPR on technical and organizational measures and safeguards requirements.

Belgium, chose to impose two further obligations on the data controller when it comes to archiving personal data for scientifc research in order to ensure public interest, namely the justifcation of the public interest, of the stored archives and the reasons according to which the exercise of the rights of the person concerned threatens to render the achievement of the objectives impossible or seriously impedes them. In contrast, Italy avoided imposing further obligations on the controller. Instead, it enhanced the role of the DPA in setting the regulatory framework, as refected in the Annual Report of the DPA, where the interplay between scientifc research needs and individuals' rights protection is prominent. Similarly to Italy, Portugal's legislation to be proposed on the establishment of biobanks for scientifc research purposes sets specifc requirements for transparency in scientifc, healthrelated research. Public interest is safeguarded through the control of biobanks by the National Data Protection Commission and the Commission for Coordination of Research in Human Cells and Tissues, which will be created.

Finland's, new Biobank Act is expected to adopt substantial public interest as a legal basis for biobanking activities. Concerns have also been raised regarding the new Act on the Secondary Use of Social and Health Care Data when it comes to the public interest, and specifcally, the dissemination of research results. In particular, this Act introduces limitations to the publication of results, which interferes with the autonomy and freedom of science. In the case of Malta, society's participation in biobanking is paramount, as refected by the steps taken towards the creation of a portal that would allow participants to grant their digital consent. In this way, participants could track the use of their samples and associated data as well as access information and updates about the research projects in which their samples are involved. Research results would also be made available on the portal, thus turning research participants into research partners.

Since 2016, in France, 'public interest' has been seen as a synonym for 'general interest' and 'collective beneft', and has become important to the processing of personal data in health research. Data controllers claiming public interest research purposes should be able to justify this assertion. They can, then, process data through a simplifed route. However, public interest is only mentioned as an exception to the principle of storage limitation in research when it comes to archiving reasons. Furthermore, data controllers who are involved in archiving in the public

40See paragraph 3 'Consent as one of the legal basis for data processing in biobanking across EU Member States: informed, broad or none?'

41See Articles 18(2), 20(3) and 21(6) GDPR. See further Santa Slokenberga, Setting the foundations: Individual rights, public interest, scientifc research and biobanking.

interest can derogate from the rights of access, rectifcation, restriction of processing and to object.

Germany and Greece, following the letter of the GDPR, provided specifc rules, such as limitations on data subjects' rights or technical measures that safeguard special categories of personal data. The Danish Data Protection Act does not include a provision specifcally referring to public interest, but provides for processing of personal data for the purposes listed in Article 9(2)(h) and (g) GDPR, which seems to cover purposes outlined in GDPR Article 9(2)(i). Similarly, the Netherlands, which has many quality registries and a comprehensive cancer registry, has not implemented Article 9(2)(i) for biobanking purposes. Such registries, which are usually not based on informed consent, fnd a 'workaround', e.g. using a common data processor and/or relying on the implementation of Article 9(2)(j). The Estonian approach seems to be shifting the balance between individual rights and public interest strongly towards public interest since research is seen as a task carried out in the public interest.

Ireland allows processing special categories of data in the public interest to protect against serious cross-border threats, ensure high standards of quality and safety of health care and for archiving purposes. The obligations of controllers and rights of data subjects are restricted to the extent necessary and proportional to, inter alia, national security and enforcement of civil law claims. The relevant minister has the power to issue regulations further restricting data subjects' rights in the public interest. Spain introduced exceptions to the interest of parties, specifcally in a more extended consent approach than the GDPR, to the detriment of the widespread accessibility of data (and samples) by researchers, although it can be considered that they are still in agreement with the framework of the latter with the new Privacy Act.42 In Latvia, even though it is not defned what research falls in the area of public interest, when it does so, derogations from Articles 15, 16, 18, and 21 GDPR are possible.43

Finally, Croatia has no explicit defnition of medical scientifc research, and this has been one of the causes of discussion of the balance between the individuals' right and public interests.44 Specifcally, where the scientifc and experimental zone ends, the public interest begins where there is no such broad rights for the individuals. Such blurred boundaries might, in practice, cause challenges due to different interpretations of scientifc research and experimental medicine in the country.

The analysis above illustrates that the countries implemented Article 9(2)(j) GDPR in their legislations vis-a-vis their longstanding research tradition. In those

42Organic Act 3/2018 of 5 of December on Protection of Personal Data and guarantee of digital rights.

43Personal Data Processing Law, Latvijas Vēstnesis, 132 (6218), 04.07.2018, Section 31.

44The Ethical Codex of the Institute for Medical Research and Occupational Health (https://www. imi.hr/en/) explicitly states that the wellbeing of the examinees should prevail over the interests of science and society. Therefore, within the research studies conducted by the Institute, there is obvious misbalance between the individual rights and public interest for the beneft of the individual rights. There are also numerous public discussions and cases pending in front of the Court with respect to question whether the vaccination is related to the individual freedom or should be seen as an obligatory action in favor of the public interest.

countries where the public interest had already been synonymous to general interest and a solidarity-based approach to research was already cultivated, the relevant provision was adopted as a means to further promote the balance between the public interest and individuals' rights. However, even in cases where certain societies were already familiar with biobanking research, the national legislator did not further specify the requirements of Article 89(1), and instead chose to stick to the letter of GDPR.

### **6 Conclusion**

As the chapter shows, the approach to regulating biobanks differs signifcantly across EU and EEA Member States. Differences have emerged not only on whether and to what extent biobanking is regulated, but also on the requirements set forth by laws. These differences apply to key elements such as lawfulness requirements, in particular, the appropriate legal basis for biobanking as well as the legal basis for lifting the prohibition of health and genetic data processing. Through the approach that GDPR has taken, it has opened up room for the Member States to move away from the long-established model of informed consent in biobanking, at least regarding personal data processing. Whether this room will be widely used or if Member States will stick to the generic consent requirements under the GDPR remains to be seen. Similarly, it will be interesting to examine how this will be received by RECs. Additionally, the protection of data subjects' rights, and approaches for alternative measures to ensure high level of data protection when derogations are enabled. Finally, differences emerge in how Member States approach public interest and whether biobanking is subsumed into it. While it is often argued that biobanking research is in the public interest, not all Member States have explicitly or legally acknowledged this. Such research may beneft from the generally generous data protection regime enacted with the GDPR, but may not beneft from the additional measures concerning 'public interest' under the GDPR. Even though in principle these variations should not affect the free movement of personal data under the GDPR, in so far as RECs have the discretion to declare research as non-compliant with ethical principles and regulations, fragmentation will remain a challenge facing researchers in collaborative projects. This conclusion suggests the need for further research on the interaction of law and ethics nationally as well as under the GDPR. It also indicates the necessity for pan-European, sector-specifc, Codes of Conduct, as encouraged by GDPR. Towards this direction, relevant initiatives have been launched with the aim of enhancing data fows across EU/EEA countries for research purposes.45 Such initiatives, though, should be developed in coalition with

45See also the European Data Protection Supervisor, A Preliminary on data protection and scientifc research, 6 January 2020. The preliminary opinion, refers to two current initiatives. First, sector-specifc a Code of Conduct for Health Research is currently underway from BBMRI-ERIC. Second, a Code of Conduct from GEANT, the pan-European data network for the research and education community

comparable ones originating in the healthcare sector. Especially in the feld of biomedical research, where present and foreseeable technological progress enables extraction of valuable information from existing healthcare datasets, research and healthcare reveal themselves as the two sides of the same coin. Therefore, drafting sector-specifc Codes of Conduct, which will call attention to this interaction and will incorporate non-conficting data protection provisions, particularly in relation to data fows or exchanges, should be a priority for all multi-sector actors involved in the aforementioned initiatives.

**Acknowledgements** The author wishes to thank Anastasia Siapka for her support during all the stages of this Chapter.

### **References**

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# **Allocation of Regulatory Responsibilities: Who Will Balance Individual Rights, the Public Interest and Biobank Research Under the GDPR?**

### **Jane Reichel**

**Abstract** In this chapter, an analysis is undertaken of the division of legislative power in the space created by the GDPR, regarding the balancing of individual rights, the public interest and biobank research. The legislative competences of the EU, international obligations within bioethics, and the regulatory space left for Member States are all examined. The conclusion of the chapter is that in spite of the aim of the GDPR to further legal harmonisation, it is more likely that unity will be brought about through administrative cooperation and soft law tools.

### **1 Introduction: Balancing Individual Rights and Public Interest in Biobank Research Post-GDPR**

Balancing the individual right to data protection and the public interest in biobank research involves a number of constitutional and statutory rules within the EU. The individual right to data protection enjoys a strong constitutional protection within the EU legal order, being included both in Article 8 of the EU Charter of Fundamental Rights (Charter) and Article 16 of the Treaty of the Functioning of the European Union (TFEU). The General Data Protection Regulation (GDPR) further provides a comprehensive set of legislation on how the right is to be upheld in practice, according to what the EU refers to as 'a gold standard'.1 Research also benefts from some protection since freedom of science is protected in several international treaties. The 1948 Universal Declaration on Human Rights includes a right to share in scientifc advancements and benefts, although this is not exactly directed at research itself. The International Covenant on Economic, Social and Cultural Rights contains an

J. Reichel (\*)

© The Author(s) 2021 421

1Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) and Slokenberga et al. (2019), p. 32.

Stockholm University, Faculty of Law, Stockholm, Sweden e-mail<EMAIL_ADDRESS>
S. Slokenberga et al. (eds.), *GDPR and Biobanking*, Law, Governance and Technology Series 43, https://doi.org/10.1007/978-3-030-49388-2\_23

obligation on the Member States to 'respect the freedom indispensable for scientifc research and creative activity'. The EU Charter declares in Article 13 that arts and scientifc research shall be free of constraint. Framed like this, freedom of science can hardly be said to be an individual right that researchers can rely on, but nevertheless it does represent recognition of the importance and value of science.2

The protection of individual rights is, however, not the only objective of the GDPR. According to Article 1, the GDPR has as its dual aim to protect natural persons with regard to the processing of personal data and provide rules relating to the free movement of personal data.3 Within the understanding of free movement of personal data also lies the possibility to use the data for different aims, such as research. The tension between these aims and objectives has been analysed throughout this book.

One of the more salient aims of the EU's data protection law reform which led to the enactment of the GDPR was to diminish the discrepancies between national laws implementing the EU Data Protection Directive.4 For the biobank community, this step was more than welcome. The fragmentation of European biobanking law has been identifed as a major hurdle to prosperous biobank research.5 In a report on the subject commissioned by the EU Commission in 2012, the frst recommendation out of nine was the following:6

Member states and European institutions should develop a consistent and coherent legal framework for biobanking that should protect participants' fundamental rights, in particular in the areas of privacy, data protection and the use of human tissue in research.

The legislative form of the GDPR, a regulation instead of a directive, was chosen in order to ensure that the same law would be applicable throughout the EU. In Recital 10 of the GDPR it is stated that '(c)onsistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union'. As has been widely discussed, and is also apparent from the contributions in this book, in the area of scientifc research, this objective has only been partially achieved. In the same recital it is also stated that '(t)his Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the processing of special categories of personal data ("sensitive data")'. In this

2Ruffert and Steinecke (2011), p. 30.

3See Article 1 GDPR which defnes the dual objective of the regulation as protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. It may further be reiterated that the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, the Data Protection Directive, was enacted as an internal market instrument, under Article 100a Treaty establishing the European Community (today Article 114 TFEU).

4Recital 9 and 13 GDPR.

5Gottweis et al. (2012), p. 8. See, for a global perspective, Dove (2015), p. 681.

6Gottweis et al. (2012), p. 6.

way, the GDPR offers considerable room for inconsistencies at the individual project and Member State levels.

The core data protection principles are laid down in the GDPR, but the detail, the prerequisite for performing the balancing test between individual right and public interest in biobank research, is defned in the laws of the Member States. What does this mean for biobankers in the EU, and for biobank networks, such as the BBMRI-ERIC? A central question is thus the relationship between the core principles and the details in the derogations. How far does the regulatory space of the Member States reach when implementing the research exceptions? In the *Schrems* case the Court of Justice of the European Union (CJEU) held there limits to how far restrictions on the individual right to privacy, in this case based on Article 7 of the Charter, could go; restrictions may not compromise 'the essence of the fundamental right to respect for private life'.7 These boundaries are to be upheld also by the Member States.8 The question, thus, is how a legitimate and foreseeable regulatory regime for processing of health data in biobanking is to be achieved. Does the GDPR contain mechanisms that provide a level playing feld for biobanks within the EU today?

The analysis in this chapter draws on the conclusion presented in this book, in an effort to answer these questions. In Sect. 2, the background to the diversity in the regulatory landscape was analysed from the perspective of legislative competence of the EU. In Sect. 3, the outcome of the implementation of the GDPR in the Member States was discussed. In Sect. 4, the potential consequences of the differences in regulatory regimes were addressed in relation to forum shopping, and Sect. 5 did the same in relation to administrative cooperation and soft law tools for harmonisation. In the fnal Sect. 6, the question of how a level playing feld for biobanks can be achieved is discussed.

### **2 Diversity in Regulatory Responses to the GDPR in the Member States**

### *2.1 Components for Regulating the Processing of Personal Data in Biobank Research*

There are two core principles in the law and ethics of biomedical research that can be considered to be universally accepted: in all bio-scientifc research activity the principle of informed consent of the individual involved must be respected, and all bio-medical research should be reviewed by research ethics committees before

7Case C-362/14 Schrems v Data Protection Commissioner, EU:C:2015:650, p. 94.

8See Joined Cases C-203/15 and C-698/15 Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson, Peter Brice, Geoffrey Lewis, EU:C:2016:970, p. 129.

being conducted.9 These principles have also gained an increasing acceptance in connection to processing of personal data in research.10 However, at the global level, there is still no legally binding document regulating these issues.

As has been discussed throughout this book, and in line with the GDPR, processing of personal data can be lawfully conducted based on either informed consent or public interest, legitimate interest, contract, etc.11 If the personal data belong to a special category, for example, health data or genetic data, further requirements set forth in Article 9 apply. According to Article 9(2)(j) and Article 89, this type of data may be processed in research under the condition that there are appropriate safeguards available, normally via ethical approval from research ethics committees.12 The value of research will thus be balanced against the risk of harm from privacy intrusion experienced by data subjects.13 Regulating the processing of personal data in biobank research therefore involves at least three separate regulatory areas: data protection, research and bioethics.

### *2.2 EU Regulatory Competences in Data Protection, Research and Bioethics*

As discussed previously in this book,14 the regulatory competence of the EU is central to the understanding of the regulatory regime for the processing of personal data in research. In contrast to national states, the EU does not have a general legislative competence but may only enact binding law in areas where the Member States have conferred powers to legislate.15 This notion is generally referred to as the principle of conferral and is codifed in Article 5(2) of the Treaty of the European Union.

In regards to data protection, the question is unproblematic. With the Lisbon Treaty the EU was conferred a specifc competence in the area of data protection in Article 16(2) TFEU. According to the Article, the EU may enact 'rules relating to the protection of individuals with regard to the processing of personal data' and 'rules relating to the free movement of such data'.16 The EU also has some competence in the area of research, but it is limited in several ways. The EU may, for example, carry out activities to defne and implement programmes and set up joint

9Ruffert and Steinecke (2011), pp. 94–96.

10Slokenberga et al. (2019), p. 32.

11Article 6(1) GDPR.

12Article 9(2)(J) and Article 89(1) GDPR and the contributions to this book.

13See the chapter by M.G. Hansson in this book, and Whitley (2016) p. 39.

14See the chapter by S. Slokenberga in this book.

15See further Reichel (2016), p. 174.

16The previous Data Protection Directive was enacted as an internal market act, under Article 100 a Treaty establishing the European Community (EC) at the time of the enactment of the Directive, today Article 114 TFEU.

undertakings or any other structure necessary for the effcient execution of Union research, technological development and demonstration.17 One example of the latter is the regulation introducing a procedure for Member States to establish a European Research Infrastructure Consortium (ERIC), under which the BBMRI-ERIC was established.18 However, when it comes to ethical issues, the EU does not have any competence to enact legislative acts.19

Even though the lack of suffcient legislative competence to fully regulate the processing of health or genetic data in biobank research arguably could have been overcome through an extensive interpretation of the competence to regulate data protection issues, as has been done in the area of administrative cooperation, which is another area where the EU has only limited competence to regulate,20 the strong connection between governance of research and bioethics and national legal culture may have made it politically impossible. Moreover, even though the underlying values and ideas of the bioethical aspects of law can to a large extent be described as universal, there are still national and regional differences, not least when it comes to health and genetics.21 The differences in the regulatory responses of the Member States, discussed throughout this book, seem to confrm this.

### *2.3 Aligning the GDPR with Other International Obligations of the Member States*

One central regulatory aspect of biobank research is the defnition of informed consent. The GDPR permits using what is known in research circles as 'broad' consent. However, as noted several times throughout this book, consent in itself is not a

17Article 179 and 187 TFEU.

18Council regulation (EC) No 723/2009 of 25 June 2009 on the Community legal framework for a European Research Infrastructure Consortium (ERIC).

19See, for example, the Amended Proposal for a Directive of the European Parliament and of the Council on Setting Standards of Quality and Safety for the Donation, Procurement, Testing, Processing, Storage, and Distribution of Human Tissues and Cells, COM (2003) 340 fnal, p. 4, where the Commission rejected certain proposals from the European Parliament on ethical issues on the grounds that Article 168 TFEU, which at the time was Article 152 EC, does not give the EU competence in that feld. See further Busby et al. (2008).

20The GDPR contains elaborated rules on administrative governance and cooperation, which will be discussed briefy in Sect. 3. Further, in regards to clinical trials, the EU has adopted certain rules on administrative cooperation in bioethical matters, Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials on medicinal products for human use and the European Data Protection Board issued Opinion No 3/2019 which concerns the interplay between the EU Clinical Trials Regulation (CTR) and the GDPR.

21For example, Article 23.1 World Medical Association, Declaration of Helsinki—Ethical Principles for Medical Research Involving Human Subjects holds that the law of the land is to be applied, together with relevant international norms and standards as long as these do not undermine the Helsinki Declaration itself.

necessity for personal data to be lawfully processed. In that way, the GDPR paves a rather smooth path for research on residual samples and data. In itself, this approach is not novel. It has previously existed in different national legal orders, as well as internationally. For example, when referring to the collection of human specimens, Article 22 of the Biomedicine Convention states:

When in the course of an intervention any part of a human body is removed, it may be stored and used for a purpose other than that for which it was removed, only if this is done in conformity with appropriate information and consent procedures.

In the explanatory report to the convention it is noted that an appropriate information and consent procedure does not necessarily mean that the patient or his or her representative must give a formal informed consent. It indicates that '[i]n some cases, it will be suffcient for a patient or his or her representative, who have been duly informed (for instance, by means of leafets handed to the persons concerned at the hospital), not to express their opposition'.22 The GDPR addresses the information requirement in this regard under Article 14, allowing exceptions if 'the provision of such information proves impossible or would involve a disproportionate effort'.23

From this, the question emerges whether the EU has attempted to re-defne the minimum level of protection for individuals when research concerns their residual biological material. If so, this creates a confict of laws between the Council of Europe and the EU legal orders, and it is questionable whether those Member States of the EU that have ratifed the Biomedicine Convention will be able to take full advantage of what the GDPR offers. Additional questions can be raised regarding those states that have signed the convention only, and are thus obliged not to defeat the object and purpose of the treaty. A solution here could be found in Article 26 of the Biomedicine Convention which does not place Article 22 in the cluster of core values of the convention, and thus permits the state parties to restrict these rights in some situations.

However, from an ethical standpoint and at least on the surface, this can be seen as rather problematic. The control expressed by the research participant/datasubject through the possibility to decide on whether or not to participate in a particular study may not necessarily relate to the desire to control personal data. As noted by Staunton et al., it may well be attributed to the aim of the particular study and an unwillingness of the research participant/data subject to have their data used in studies that do not conform to their ethical beliefs.24 Has the GDPR therefore stripped the data subjects of their ability to control the use of their data in research? In our view, as *expressis verbis* stated in Article 9(2)(j), it is in the hands of the Member States and the EU. The ability to avoid consent-based research has been subordinated to the EU competence

22Explanatory Report—ETS 164—Human Rights and Biomedicine (Convention), https://rm.coe. int/16800ccde5, para 137.

23Art 14(5)(b) GDPR.

24Staunton et al. (2019), p. 2.

limitations and prevailing values in a particular national legal order. It may well be the case that a particular Member State will choose not to operationalise Article 9(2) (j) GDPR, but up until now, at least according to the country laws that have been reviewed in this book, this approach has not been taken.

### **3 Regulating Safeguards at the National Level: Heterogeneity Remains**

Article 89(1) and (2) divides the responsibility for ensuring that appropriate conditions and safeguards are in place for the lawful processing of personal data in research between the EU and the Member States. The frst paragraph, Article 89(1), does not clearly point out who is responsible for ensuring safeguards but merely holds that 'processing for (…) scientifc or historical research purposes (…), shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject'. Safeguards may be provided via national law, but it is required that they are regulated 'in accordance this Regulation', the GDPR. Article 89(2), on the other hand, refers to either Union law or national law to allow derogations from Articles 15, 16, 18 or 21, subject to appropriate conditions and safeguards.25 Accordingly, the conditions and safeguards for processing personal data in biobank research are regulated in a decentralised manner. Also, Article 9(4) GDPR contributes to the decentralisation by allowing Member States to maintain or introduce further conditions, including limitations for the processing of genetic data, biometric data or data concerning health. In addition, Article 23 GDPR allows for further general derogations in the public interest, for example, for public health.26

As the pan-European survey by Tzortztou et al. in chapter 'Biobanking Across Europe Post-GDPR: A Deliberately Created Fragmented Landscape' in this book illustrates, the Member States have taken different approaches in implementing these conditions and safeguards in regard to both the form and content. Whilst Sweden has taken a minimalistic approach and has only made use of the possibility in Article 89(2) GDPR to adopt general derogations in a limited manner, the regulatory framework for allowing researchers to access and process data held in public populationbased health registries remains wide.27 In Italy, the entry into force of the GDPR has, on the other hand, had the function of flling the gap in the legislation with regard to biobanking for medical scientifc research purposes.28 In France and in Finland, the

25See the chapter by A.G. Duguet and J. Herveg in this book for further details.

26The concept of public interest in the GDPR is analysed by S. Slokenberga, see the chapter by S. Slokenberga in section 4.3.4 in this book.

27See the chapter by M. Stenbeck, S. Eaker Fält and J. Reichel in this book.

28See the chapter by S. Penasa and M. Tomasi in this book, section IV.

national regulatory approach seems to a certain extent to uphold a stricter standard than required by the GDPR, whereas in Estonia, the legislator has chosen a more lenient approach.29 The national regulatory responses thus remain heterogeneous.

### **4 Addressing Regulatory Differences Via Forum Shopping?**

A relevant question to pose is whether this heterogenous regulatory landscape may lead to forum shopping, in the sense that research proposals are allocated to Member States with the most benefcial regulatory regimes. The question of forum shopping, or in other words, regulatory competition, is far from unknown in the EU Internal Market and not always seen as problematic in itself. Within the Internal Market, Member States should allow a free fow of goods, services, labour and capital, unless there is a legitimate reason to hinder it.30 It is for the economic actors in the Internal Market to allocate their business to the forums that offer the most advantageous conditions. In the *Centros* case, the CJEU held that it was contrary to the rules of the Internal Market for a Member State to refuse to register a 'letterbox-company' merely on the basis that the company wanted to allocate its business in a less restrictive regulatory environment. Only on suspicion of fraud would it be legitimate for the Member State to take action.31 The practice is also well known in labour law where employers might want to place their headquarters in a state with a more lenient labour law regime. Even if this is often criticised, it has proven diffcult to combat the practice without distorting the Internal Market.32 As mentioned in the introduction, the GDPR has as its objective to promote free movement of personal data. In global medical research, the concepts of 'ethics dumping', the practice of exporting unethical research practices to lower-income settings, has been recognised as an ethical problem.33 The differences between Member States of the EU should not be exaggerated, but at the same time researchers allocating research proposals to certain states in order to circumvent ethical regulation can be seen as problematic and will in the long run undermine social trust in biobanking. The next issue to consider is therefore whether the GDPR contains any mechanisms that may bridge the regulatory differences.

29See the chapter by G. Chassang et al., section 5.1; Chapter by T. Southerington, section III and chapter by K. Pormeister, section 4.

30Article 26 TFEU.

31Case C-212/97 Centros Ltd v Erhervs- og Selskabsstyrelsen EU:C:1999:126, p. 39.

32Houwerzijl (2014), p. 98.

33See, for example, The Global Code of Conduct for Research in Resource-Poor Settings, in particular Article 14. The code was developed within the TRUST, Equitable research party projects, see further www.globalcodeofconduct.org/.

### **5 Addressing Regulatory Differences Via Administrative Cooperation and Soft Law Tools**

As mentioned briefy above and as also discussed by Dara Hallinan in chapter 'Biobank Oversight and Sanctions Under the General Data Protection Regulation' of this book, the GDPR contains an elaborated governance structure for both European and national administration within the data protection area. Here, focus is laid on the potential of this structured cooperation of authorities to overcome differences in interpretations of data protection rules and concepts. It is in this context of interest to note that the administrative structure is partially regulated also in EU primary law. Both Article 8 of the Charter and Article 16 TFEU state that compliance with data protection rules shall be subject to control by an independent authority. This independency is regulated in Chapters VI and VII of the GDPR, together with the competence, tasks and powers of the national data protection authorities (DPAs) and the newly established European Data Protection Board (EDPB), which has taken over after the previous Article 29 Working Party Group.

One of the tasks of the EDPB is to issue guidelines, recommendations, best practices and opinions on a wide range of subjects.34 Even if the GDPR does not regulate biobanking directly, these documents will often be relevant both in regards to defning core principles of data protection, such as informed consent, and in relation to processing personal data across sectors, such as clinical trials.35 The GDPR also introduced several new tools with which DPAs can cooperate; two of these will be discussed here. These are a one-stop-shop mechanism for appointing a lead authority in cases involving monitoring of cross-border processing and a procedure for composite decision-making, labelled a consistency mechanism.36

The frst mechanism was established to offer a smooth and foreseeable means of supervision since it identifes one single DPA to act as a one-stop-shop for controllers and processors active in more than one Member State, thus giving the lead DPA a role as coordinator of the supervision of all the processing activities of that business throughout the EU in collaboration with other 'concerned' DPAs.37

The second, the consistency mechanism, provides a procedure for fulflling the role of a dispute resolution mechanism in which the EDPB functions as a dispute resolution body.38 According to this procedure, a DPA can refer a draft decision to

34Article 70(1) GDPR.

35See European Data Protection Board, Guidelines on Consent under Regulation 2016/679 (wp259rev.01) and European Data Protection Board, Opinion No 3/2019 which concerns the interplay between the EU Clinical Trials Regulation (CTR) and the GDPR. Further, the European Data Protection Supervisor (EDPS), tasked with monitoring data protection within the EU institutions and bodies under Regulation 2018/1725, has issued a Preliminary opinion on data protection and scientifc research, 6 January 2020.

36Article 56 and 63–66 GDPR, respectively. See further Hijmans (2016), p. 369.

37Article 60 GDPR and Giurgiu and Larsen (2016), p. 349.

38 Ibid, p. 350.

the EDPB before enacting a decision in different categories of situations. In the frst category, consisting of six identifed cases, referral is compulsory.39 In the second category, concerning 'any matter of general application or producing effects in more than one Member State', referral is optional.40 However, the procedure in the second paragraph can be initiated by any DPA, not merely the lead authority, the chair of the EDPB and the Commission. If the DPAs cannot agree, any one of them may trigger the consistency mechanism, thus inviting the EDPB to take a leading role. In both categories, the EDPB issues an opinion which all DPAs and the Commission may comment on.41 The lead authority must 'take utmost account of the opinion of the Board' and communicate to the Chair of the Board whether it will maintain or amend its draft decision.42 If the lead authority does not abide by the opinion, the EDPB may proceed with a dispute resolution. This effectively entails a decision adopted for the individual case which the DPA must implement by giving a fnal decision according to the requirements of the relevant national law, referring to the decision enacted by the EDPB.43 If and to what extent this mechanism is to be used within the area of research in general or biobank research in particular remains to be seen. Within the areas where the GDPR acknowledges the regulatory competence of the Member States, such as due to the research exceptions, it is hardly conceivable that the consistency mechanism can reconcile the various approaches and traditions of the Member States, at least not in a comprehensive manner.

A more customised tool for defning the proper balance between individual right and public interest in biobank research is the code of conduct.44 A code of conduct can be drafted by private companies and organisations for the processing of personal data by certain categories of controllers or processors.45 The procedure for adopting a code of conduct involves both a DPA, the EDPB and the Commission, and results in a binding document specifying the proper application of the GDPR for processing within the Union and as a basis for transfer outside.46 In June 2019,