GDPR Requirements for Biobanking Activities Across Europe

Valentina Colcelli (PhD) is a Senior Researcher at Italian National Research Council (CNR). Department CNR_IFAC. She published books concerning EU integration and more than 80 papers. She is a member of several projects funded by the EU and long-lasting international research cooperation, like the H2020 and Horizon Europe. She is Independent Ethics Advisors for European Cancer Imaging Initiative (EUCAIM project, funded under the DIGITAL program,18 MIO EU co-funding), one of the flagships of the Europe's Beating Cancer Plan (EBCP). Expert for European Commission Directorate-General for Research and Innovation/Infrastructures _ ERIC. She is Visiting External examiner at the University of Malta, and Professor of “Law, Science and Technology” at Escuela Judicial del Poder Judicial del Estado de Oaxaca –México (Maestría en Derecho Judicial). She is co-chair of the Working Group “Regulatory, Ethics, and GDPR” for the Scientific Association “European, Middle East &African for Biopreservation and Biobanking" (ESBB) and member of the ESBB Council.Roberto Cippitani is Jean Monnet Chairholder at the Department of Law, Università degli Studi di Perugia; Co-Director of the Chair ISAAC (Individual Rights, Scientific Research and Cooperation in Europe and in the World) at UNED - Universidad Nacional a Distancia (Madrid); Professor at INDEPAC - Instituto Nacional de Estudios Superiores en Derecho Penal (Mexico) and at the Escuela Judicial del Poder Judicial del Estado de Oaxaca (Mexico); former Academic Coordinator of the Jean Monnet Centre of Excellence “Rights and Science” in the University of Perugia; Associated Researcher at CNR-IFAC. Responsible, staff member, and ethics advisor of projects funded under EU programs. He is visiting professor at several universities in Europe, Latin America and China. Christoph Brochhausen, MD, Full Professor. Clinical Head of the Institute of Pathology and holds the Chair of Pathology at the Medical Faculty Mannheim of the University Heidelberg. He is council member and co-chair of the European, Middle Eastern and African Society for Biopreservation and Biobanking -Working group “Regulatory, Ethics & GDPR“. He is specialized in orthopaedic-, respiratory- and cardio-vascular pathology. His research is focused on Digital Pathology, Cryotechnology, Precision Medicine, Tissue Engineering and Regenerative Medicine as well as ELSI in Biobanking. Christoph Brochhausen coordinates BRoTHER, a Bavarian-Czech research network in biobanking and eduBRoTHER an EU-funded, transdisciplinary and international education program on Precision Medicine and Biobanking. He is awarded with the Michalis lecture, Trinity College Cambridge (UK, 2008), the Best Paper Award of the European Society of Biomaterials (2009), the “Land of Ideas "award from the German Government (2012), the Histalim biotechnology Award (France, 2015) and the “Ars legendi award“ of the German Medical Faculty Day (2015). Christoph Brochhausen has written more than 180 scientific publications in peer-reviewed journals, 18 book contributions and two books. Citations: ^3000, H-index: 34.Rainer Arnold, Dr. Dr.h.c. mult., Professor at the University of Regensburg, in 1978 appointed holder of the Chair of Public Law, in 1999 nominated holder of the Jean Monnet Chair of EU Law and in 2008 holder of the Jean Monnet Chair ad personam “Legal Relations of the EU with Central, Eastern and South-Eastern Europe“. Nominated in 2000 hostujíci professor at the Charles University Prague. Corresponding Member of the Academy of Sciences of Bologna, Membre titulaire de l’Académie international de droit comparé, Fellow of the European Law Institute. In 2008 (3 months) Fernand Braudel Fellow and various times Visiting Fellow at the European University Institute, Fiesole/Florence, former Visiting Professor at the University Paris I (Panthéon-Sorbonne), Paris II (Panthéon-Assas), Strasbourg, Toulouse, Aix-en-Provence, Roma La Sapienza, Bologna, Trento, and other. Organization of twenty-three International Congresses on European and Comparative Constitutional Law, co-organized with the Constitutional Courts of Moldova in 2017 (Kishinau) and of Lithuania in Oct. 2019 (Vilnius), with the University of Gdansk in 2018 and with the World Law Association in Febr. 2019 (Madrid) and in July 2023 (New York).

• Introduction.- Medical research and data protection in Europe. The emergence of general legal principles.- Part I  Syllabus of the burning questions.- Anonymisation (Part I) ‘What is the state-of-the-art of anonymisation in data-driven health research and its role in the “European Health Data Space Regulation”?’.- Anonymisation - The trap for biobanking (Part II) ‘Why the anonymisation could be a trap for the biobanking activity? Can there really be anonymisation in the research biobanks?’.- Applying national law in cross-border research activity ‘Which national law should be applied in cross-border research activity in the local implementation of GDPR?’.- Archived tissue ‘What is the potential use for research under GDPR for archived tissue specimens obtained in a diagnostic or therapeutic pattern?’.- Blockchain and dynamic consent ‘Can the blockchain realise proper support for dynamic consent?’.- Brexit effects ‘What are the “Brexit effects” on the exchange of data and biological samples with the UK?’.- Broad consent ‘Do patients have to be informed about the concrete research projects for which their data and biosamples are to be used? Is so-called broad consent adequate?’.- Cloud ‘How is it possible to exchange research and personal data using the cloud without being a danger to patients?’.- Consent requirements ‘What are the terms and conditions of informed consent?’.- Consent and assent by children ‘Management of assent and consent by children. What should be done when they reach the appropriate age: Obligations and recommendations?’.- Consent & Technology ‘Is dynamic consent the solution or can an interactive website solve the problem of consent?’.- Consent from children andvulnerable people ‘What protection is provided to people who are not able to give consent or are restricted in their ability to give consent, for example, children or people with disabilities?’.- Consent withdrawal ‘What is the procedure if consent will later be withdrawn?’ .-  Covid-19 ‘Are the rules of the GDPR on scientific research - if correctly applied - able to guarantee personal health data in the context of Covid-19 research activities?’.- Dynamic consent ‘According to sentence three of recital 33, persons whose data are to be stored for future research projects should be given the opportunity to provide their consent to only certain areas of research or parts of research projects to the extent permitted by the purpose pursued. How can this be realised?’ .- Ethics committees ‘To what extent are ethics committees relevant for the activities of the biobank?’.-  Ethic & Biobanks ‘What are the steps needed to implement bioethical issues in a population-based and disease-based biobank?’.- Ethical principles and legal provisions ‘What ethical principles apply to biobanking activities?’.- EU legislation and health data protection ‘For the processing of medical personal data in biobanking activities, is the GDPR the sole reference legislation in the EU?’.- Forensic databases (Part I) ‘Forensic use of research biobanks: How does the GDPR regulate the issue?’.- Forensic databases (Part II) ‘How does EU law address issues concerning access for forensic purposes to research biobanks?’.- Future research ‘How to deal with the problem that future research may often not be able to be defined in narrow and specific terms, as it depends on the current state of research?’.- Genetic data ‘What are the ethical–legal consequences entailed in the exceptional nature of genetic information?’.- Granularity ‘When processing personal data and biological material in research activities, is it possible to derogate from the general rules and, in particular, from the rule of granularity of consent?’.-  Imaging biobank ‘What are the areas of the GDPR bearing on an image biobank?’.- Industry perspective ‘Contracting in the light of the GDPR: What are the key considerations for transfers of biosamples and data from an industry perspective?’.- Joint controller agreement ‘What is the function of the joint controller agreement in sharing personal data with a large research consortium or biobank infrastructures?’.- Legitimate interests ‘Are legitimate interests lawful grounds for processing retrospective health data and tumour tissue?’.- Ownership of human biological material ‘To whom does the “ownership” of the human body and its parts belong? Who has the right to dispose of it and for what purpose?’.- Paediatric biobanks (general overview) ‘How to tackle the protection of personal data and other ethical issues in a paediatric biobank?.-  Public Interest Who decides on the existence of a public interest?’.- Rare diseases and data protection (Part I) ‘How to enable research on rare diseases while protecting personal data?’.- Rare diseases and legal, ethical, technical and societal needs (Part II) ‘Why are biobanks and research networks able to support data protection issues in rare disease research?’.- Rare paediatric diseases ‘Does the GDPR support dynamic consent/assent strategies for rare paediatric diseases?’.-  Residual material ‘What applies to the processing of residual material with its associated data? Is explicit consent required for this?’.- Retention time - conservation of personal data (Part I) ‘How long can personal data be stored in a biobank?’.-  Retention time - conservation of tissues (Part II) ‘How long can tissues be stored in a biobank?’.- Retrospective research ‘Is the use of broad consent for retrospective research on data and tissue possible in the framework of GDPR?’.- Scientific research and the biomedical sector. Requirements and methods for planning and managing a “data protection by design” project. ‘How can a scientific research project be planned and managed to comply “by design” with GDPR?’.- Secondary use (Part I) ‘What does secondary use mean for research using tissue specimens obtained in a diagnostic or therapeutic setting, in the light of the GDPR?’.- Secondary use and dual use of biomaterial samples (Part II) ‘Does broad consent include the reuse and dual use of biomaterial samples and their associated personal data?’.- Transfer of the personal data for research purposes towards non-EU countries ‘How is it possible to transfer personal data for research purposes to non-EU countries?.- Users ‘Who are the users in the context of biobanks? What are the factors to consider when dealing with the human component?’.- Part II   Biobanking legal and ethical requirements across Europe: National reports (in alphabetic order).- Instead of a preface Towards regulation for the European health data research: A comparative analysis.- National report: Austria.- National report: Belgium.- National report: Bulgaria.- National report: Croatia.- National report: Cyprus.- National report: Czech Republic.- National report: Denmark.- National report: Estonia.- National report: Finland.- National report: France.- National report: Germany.- National report: Greece.- National report: Hungary.- National report: Ireland.- National report: Italy.- National report: Latvia.- National report: Lithuania.- National report: Luxemburg.- National report: Malta.- National report: Netherlands.- National report: Poland.- National report: Portugal.- National report: Romania.- National report: Slovakia.- National report: Slovenia.- National report: Spain.- National report: Sweden.- National report: United Kingdom.- Conclusion.