Are the principles of data protection suitable for regulating the relationships between techno-science and the law for the specific area of genetic research, particularly with respect to collections of biological samples—often referred to as biobanks? Or is it true, as is widely believed in medical and scientific circles, that personal data protection legislation, or at least its implementation,¹ is an obstacle to medical and scientific research, and in particular to genetic research?

Furthermore, what has personal data protection legislation, which is mainly focused on personal information, to do with the legal status of biobanks?²

Beginning with these questions, although they may seem to trivialise the import of the actual issues to be faced, allows us to discuss the legal status of medical and scientific research in the age of biobanks by looking at the interactions with personal data protection legislation and also, perhaps more importantly, allows us to assess whether it is necessary (or considered appropriate) to introduce new legislation or to amend the existing rules in the European scenario.³

It could be said that an assessment of this sort is not an end in itself, as such an assessment will actually be instrumental in deciding which steps will be taken, and the decisions by policy- and rule-makers must not be postponed further, particularly given the wealth of literature available on the topic.

The many reasons for this urgency may be summarised as follows. The technical and scientific advancements in the genetics sector are obvious to all, and expectations are increasing that descriptions of the causes and identification of the treatments for serious diseases that affect large proportions of the population (such as cancer or degenerative diseases⁴) and other less common diseases that are the result of genetic defects will soon be available, for the benefit of both current and future generations; information technology, and particularly bioinformatics, is constantly improving and healthcare systems are increasingly affected by this improved technology—well beyond their computerisation—and both of these factors are bound to result in a repository of information with increasingly high-quality, cost-effective features that can be (re)used for research purposes⁵; large biobanks are being set up in many countries (for example, Iceland,⁶ England and Estonia), and existing collections of biological samples are being sorted and stored, while research projects and scientific networks are increasingly being restructured in multi-tier terms (regional, national, continental, inter-continental)⁷; and, finally, there are major business interests, both public and private, and investments involved in developing this sector.⁸

If these points do not sufficiently explain the importance of the issue, one only needs to browse the many documents issued over a very short period by national bio-ethics committees⁹ which indicate the need for development of clear, harmonised rules, at least at a European level, for all the stakeholders in the area. Data protection authorities themselves have not remained passive in the face of the developments related to the processing of genetic data; they are actually contributing to the debate on biobanks, both at a national level¹⁰ and via the Article 29 Working Party,¹¹ within their respective spheres of competence.

The question remains of whether personal data protection legislation, and subsequently the independent supervisory authorities that are required in Member States to check on the lawfulness of personal data processing, has anything to do with biobanks that are used (or are intended to be used) for research purposes and, if so, the extent to which this is so.

One could argue that biobanks should fall within the scope of the rules applying to “res” (i.e. property) rather than “personae” (i.e. individuals), in which case this whole issue would be tackled from the standpoint of property rights rather than personal rights. This is the approach followed in common law countries, and indeed is the approach adopted by the US legal system, in which there are no general data protection laws, so that the protection of individuals relies only on theoretical models based on property rights, if applicable, which can be reconciled more easily with market logic.

The point is that the use of biological samples (and/or the genetic material extracted from them) for research purposes does not immediately imply consideration of their “material” nature along with the potential gain associated with the use and/or processing of those samples, because it is the “informational” dimension that is the focus of attention. In other words, it is the information extracted from biological samples that matters in the research context, rather than the sample as such; the sample plays the ancillary role of conveying the information it contains, which can only be disclosed if the sample is analysed appropriately.

If this were not the case, it would be hard to understand why the regulatory framework applying to the use of biological samples for genetic research is modelled closely on personal rights rather than property rights. Even if it is assumed that “ownership” of the biological sample is not vested in the individual from whom the sample was taken (as is the case, for instance, with the so-called “donation” of biological samples), the use of any information extracted from the biological sample is regulated in Europe according to personal data protection principles, if that information can be related to an identifiable and/or identified individual.

Thus, if the biological sample is only relevant to research insofar as it is a “container” and a “carrier” of (genetic) information,¹² the regulations applying to its preservation and circulation cannot be significantly removed from data protection principles—it is no mere chance that the term “bioinformationelle Selbstbestimmungsrecht”¹³ was created in the literature to mirror the well-known informationelle Selbstbestimmungsrecht, as recognised by the German Bundesverfassungsgericht in 1983.¹⁴

This interpretation was endorsed more or less explicitly by the Data Protection Act (DPA) and, after being put forward by some scholars,¹⁵ was recently upheld by the European Court of Human Rights in the case of S. and Marper v. UK. ¹⁶

Having clarified that personal data protection principles are applicable not only to the personal information (including genetic information) that is used for research purposes, but also to the biological samples such information is (or can be) extracted from, one should tackle the first question—i.e. whether the protection of fundamental rights of individuals should override all other rights, including the right to scientific research, by way of a sort of “tyranny of values”, given that this protection is at the core of our legal systems including, unquestionably, the EU system. Articles 7 and 8 of the EU Charter of Fundamental Rights have been incorporated into the Lisbon Treaty, which came into force recently.¹⁷

This stance, which has never actually been endorsed by DPAs, should be regarded as inadmissible. The recognition that the right to the protection of personal data is a fundamental right does not leave room for merely individualistic and/or radicalised views. In Italy, it has been authoritatively stated that fundamental rights, “being values that are recognised and safeguarded by the Constitution, … are always limited by their very nature—including those rights that are mentioned in the Constitution without any reference, not even in general terms, to their limitations (e.g. the freedom of art and science: see Article 33 of Italy’s Constitution). If two rights are in conflict, or a personal right is in conflict with a public interest protected by the Constitution, a balanced analysis should be carried out (being the so-called balancing of interests) in order to determine which right is to prevail, based on the specific circumstances, or else how those rights can be mutually reconciled”.¹⁸

Furthermore, it should be pointed out that the opposite stance should also be rejected; i.e. that the world of medical and scientific research should be left free to decide on the applicable rules.

One should rather follow the approach based on praktische Konkordanz,¹⁹ or practical co-operation, as recently highlighted by Beyleveld. In this manner, one could not only use interpretation standards applied to the principles that are enshrined in constitutional charters, but also remain true to the belief that it will only be possible to foster public trust in research and ensure that research activities can continue to be carried out²⁰ by ensuring respect for the fundamental values of individuals at the highest level.²¹

Before moving on to more detailed considerations, it should be clarified that the regulations that have been (or are about to be) introduced concerning the use of biobanks for medical and scientific research have been derived from multiple sources. On the one hand, they are related to personal data protection principles, as already pointed out, and to professional secrecy rules (especially in the healthcare sector) while, on the other hand, they are associated with the regulations applying to clinical drug trials²² which are modelled to a large extent on the rules developed at an international level. The latter is especially true for the supervision by ethics committees of biobanks and, generally speaking, of the use of biological samples for research purposes, as well as for the requirement that the proband’s informed consent be obtained prior to using his/her data and samples for research purposes.²³

However, it should also be pointed out that there is an ever increasing corpus of legislation that, though starting from the aforementioned principles, is attempting to particularise those principles by introducing regulations that deal specifically with research activities based on the use of biobanks; accordingly, this research sector is taking on features that differ from traditional clinical drug trials.²⁴ This is shown quite clearly by the adoption of the Council of Europe’s Recommendation R(2006)4 on research on biological materials of human origin. Similarly, with respect to domestic legislation, specific laws have been enacted (and subsequently amended) in Norway, whereas the so-called loi bioètique is being revised in France specifically to keep the provisions on observational studies separate from those applying to clinical tests.

Therefore, one cannot rule out that law-making efforts in this area will be made at a Community level as well, especially given the increasing amount of research involving biobanks from several Member States; in fact, the shared principles introduced by the legislation enacted domestically to transpose directive 2001/10 cannot be applied to this sector.²⁵

However, this is a topic best addressed by switching from general principles to specific rules so as to prevent obstacles from arising in the day-to-day research practice, despite the existence of such shared principles.

Before embarking on a search for the peculiarities of genetic research and biobanks, it may be helpful to recall that Directive 95/46, which is an omnibus regulation, does not provide detailed guidance in this respect. This has left a broad manoeuvring space for national lawmakers as to the regulations applying to the research sector; indeed, Article 8(4) of the Directive allows for additional deviations from the prohibition against processing sensitive data, on condition that “appropriate safeguards” are taken and that there are “substantial public interest reasons”.

Nor are clear-cut guidelines available in supranational instruments; the general rule prohibiting the processing of sensitive data as per Article 6 of the Strasbourg Convention of 28 January 1981 actually allows the use of such data for research purposes, providing Member States adopt “suitable safeguards”.

In Europe, national lawmakers can therefore exercise wide-ranging discretion in setting out, via standard legislation, the mechanisms for striking a satisfactory (albeit difficult) balance between the conflicting values at stake. Based on an initial analysis, as mentioned previously, all such values would appear to deserve to be implemented in full, as all of them can be considered to be important among those that are recognised and protected by our legal systems. They include the freedom of science and the task of fostering scientific research and development, and more specifically medical research, as well as the community’s interest in establishing the causes of disease, which ultimately corresponds to the right to health as an interest vested in the community at large. On the other hand, they also include protecting personal rights and human dignity, in particular with regard to the right to data protection and informational self-determination.

Nonetheless, it should also be considered that personal data protection principles can be placed under serious strain by the requirements of genetic research and the new investigational methods applied in this research.²⁶ Some of the critical points in this respect are outlined below.