The implementation of EU law has however not been left to the Member States to take care of entirely separate from the EU. Article 197.1 TFEU, where EU competence under Article 6g TFEU is specified, also pronounces that the effective implementation of EU law by the Member States, which is essential for the proper functioning of the Union, shall be regarded as a matter of common interest. It is up to Member States to implement EU law, but it is a matter of common interests that—and not seldom how—it is done. If we instead consider the issue from a more practical perspective, the implementation of EU law is usually divided into three parts, direct, indirect or shared administration. EU institutions themselves thus provide direct administration, particularly the Commission, indirect administration is when the implementation is taken care of by the Member States, while the shared administration is carried out by the Member States in cooperation with EU institutions and agencies.⁷ Nowadays EU law is mainly implemented through various forms of shared administration, with national administrative organs working closely with EU institutions and agencies.⁸

Another relevant factor is that the EU’s own administration has grown significantly, through the establishment of over 30 independent European agencies. The EU authorities have different characteristics, but most of them, the so-called regulatory agencies, have the overall task of promoting the implementation of EU law in different ways.⁹ The regulatory agencies may provide technical or scientific advice to the Commission and the Member States, be responsible for operational activities or create networks between administrations. They may also collaborate with private organisations and undertakings.

There have been efforts within the EU, not least by the Commission, to establish better balanced governance for the EU agencies, which has been surprisingly difficult. In 2012 a joint statement of the European Parliament, the Council and the Commission was adopted, as well as a follow-up road map, in which a common approach was presented to improve the consistency, effectiveness, accountability and transparency in the work of the EU authorities.¹⁰

Although the EU has no independent competence to regulate the internal institutional or procedural organisation of the Member States, there are now a vast number of EU legislative acts containing such rules. The explanation lies in a broad interpretation of the articles providing the EU with a legal basis to adopt rules in substantive policy areas. Within the EU food policy, for example, the EU has adopted a regulation with common rules for monitoring the implementation of EU food regulations.¹¹ In the preamble it is stated that the Member States should enforce the feed and food law, animal health and animal welfare rules and monitor and verify that the relevant requirements thereof are fulfilled, and that it is therefore appropriate to establish a harmonised framework of general rules for the organisation of food controls.¹² The legal basis for the regulation is found in three articles on substantive policy areas, the present Article 43 TFEU on agricultural policy, Article 114 TFEU on internal market and Article 168 TFEU on public health. Further examples can be found in a number of horizontal legislative acts within the internal market, which contains instructions and minimum rules for the competent authorities of Member States to handle administrative matters regarding free movement of citizens, goods or services, as well as instructions on how the competent authorities in the Member States should cooperate, etc.¹³

Within the area of research and innovation, which is especially relevant for this paper, the conditions are almost the opposite. The EU catalogue of competencies, article 4.4 Para. 3, TFEU, states that the EU has limited competence to act in this area:

In the areas of research, technological development and space, the Union shall have competence to carry out activities, in particular to define and implement programs; however, the exercise of that competence shall not result in Member States being prevented from exercising theirs.

The Union may “carry out activities”, which is not the same as enacting binding legal tools. Further, the principle of preemption, which otherwise applies when the EU has exercised its competence in areas where competence is shared with the Member States (Article 2.2 TFEU), does not apply here. Any action taken by the EU does not prevent the Member States to act themselves.

According to Article 179 TFEU, the EU shall have the objective of strengthening its scientific and technological bases by achieving a European research area, characterised by the free circulation of researchers, technological development and space. Articles 180–181 TFEU set out what action the EU may take, mainly complementary and coordinated action. According to Article 187 TFEU, however, the EU may “set up joint undertakings or any other structure necessary for the efficient execution of Union research, technological development and demonstration.” It is under this legal basis that the EU has enacted the above-mentioned regulation establishing the European consortium for research infrastructures, the ERIC consortium, discussed further in Sect. 6.

The first aspect refers to the specific characteristics that the EU has in comparison to other international organisations, namely its capacity to adopt legal acts that bind the Member States and their citizens directly.¹⁵ The treaties have established procedures to be used for various forms of legislation, attributing specific roles to EU institutions in the process. The original legislative model is usually denoted Community Method.¹⁶ A basic idea of the method is that the central EU institutions listed in Article 13 TEU are to represent specific interests within the Union. By regulating the functioning of the different institutions in the legislative process, these interests may be balanced against each other. It is thus not a question of separation of powers in the traditional sense, where three branches of the state, the legislature, the executive, and the judiciary, are divided in order to balance each other. The basis of the Community Method may rather be seen as a division of interests, in order for them to balance against each other. The legislative power rests with the Council that represents the interest of the Member States, together with the European Parliament that represents the interest of the citizens of the Union. The legislative initiative can however only be taken by the Commission, which represents the interests of the Union as a whole, being completely independent of the Member States. The Court of Justice of the European Union and the European Court of Auditors are given the task of control: to ensure that the law is observed and to examine Union accounts.¹⁷ The institutional balance is thus of central importance in EU constitutional order, as well as the right for the institutions and the Member States’ right to initiate a judicial review of all the legal acts adopted.¹⁸

Even though the European Community, the EC, was replaced and succeeded by the Union in the Lisbon Treaty (Article 1 TEU), the Community Method has actually increased in importance, since it is now only the common foreign and security policy that is still dealt with according to traditional international decision making procedures (title V of the TEU). For a new act to be adopted in the EU, it is generally required that the Commission submits a proposal that a sufficient majority in the European Parliament and the Council can accept.¹⁹

The second aspect of the EU’s constitutional order that can be identified as relevant, the restrictive approach to delegation of legislative power, can also be seen as a way to uphold institutional balance in the EU’s legislative procedure. According to the classical Meroni doctrine, there are only limited possibilities to derogate from the distribution of powers which the Treaties have set out. Delegation is only possible if the delegated powers are clearly defined, the exercise of the delegated powers is under the control of the delegating institution on the basis of specific and objective criteria and that the delegation does not include discretionary powers that allow a margin of appreciation.²⁰ As seen above, in recent years a large number of EU agencies have been established. This development has taken place without any further mechanisms for delegation being introduced in the Treaties. The tasks of the EU agencies vary, but some are equipped with the authority to make decisions in individual matters,²¹ and others can play a role in the EU legislative process in the form of expert bodies giving advice.²²

An interesting example of the latter category is the three EU agencies in the financial sector, established in 2011,²³ which play a significant role in their respective areas, both in connection to the Commission’s adoption of delegated legislation relating to technical standards and the issuing of non-binding guidelines and recommendation to the competent authorities of the Member States. According to Article 10 of the respective regulations, the authorities are to draft technical standards for submission to the Commission and the Commission may not derogate from or modify the draft, without first consulting the Authority. In Article 16 the authorities are conferred a competence to adopt guidelines and recommendations “with a view to establishing consistent, efficient and effective supervisory practices within the ESFS, and to ensuring the common, uniform and consistent application of Union law”. The same article also states that the competent authorities of the Member States “shall make every effort to comply” with these guidelines and recommendations, which they must confirm to the EU authority. If the competent authority does not intend to follow the guidelines or recommendations, the reasons for this should be expressly stated. The guidelines and recommendations are not formally binding legal acts in a formal sense, but in practice they are not far from it. Hofmann has in the light of these developments found in general that the gap between the constitutional regulation and the reality of the emerging European administration is increasing.²⁴

Besides the two aspects described above, a further aspect may be emphasized, namely the above-mentioned principle of conferral. The principle is relevant both for explaining why the EU cannot take general measures to regulate the national implementation of EU law, but also why certain policies generally fall outside the competence of the EU, or why the EU only has limited competence. Examples of the latter category are the EU’s employment policy, which will be mentioned only briefly, and the EU’s research and innovation policies.²⁵

The EU has no competence to take legally binding action in employment, but may under Article 5.2 TFEU adopt measures to coordinate Member States policies, “in particular by defining guidelines”. Traditionally, the open method of coordination, OMC, has been used in this area, whereby national policies can be coordinated without competence formally having been transferred to the EU.²⁶ The approach is to identify and define common objectives, after which the Member States adopt individual programs for achievement. By making use of benchmarking and comparative studies, the programs are evaluated. The process is intended to function decentralised, with the EU, Member States, regional and local levels as well as the social partners and civil society actively involved, using variable forms of partnership.²⁷

With regard to EU policies for research and innovation, the EU has merely competence to take complementary and coordinated actions vis-à-vis national policies (Sect. 2.2). Even so, Ruffert and Steinecke maintain that the EU acts as a supranational organisation in the international field of research.²⁸ This can be explained by the organisational regimes and soft law mechanisms that the EU can utilise within the European research area. In the 2020 strategy, the EU has defined several steps to achieve a sustainable economy and growth in Europe.²⁹ One part of the strategy is directed to research and innovation. The EU has introduced several agencies, programs and instrument to facilitate research. One of them is the European Strategy Forum on Research Infrastructures, EFRSI, a Commission instrument to support a coherent and strategic policy for research infrastructures in Europe.³⁰ The ESFRI identifies and describes the scientific needs for research infrastructures within the EU in the near future through roadmaps.³¹ Within the ESFRI, the national competent authorities in the research area are represented and the needs identified at the EU level will also influence the priorities made at the national level. For example, in the Swedish equivalent to the ESFRI road map, the Research Council guide to infrastructures 2012, it is stated that the ESFRI road map has been used as an important basis.³² The Biobanking and Biomolecular Resources Research Infrastructure (BBMRI) was one of the first projects to enter the European Research Infrastructure’s preparatory phase of the ESFRI roadmap, funded by the Commission.³³ BBMRI.eu today has 54 members, with more than 225 associated organisations (largely biobanks) from over 30 countries. The Swedish Research Council funds the Swedish part of the project, BBMRI.se.

The growing cooperation between European and national administrative bodies in various forms has come to be regarded as an administrative organisation in itself, known as an integral or composite administration.³⁴ An important difference between this composite European administration and national administration is that the composite administration is not organised under one coherent political structure. Neither the EU nor the Member States can by themselves steer or control the European composite administration as a whole. Instead, the composite administration is a part of all 29 constitutional orders at the same time, the EU and the 28 Member States.³⁵ A specific feature of the composite administration is its fragmented structure; the organisation and inter-relationships between its constituent bodies vary from one policy area to another.³⁶ This heterogeneous administrative model, with its indistinct boundaries between the European and national, as well as between the private³⁷ and the public, may in itself open the doors for the use of alternative regulatory methods, using soft governance tools rather distinct legal rules. One of the main driving forces behind the development of a composite administration is its ability to solve common European problems that are out of reach for the individual entities, the EU and the Member States.³⁸ By coordinating European and national policies and infrastructures, a more efficient outcome of policies may be attained. On the other hand, the ability to steer and control the heterogeneous administration may prove more difficult, since it is not directed by one coherent policymaker. With this further follows a risk of fragmentation, since different policy areas develop rather independently of each other. What this implies for the area of medical research and bioethics will be discussed in Sect. 6.

As set out above, the notion that individuals have the right to decide if and how parts or samples of their body are to be used in medical research is strong in the International Community.⁴³ International law at the global level does not provide for any binding legal rules regarding the above-mentioned three parts of informed consent, only soft law.⁴⁴ A central document is the UNESCO Universal Declaration on Bioethics and Human Rights, where Article 6 states that the right of autonomy of every person to decide on participation in research, for example by donating samples, should be protected, and Article 9, concerns the protection of the privacy of the persons concerned and the confidentiality of personal information. Furthermore, the OECD Guidelines for Human Biobanks and Genetic Research set out the protection of participants’ privacy and the confidentiality of data as a founding principle in section 1.D, and informed consent as the main rule, in section 4.B.

At the European level there are some binding legal acts. The Council of Europe has adopted two acts containing general provisions on rights to privacy, health and dignity, namely the European Convention for the Protection of Human Rights and Fundamental Freedoms from 1950 and the Social Charter from 1961. In 1997 the Council of Europe adopted the Convention on Human Rights and Biomedicine, with more specific requirements for informed consent (Articles 5–9) and the right to privacy and to information (Article 10). The Council of Europe has further enacted a Convention in 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data, based on which the EU Data Protection Directive⁴⁵ is modeled (see Sect. 4.2.1).

The EU Charter of Fundamental Rights, which is binding since entering into force of the Lisbon Treaty 2009, contains several relevant articles. Article 3 states the right of each individual to integrity within the fields of medicine and biology, which is respected by obtaining informed consent, and Article 8 grants the right to the protection of personal data.

Under the level of fundamental rights, there are hardly any international or European sources containing binding administrative rules concerning cross-border biobanking directly.⁴⁶ EU law contains secondary legislation that may be applied in connection to biobanking (4.2.1). Instead, the main source consists of soft law (4.2.2).

Also, fundamental rights other than autonomy rights may be relevant in the field of biobanking for medical research purposes, namely those rights and interests that may exist on a collective level usually referred to as public benefit or public good. The right to the enjoyment of the highest attainable standard of physical and mental health was first articulated in the 1946 Constitution of the World Health Organization (WHO), and the right to health is also included in the United Nations Universal Declaration of Human Rights from 1948 (Article 25) and in the United Nations International Covenant on Economic, Social and Cultural Rights from 1966 (Article 12). In Europe, the right to health is protected in the Council of Europe Social Charter (Article 11), and in an equivalent manner, the EU Charter of Fundamental rights (Articles 34 and 35).⁶²

Furthermore, the researchers themselves can also benefit from some protection, since the freedom of science is also protected in several international treaties. The 1948 Universal Declaration on Human Rights includes a right to share scientific advancements and benefits (Article 27), which is not exactly directed to the researches themselves. The International Covenant on Economic, Social and Cultural Rights contains an obligation on the Contracting States to “respect the freedom indispensable for scientific research and creative activity”, Article 15.3. The EU Charter of fundamental rights declares, in Article 13, that the arts and scientific research shall be free of constraint. Framed like this, the freedom of science is hardly an individual right for the researchers to rely on, but nevertheless a recognition of the importance and value of science.⁶³

As a general point of departure, research ethics committees at the national level carry out the assessment of ethical issues in relation to medical research on biobanks. All of the above-mentioned guidelines and recommendations require the involvement of ethics committees in some form.⁶⁴ In the OECD guidelines on human biobanks and genetic research databases (HBGRD) the use of an independent research ethics committee is considered as one of the main prerequisites of best practices⁶⁵:

The establishment, governance, management, operation, access to, and use of the HBGRD and its protocols and processes for research activities, should be approved or reviewed, as applicable, by an independent research ethics committee.

Ruffert and Steinecke maintain that these types of committees exist in almost all countries.⁶⁶ The approval by a research ethics committee might, according to national law, be required both when collecting samples for a specific research project, or when re-using old samples already stored in a biobank. Standardised forms are usually used when obtaining the consent of sample donors. These are usually drafted by the researchers themselves, after models are made available by associations,⁶⁷ the biobanks themselves,⁶⁸ or, as discussed above, provided by groups of researchers.⁶⁹

The assessment of the committees may, on many occasions, include the balancing of interests between the individual rights involved and the possible benefits for the public, since the review of whether the aim of the research can motivate the use of possibly privacy sensitive issues, i.e. human biological material and personal data is central to the committees’ task. The research ethics committees can be considered as being well-equipped for this task, since the committee can provide a far broader range of perspectives upon issues under consideration because membership of ethics committees are typically drawn from different disciplines.⁷⁰ On the other hand, which will be discussed further below (Sect. 5.2), it may be questioned whether the research ethics committees at the national level are so well-equipped to assess medical research on biobanking conducted cross border, on a global scale.

When administrative matters move beyond the state, there are basically two methods for deciding on what rules should apply. Either a common understanding of what rules to be applied can be developed, so that administrative actors apply the same or similar rules, or administrative actors stick to their own rules and develop meta-rules for when to apply what set of rules. As stated by Ruffert and Steinekke, referring to an example suitable for this article⁷²:

The execution of a bio-ethically doubtful research project by a multinational research institution could be governed either by the bio-ethical rules of an international organisation or by conflicting rules of different States (the State where the institution is seated, where the project is mainly performed, where the researchers originate from…)

The two methods do not exclude each other, but may interact in an intricate manner. What makes global biobanking difficult is that the same solution does not necessarily apply to all three dimensions of the informed consent condition described above, in relation to handling the biological material, the data connected to it and to the participation in research. Within a procedure only involving research on Swedish sample donors/data subjects, all three parts can be reviewed by a research ethics committee in one single application. In a global context, the situation is quite different. A national research ethics committee cannot enact legally binding decisions addressing legal subjects abroad directly. At a global level, the three parts are handled separately. In the following, the legal situations will be analysed using Swedish law as an example, but with references to an international context.