Protection Principles and Research in the Biobanks Age
© Springer Science+Business Media Dordrecht 2015Deborah Mascalzoni (ed.)Ethics, Law and Governance of BiobankingThe International Library of Ethics, Law and Technology1410.1007/978-94-017-9573-9_6
Data Protection Principles and Research in the Biobanks Age
Italian Data Protection Authority, Rome, Italy
The article builds on the speech presented at the International Meeting on “Rethinking autonomy in the research biobanks age”, Università degli Studi, Milan, 17–18 December 2009. The author would like to thank Mr. Antonio Caselli for translating the text. Opinions and views expressed are the author’s only.
1 Time for Rethinking and Looking Forward
Are the principles of data protection suitable for regulating the relationships between techno-science and the law for the specific area of genetic research, particularly with respect to collections of biological samples—often referred to as biobanks? Or is it true, as is widely believed in medical and scientific circles, that personal data protection legislation, or at least its implementation,1 is an obstacle to medical and scientific research, and in particular to genetic research?
Furthermore, what has personal data protection legislation, which is mainly focused on personal information, to do with the legal status of biobanks?2
Beginning with these questions, although they may seem to trivialise the import of the actual issues to be faced, allows us to discuss the legal status of medical and scientific research in the age of biobanks by looking at the interactions with personal data protection legislation and also, perhaps more importantly, allows us to assess whether it is necessary (or considered appropriate) to introduce new legislation or to amend the existing rules in the European scenario.3
It could be said that an assessment of this sort is not an end in itself, as such an assessment will actually be instrumental in deciding which steps will be taken, and the decisions by policy- and rule-makers must not be postponed further, particularly given the wealth of literature available on the topic.
The many reasons for this urgency may be summarised as follows. The technical and scientific advancements in the genetics sector are obvious to all, and expectations are increasing that descriptions of the causes and identification of the treatments for serious diseases that affect large proportions of the population (such as cancer or degenerative diseases4) and other less common diseases that are the result of genetic defects will soon be available, for the benefit of both current and future generations; information technology, and particularly bioinformatics, is constantly improving and healthcare systems are increasingly affected by this improved technology—well beyond their computerisation—and both of these factors are bound to result in a repository of information with increasingly high-quality, cost-effective features that can be (re)used for research purposes5; large biobanks are being set up in many countries (for example, Iceland,6 England and Estonia), and existing collections of biological samples are being sorted and stored, while research projects and scientific networks are increasingly being restructured in multi-tier terms (regional, national, continental, inter-continental)7; and, finally, there are major business interests, both public and private, and investments involved in developing this sector.8
If these points do not sufficiently explain the importance of the issue, one only needs to browse the many documents issued over a very short period by national bio-ethics committees9 which indicate the need for development of clear, harmonised rules, at least at a European level, for all the stakeholders in the area. Data protection authorities themselves have not remained passive in the face of the developments related to the processing of genetic data; they are actually contributing to the debate on biobanks, both at a national level10 and via the Article 29 Working Party,11 within their respective spheres of competence.
2 Biological Samples and Personal Information: Two Worlds Apart?
The question remains of whether personal data protection legislation, and subsequently the independent supervisory authorities that are required in Member States to check on the lawfulness of personal data processing, has anything to do with biobanks that are used (or are intended to be used) for research purposes and, if so, the extent to which this is so.
One could argue that biobanks should fall within the scope of the rules applying to “res” (i.e. property) rather than “personae” (i.e. individuals), in which case this whole issue would be tackled from the standpoint of property rights rather than personal rights. This is the approach followed in common law countries, and indeed is the approach adopted by the US legal system, in which there are no general data protection laws, so that the protection of individuals relies only on theoretical models based on property rights, if applicable, which can be reconciled more easily with market logic.
The point is that the use of biological samples (and/or the genetic material extracted from them) for research purposes does not immediately imply consideration of their “material” nature along with the potential gain associated with the use and/or processing of those samples, because it is the “informational” dimension that is the focus of attention. In other words, it is the information extracted from biological samples that matters in the research context, rather than the sample as such; the sample plays the ancillary role of conveying the information it contains, which can only be disclosed if the sample is analysed appropriately.
If this were not the case, it would be hard to understand why the regulatory framework applying to the use of biological samples for genetic research is modelled closely on personal rights rather than property rights. Even if it is assumed that “ownership” of the biological sample is not vested in the individual from whom the sample was taken (as is the case, for instance, with the so-called “donation” of biological samples), the use of any information extracted from the biological sample is regulated in Europe according to personal data protection principles, if that information can be related to an identifiable and/or identified individual.
Thus, if the biological sample is only relevant to research insofar as it is a “container” and a “carrier” of (genetic) information,12 the regulations applying to its preservation and circulation cannot be significantly removed from data protection principles—it is no mere chance that the term “bioinformationelle Selbstbestimmungsrecht”13 was created in the literature to mirror the well-known informationelle Selbstbestimmungsrecht, as recognised by the German Bundesverfassungsgericht in 1983.14
3 Fundamental Rights of Individuals and Protection of Research: A Conflict Past Reconciliation, or a Necessary Bond?
Having clarified that personal data protection principles are applicable not only to the personal information (including genetic information) that is used for research purposes, but also to the biological samples such information is (or can be) extracted from, one should tackle the first question—i.e. whether the protection of fundamental rights of individuals should override all other rights, including the right to scientific research, by way of a sort of “tyranny of values”, given that this protection is at the core of our legal systems including, unquestionably, the EU system. Articles 7 and 8 of the EU Charter of Fundamental Rights have been incorporated into the Lisbon Treaty, which came into force recently.17
This stance, which has never actually been endorsed by DPAs, should be regarded as inadmissible. The recognition that the right to the protection of personal data is a fundamental right does not leave room for merely individualistic and/or radicalised views. In Italy, it has been authoritatively stated that fundamental rights, “being values that are recognised and safeguarded by the Constitution, … are always limited by their very nature—including those rights that are mentioned in the Constitution without any reference, not even in general terms, to their limitations (e.g. the freedom of art and science: see Article 33 of Italy’s Constitution). If two rights are in conflict, or a personal right is in conflict with a public interest protected by the Constitution, a balanced analysis should be carried out (being the so-called balancing of interests) in order to determine which right is to prevail, based on the specific circumstances, or else how those rights can be mutually reconciled”.18
Furthermore, it should be pointed out that the opposite stance should also be rejected; i.e. that the world of medical and scientific research should be left free to decide on the applicable rules.
One should rather follow the approach based on praktische Konkordanz,19 or practical co-operation, as recently highlighted by Beyleveld. In this manner, one could not only use interpretation standards applied to the principles that are enshrined in constitutional charters, but also remain true to the belief that it will only be possible to foster public trust in research and ensure that research activities can continue to be carried out20 by ensuring respect for the fundamental values of individuals at the highest level.21
4 The Principles Underlying the Regulation of Biobanks
Before moving on to more detailed considerations, it should be clarified that the regulations that have been (or are about to be) introduced concerning the use of biobanks for medical and scientific research have been derived from multiple sources. On the one hand, they are related to personal data protection principles, as already pointed out, and to professional secrecy rules (especially in the healthcare sector) while, on the other hand, they are associated with the regulations applying to clinical drug trials22 which are modelled to a large extent on the rules developed at an international level. The latter is especially true for the supervision by ethics committees of biobanks and, generally speaking, of the use of biological samples for research purposes, as well as for the requirement that the proband’s informed consent be obtained prior to using his/her data and samples for research purposes.23
However, it should also be pointed out that there is an ever increasing corpus of legislation that, though starting from the aforementioned principles, is attempting to particularise those principles by introducing regulations that deal specifically with research activities based on the use of biobanks; accordingly, this research sector is taking on features that differ from traditional clinical drug trials.24 This is shown quite clearly by the adoption of the Council of Europe’s Recommendation R(2006)4 on research on biological materials of human origin. Similarly, with respect to domestic legislation, specific laws have been enacted (and subsequently amended) in Norway, whereas the so-called loi bioètique is being revised in France specifically to keep the provisions on observational studies separate from those applying to clinical tests.
Therefore, one cannot rule out that law-making efforts in this area will be made at a Community level as well, especially given the increasing amount of research involving biobanks from several Member States; in fact, the shared principles introduced by the legislation enacted domestically to transpose directive 2001/10 cannot be applied to this sector.25
However, this is a topic best addressed by switching from general principles to specific rules so as to prevent obstacles from arising in the day-to-day research practice, despite the existence of such shared principles.
5 Supranational Data Protection Regulations and Scientific Research
Before embarking on a search for the peculiarities of genetic research and biobanks, it may be helpful to recall that Directive 95/46, which is an omnibus regulation, does not provide detailed guidance in this respect. This has left a broad manoeuvring space for national lawmakers as to the regulations applying to the research sector; indeed, Article 8(4) of the Directive allows for additional deviations from the prohibition against processing sensitive data, on condition that “appropriate safeguards” are taken and that there are “substantial public interest reasons”.
Nor are clear-cut guidelines available in supranational instruments; the general rule prohibiting the processing of sensitive data as per Article 6 of the Strasbourg Convention of 28 January 1981 actually allows the use of such data for research purposes, providing Member States adopt “suitable safeguards”.
In Europe, national lawmakers can therefore exercise wide-ranging discretion in setting out, via standard legislation, the mechanisms for striking a satisfactory (albeit difficult) balance between the conflicting values at stake. Based on an initial analysis, as mentioned previously, all such values would appear to deserve to be implemented in full, as all of them can be considered to be important among those that are recognised and protected by our legal systems. They include the freedom of science and the task of fostering scientific research and development, and more specifically medical research, as well as the community’s interest in establishing the causes of disease, which ultimately corresponds to the right to health as an interest vested in the community at large. On the other hand, they also include protecting personal rights and human dignity, in particular with regard to the right to data protection and informational self-determination.
Nonetheless, it should also be considered that personal data protection principles can be placed under serious strain by the requirements of genetic research and the new investigational methods applied in this research.26 Some of the critical points in this respect are outlined below.
6 Compatibility Between Genetic Research and General Data Protection Principles
6.1 The Purpose Specification Principle
Given that there are no provisions specifically addressing scientific research, and in particular genetic research, in Directive 95/46, it is necessary to assess whether general data protection principles are compatible with the requirements typically applying to genetic research—which in principle, subject to different regulations, is carried out on the assumption of having obtained the participants’ informed consent.
To that end, it is appropriate to start from the purpose specification principle, which is the focus of all data protection regulations. Article 6(1), letter (b), of Directive 95/46 provides that personal data may be processed for “specific” and “explicit” purposes; having achieved the (lawful) purpose for which personal data is processed, one must—in principle—either erase or anonymise the data in question. Therefore, any processing operation concerning personal data is basically temporary in nature, as it should be terminated as soon as the relevant purpose has been achieved.
If this regulatory concept is applied to genetic research, there are some initial compatibility issues. Genetic research is characterised, more than other types of medical and scientific research, as an “open-ended process”. That is to say, to quote the Italian wording, “you know where you are starting from, but you do not know where you will end”. It is difficult to be sufficiently specific about the purpose(s) for which the data subject’s “informed consent” is to be obtained. There is actually the risk of specifying boundaries that are either too broad (“for purposes of genetic research”) or too narrow (“for the purpose of studying a specific genetic disease”).
Major concerns have been raised by researchers about any provision requiring them to recontact data subjects in order to obtain their consent for a “new” area of genetic research using the information and biological samples collected previously. This is alleged to be difficult to put into practice, to entail additional costs, or to be downright impossible.
In short, the personal data and biological samples used for genetic research, which are liable to be used repeatedly within the framework of a basically endless cycle, risk challenging the concept whereby any processing operation concerning personal data should be temporary in nature; moreover, they can undermine the foundations of the so-called right to anonymity.
6.2 The Relevance Principle
However, the purpose specification principle (along with the related “informed consent” principle) is not the only principle that is challenged. Similar considerations apply to the relevance principle (Article 6(1), letter (c) of Directive 95/46/EC). There is no need to outline the detailed features of genetic research here; it is necessary only to stress that this type of research makes use of a considerable amount of personal data from the most diverse sources (genetic, genealogical, medical, and behavioural) plus information on habits and life-styles concerning both the data subject and their relatives. Genetic researchers also avail themselves of biological samples, which can be kept for an indefinite length of time.
It is difficult to differentiate “adequate, relevant, and not excessive data” from those that are not so (or may not become so in future), although one has to do this with sensitive data in this sector—which should be subject to stricter relevance criteria. In fact, genetic research “exposes” a person’s most intimate details, and the research requires such “exposure” in order to be truly effective.