GDPR and Biobanking

Front matter

| Technology Series 43

GDPRand Biobanking

Individual Rights, Public Interest and Research Regulation across Europe

Contents

JHEVOROCHON: 6 bi5.5006 c'eeihencae K 45568055 a RNASE 806 EebE Ree RDS 1 Santa Slokenberga, Olga Tzortzatou, and Jane Reichel

PartI Setting the Foundations

Setting the Foundations: Individual Rights, Public Interest, Scientific Santa Slokenberga

Part II GDPR Insights Mahsa Shabani, Gauthier Chassang, and Luca Marelli

Biobank and Biomedical Research: Responsibilities of Controllers and Processors Under the EU General Data Protection

Ciara Staunton

Safeguards and Derogations Relating to Processing for Scientific Anne-Marie Duguet and Jean Herveg

Biobank Oversight and Sanctions Under the General Data Protection Resmlatots.c5i464440 242.0 5id49 eatea o oes 121 Dara Hallinan vi Contents

Andelka M. Phillips and Tamara K. Hervey

Part III National Implementation An Overview of Belgian Legislation Applicable to Biobank Research

Teodora Lalova, Anastassia Negrouk, Laurent Dollé,

Sofie Bekaert, Annelies Debucquoy, Jean-Jacques Deréze,

Peggy Valcke, Els J. Kindt, and Isabelle Huys

Balancing of Individual Rights and Research Interests in Danish Biobank Regulation sg 6 Gh eek ei eesbaser d e arina 215 Mette Hartlev

Kärt Pormeister

Access to Biomedical Research Material and the Right to Data Protection in Finks sic 55sec aces beteeddakeces bead dakai roti 243 Tom Southerington

Research Biobanking, Personal Data Protection and Implementation of the GDPR in Francés. 62654400005 6ideicednseeod veewsanbanas ous 257 Gauthier Chassang, Michael Hisbergues, and Emmanuelle Rial-Sebbag

Nils Hoppe

Olga Tzortzatou and Anastasia Siapka

The Italian Way for Research Biobanks After GDPR: Hybrid

Normative Solutions to Balance the Protection of Individuals

Simone Penasa and Marta Tomasi

Norwegian Biobanks: Increased Complexity with GDPR and

Carla Barbosa and Andreia da Costa Andrade

The New European Legal Framework on Personal Data Protection

and the Legal Status of Biological Samples and Biobanks for

Carlos M. Romeo-Casabona

Swedish Law on Personal Data in Biobank Research: Permissible Büt COMples 54.055 4.44204 kd Sih ede a a Ra 379 Magnus Stenbeck, Sonja Eaker Falt, and Jane Reichel

Contents vii

PartIV Fragmentation and Ways Forward

Biobanking Across Europe Post-GDPR: A Deliberately Fragmented Fandita 6h. ds ea eha is KOS LAO EE ERO Fo PREGA Ee ERA E 397 Olga Tzortzatou, Santa Slokenberga, Jane Reichel, Andreia da Costa Andrade, Carla Barbosa, Sofie Bekaert, Evert-Ben van Veen,

Carlos M. Romeo-Casabona, Katharina Ó. Cathaoir, Gauthier Chassang, Annelies Debucquoy, Jean-Jacques Derèze, Laurent Dollé, Sonja Eaker Fält, Radek Halouzka, Mette Hartlev, Michael Hisbergues, Nils Hoppe, Isabelle Huys, Els Kindt, Anne Kjersti Befring,

Lukasz Kozera, Dorota Krekora-Zajac, Teodora Lalova, Michaela Mayrhofer, Anastassia Negrouk, Jakub Pawlikowski, Simone Penasa, Kärt Pormeister, Emmanuelle Rial-Sebbag, Anastasia Siapka,

Tom Southerington, Magnus Stenbeck, Maja Šutalo, Marta Tomasi, Peggy Valcke, and Ruth Vella Falzon

Allocation of Regulatory Responsibilities: Who Will Balance Individual Rights, the Public Interest and Biobank Research

Jane Reichel

Introduction A)

Check for updates

Santa Slokenberga, Olga Tzortzatou, and Jane Reichel

Discrepancies in biobank research regulations have commonly been regarded as one of the most significant hurdles for effective research collaboration. One of the more central aspects of biobank research regulation concerns the use of personal data— health and genetic data and other information related to individuals, either as individual research subjects or participants in a particular scientific study or as one of many in a registry. Accordingly, the adoption of the EU General Data Protection Regulation (GDPR) in 2016 and its applicability from May 2018 had been long awaited by the biobank community. Although the GDPR is not a research regulatory instrument, in the attempt to regulate personal data processing activities it creates a rather complex ‘research regime’, also known as ‘scientific research regime’ or ‘research exemption’, through which it shapes how scientific research in so far as personal data are concerned is regulated by the EU and could further be shaped either by the EU itself or the Member States. The GDPR sets forth stringent requirements for the processing of health and genetic data and a set of data subject rights and imposes considerable obligations on biobanks and researchers, while simultaneously allowing for considerable derogations, directly applicable or enabled through the Member State or the EU law, for the purposes of scientific research. Occasionally, further derogations from individual rights could be possible and other requirements apply if research can be regarded as in the public interest.

S. Slokenberga (%4) Faculty of Law, Uppsala University, Uppsala, Sweden e-mail: santa.slokenberga @jur.uu.se

O. Tzortzatou Academy of Athens, Biomedical Research Foundation, Athens, Greece e-mail: otzortzatou @ bioacademy.gr

J. Reichel Stockholm University, Faculty of Law, Stockholm, Sweden e-mail: Jane.Reichel @juridicum.su.se

© The Author(s) 2021 1 S. Slokenberga et al. (eds.), GDPR and Biobanking, Law, Governance and Technology Series 43, https://doi.org/10.1007/978-3-030-49388-2_1

2 S. Slokenberga et al.

Article 89 is the central provision that regulates scientific research under the GDPR. It is also a key provision in enabling derogations from individual rights for the purposes of scientific research. Following operationalisation of Article 89, these derogations can be made by directly invoking the provisions of the GDPR on a case-by-case basis, as well as through the national laws of the Member States of the EU, as well as laws of the EU. Consequently, although the GDPR harmonises data protection requirements for resarch, and in that way contributes to the governance of biobanking, considerable divergences between requirements in different EU Member States could occur. Additionally, the Member States of the EU as well as the EU may address questions of public interest that could open up for further fragmentation. This room for divergence, while it offers flexibility for accommodating various standards and values, also creates uncertainty and poses questions about scientific collaboration and data sharing when different standards apply. One can therefore question whether the EU has built a platform upon which biobanking can accelerate or it has created a platform that allows for fragmentation of the regulatory landscape, and thereby creates risks of slowing down research collaborations and scientific advances.

In this book, a comprehensive approach is taken to determine how the GDPR affects the regulatory regimes on the use of personal data in biobank research in the EU Member States. The aim is to examine the GDPR research regime in biobanking starting with the research exception enabled through Article 89 GDPR. In order to achieve this aim, the book takes on two tasks: first, to scrutinize the GDPR research regime, its objective and constituting elements, impact on biobanking, as well as role in a changing EU landscape, especially post-Brexit arrangements; second, to review how various derogations have been operationalised nationally, and what challenges and opportunities this diversification can bring. It thereby captures the complexity GDPR creates for biobanking and sheds light on various approaches to tackling the challenges that have emerged.

More specifically, Part I sets the foundations for this book. The approach in this part rests on three main pillars, namely, the notion of individual rights, public interest and scientific research. In Chapter, ‘Individual rights, public interest and biobank research’, Santa Slokenberga maps out how biobanking has found its place in the GDPR and traces the main avenues of co-existence of these three pillars.

Biobanking is a field with well-established research ethics traditions in which the research ethics committees have a considerable role to play. In Chapter, ‘Striking a balance between personalized genetics and privacy protection from the perspective of GDPR’, Mats G. Hansson takes an ethicist’s perspective examines how Research Ethics Committees could balance the need for scientific research for scientific advances, on the one hand, and privacy protection, on the other hand, in the absence of clear guidance from law and policy makers. In his contribution, Hansson proposes three premises that could help balancing the aspiration to further research with the aim to ensure the study participants privacy protection.

Part II is devoted to the analysis of GDPR requirements for biobanking. In research, data access and data sharing are of paramount importance. One of the critical concerns is how to comply with the GDPR while still allowing for these two to occur. In Chapter, ‘Biobank governance and the impact of the GDPR on the regulation of biobank research’, Mahsa Shabani, Gauthier Chassang, Luca Marelli examine the governance models for accessing genomic and health data, and key tools and mechanisms to further compliance with the GDPR. It is clear the GDPR leaves considerable room for further governance interventions by policy makers to uphold good research practices, to ensure research is not hindered and to safeguard the privacy of research participants as sample donors and data subjects. These governance mechanisms need to be up to date in order to be able to mitigate risks and take advantage of the opportunities brought by new and emerging technologies.

In Chapter, ‘Biobank and Biomedical Research: Responsibilities of Controllers and Processors under the EU General Data Protection Regulation’, Ana Nordberg scrutinises key obligations biobanks and researchers face as controllers and processors. She also identifies key compliance challenges faced by biobanks as data controllers and processors, and discusses different compliance avenues. Furthermore, she highlights challenges that emerge in the area of biobanking as we move towards a data-driven society in which artificial intelligence and big data have a prominent role to play.

In Chapter, ‘Individual rights in biobank research under GDPR’, Ciara Staunton examines what rights the GDPR provides to the data subjects and their operationalisation in the area of biobanking. She takes a close look at each of the individual rights protected by the GDPR and considers their impact in biobanking. She argues that even though the individual rights in the GDPR are intended to give greater autonomy and control over the use of a data subject’s personal data, this may not necessarily be so in the area of biobanking. Not only might data subjects lack awareness about their data being processed, and hence be unable to protect their rights, but they might also be left with few, if any, enforceable rights as a result of different derogations. As a compensatory measure to ensure a high level of data protection, adequate safeguards are offered instead.

Anne-Marie Duguet and Jean Herveg in Chapter, ‘Safeguards and derogations relating to processing for scientific research: Article 89 analysis for biobank research’, scrutinize the requirement of adequate safeguards and argue that failing to comply with them could render the intended processing for scientific research purposes non-compliant with the GDPR. The GDPR might not appear overly generous in specifying what these safeguards could be but, together with the established research standardsand practice in the field, the authors have found it possible to highlight three elements: respect for the essence of data protection, proportionality and appropriate and specific measures to safeguard the fundamental rights of the data subjects. The authors put forward eight measures that could serve as appropriate safeguards and accordingly as tools to operationalise the generous research exemptions offered by the GDPR.

In Chapter, ‘Biobank Oversight and Sanctions under the General Data Protection Regulation’, Dara Hallinan examines the function and problems with the oversight and sanctions mechanisms outlined in the GDPR as they relate to the biobanking context. Hallinan has identified four types of oversight (ex ante assessment, prior notification and approval, ongoing oversight and general oversight) and two key types of sanction (liability and compensation sanctions, and administrative sanctions). Although these mechanisms are prima facie comprehensive, as Hallinan argues, they are not immune from critique. His chapter shows that problems appear in relation to the standard of protection provided for data subject rights, the

4 S. Slokenberga et al.

disproportionate impact on legitimate interests tied up with the biobanking process—particularly genomic research interests—and their practical implementability in biobanking.

The requirements the GDPR sets forth apply to the EU Member States and the European Economic Area (EEA) states, and through extraterritoriality clauses to others targeting EU data subjects. It also sets forth stringent rules when personal data are being transferred to third countries. Brexit presents an interesting situation as on the one hand the UK is expected to leave the EU, becoming a third country for the purposes of data protection, but on the other hand the UK is a current Member State of the EU as of June 2020 and has adopted a national data protection framework in line with the GDPR. It could transpire that the EU Member States are required to comply with the GDPR through Chapter V rules, namely rules that address data transfers to the third countries or international organisations. In Chapter, ‘Brexit and biobanking: GDPR perspectives’, Andelka M. Phillips and Tamara K. Hervey provide insights into possible post-Brexit legal futures. In addition to illuminating possible scenarios Brexit poses for biobanking and highlighting the possible post January 31, 2021 scenario, this chapter also provides an insight into the situation for biobanking that any EU Member State could face if an analogue to Brexit occurs.

Part HI, Chapters are focuses on how GDPR has been implemented in the selected EU Member States. Teodora Lalova, Anastassia Negrouk, Laurent Dollé, Sofie Bekaert, Annelies Debucquoy, Jean-Jacques Deréze, Peggy Valcke, Els Kindt and Isabelle Huys provide ‘An Overview of Belgian Legislation Applicable to Biobank Research and its Interplay with Data Protection Rules’. Mette Hartlev examines the ‘Balancing of Individual Rights and Research Interests in Danish Biobank Regulation’. Kärt Pormeister provides insights into the ‘Regulatory Environment for Biobanking in Estonia’. Tom Southerington scrutinizes “Access to Biomedical Research Material and the Right to Data Protection in Finland’. Gauthier Chassang, Michael Hisbergues and Emmanuelle RialSebbag examine ‘Research biobanking, personal data protection and implementation of the GDPR in France’. Nils Hoppe scrutinizes ‘The Regulation of Biobanking in Germany’. Olga Tzortzatou and Anastasia Siapka have provided ‘Mapping the Biobank Landscape in Greece’. Simone Penasa and Marta Tomas have examined ‘The Italian Way for Research Biobanks after GDPR: Hybrid Normative Solutions to Balance the Protection of Individuals and Freedom of Research’. Anne Kjersti Befring has provided insights into “Norwegian Biobanks: Increased Complexity with GDPR and National Law’. Carla Barbosa and Andreia da Costa Andrade have offered “Biobanks and GDPR: a look at the Portuguese panorama’. Carlos M. Romeo Casabona has offered insights into ‘The new European Legal Framework on Personal Data Protection and the Legal Status of Biological Samples and Biobanks for Biomedical Research Purposes in Spanish Law’. Finally, Magnus Stenbeck, Sonja Eaker Fält and Jane Reichel have provided insights into ‘Swedish law on Personal Data in Biobank Research: Permissible but Complex’.

These country studies have several common central pillars. They begin by providing an overview of the biobank infrastructure and regulatory environment in the respective country. In particular, they cover issues such as what types of biobanks are there in their respective countries, how biobank research is regulated, how individuals are involved in the sample collection and what procedures are being followed, what are the oversight bodies in the field etc. Thereafter they examine the approach to individual rights and safeguards in the respective national legal order and assess how the rules work in practice and how the balance between individual rights and development of science is struck in the country. Finally, they reflect on the GDPR impact and future possibilities for biobanking, and cover other issues that have been of relevance, such as reflections on the biobank and research governance, the capacity building and sustainability and the collaboration challenges, in the respective country’s settings.

In the final Part IV, some conclusions are drawn to the central question this book set out to examine; the impact of the GDPR in the area of biobanking.

In Chapter, “Biobanking Across Europe post-GDPR: A Deliberately Fragmented Landscape’, Olga Tzortzatou and scholars representing 19 countries, namely Teodora Lalova, Anastassia Negrouk, Laurent Dollé, Sofie Bekaert, Annelies Debucquoy, JeanJacques Deréze, Peggy Valcke, Els Kindt and Isabelle Huys (Belgium); Radek Halouzka (Czech Republic); Maja Sutalo (Croatia); Mette Hartley (Denmark); Kart Pormeister (Estonia); Tom Southerington (Finland); Gauthier Chassang, Michael Hisbergues and Emmanuelle Ria l-Sebbag (France); Nils Hoppe (Germany); Olga Tzortzatou, Anastasia Siapka (Greece); Katharina O Cathaoir (Ireland); Simone Penasa and Marta Tomas (Italy); Ruth Vella Falzon (Malta); Evert-Ben van Veen (the Netherlands); Anne Kjersti Befring (Norway and Liechtenstein); Jakub Pawlikowski, Dorota Krekora-Zajac and Lukasz Kozera (Poland); Carla Barbosa and Andreia da Costa Andrade (Portugal); Carlos M. Romeo-Casabona (Spain); Magnus Stenbeck, Sonja Eaker Fält and Jane Reichel (Sweden); and Santa Slokenberga (Latvia) take a comprehensive insight into the fragmented landscape that GDPR has created. It reviews the biobank regulatory environment; whether and how derogations under Article 89(2) GDPR are enabled; the legal basis for scientific research and the role of consent in biobanking post-GDPR; the balance between individual rights and public interest in national law; and finally, GDPR impact and future possibilities for biobanking. In the conclusion, this chapter underlines the importance of research ethics committees and the coalition regarding data flow or exchange issues, among the several ongoing sector-specific initiatives for Code of Conducts.

In Chapter, ‘Allocation of Regulatory Responsibilities: Who Will Balance Individual Rights, the Public Interest and Biobank Research Under the GDPR?’, Jane Reichel takes a bird’s eye view of the situation and reflects on the allocation of regulatory responsibilities for research under the GDPR. The question is what legislator will in the end perform the balancing of the competing interests of individual rights, the public interest and biobank research? An analysis is given of the division of powers within the regulatory space created by the GDPR in relation to the processing of personal data for research; the legislative competences of the EU and the space left to the Member States. Further, international obligations within bioethics are taken into account. Building on the analysis presented throughout the book, it is concluded that the GDPR has not fulfilled its aim to diminish regulatory

6 S. Slokenberga et al.

fragmentation in regard to processing of data within biobank research. Two mechanisms of overcoming fragmentation in practice are discussed; via forum shopping and via administrative cooperation and soft law tools provided by the GDPR. The conclusion of the chapter it is while forum shopping in ethical issues might be problematic, it is more likely that unity could be brought by the later, administrative cooperation and soft law tools. Even though these tools lack the democratic legitimacy of statutory law, as the law stands today it may be the best we can hope for.

The editors would like to acknowledge the contributions of BBMRI-ERIC in meeting the research goal of the comparative analysis in chapter “Biobanking Across Europe post-GDPR: A Deliberately Fragmented Landscape’. In the context of the H2020 project ADOPT BBMRI-ERIC (GA No 676550), BBMRI-ERIC, the research infrastructure for biobanking, set up a first screening table based on which national laws were screened for further details relating to operationalization of the GDPR in the national context. For the purpose of this book project, the table was further adapted and enlarged beyond the member states of BBMRI-ERIC. To date, it consists of 20 member states and one international organization. Among other things, its ELSI Services and Research unit provides guidance on ethical, legal and societal aspects relevant for facilitating access to Pan-European biobanks. Several authors of this book are affiliated to BBMRI-ERIC or its National Nodes in various capacities.!

Finally, on behalf of the editors team, we would like to thank Nick Cleary for his help with the editing the text and BBMRI-ERIC for covering the open access fee.

Acknowledgements Santa Slokenberga’s work has been funded by her postdoctoral fellowship at Lund University, Faculty of Law (Sweden).

'http://www.bbmri-eric.eu.

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

Part I Setting the Foundations

Setting the Foundations: Individual Rights, @® Public Interest, Scientific Research gag and Biobanking

Santa Slokenberga

Abstract The principle of conferral tames the EU competence to regulate research in a comprehensive manner, yet furthering research is one of its aspirations. Data protection, however, is an area within which the EU has legislated extensively. During the development of the General Data Protection Regulation (GDPR), an important issue to tackle was how to balance the ambitious EU aspirations and differing stakeholder interests, on the one hand, with limited competences in research regulation, on the other, and how to determine the extent to which data protection could be used as a means to further scientific research in the EU legal order. The outcome is the GDPR multifaceted research regime that sets forth EU policy and opens up for further regulations from the Member States as well as the EU.

The research regime that the GDPR has created poses numerous questions. Key among these is, what are the implications of the operationalisation of Article 89 GDPR in biobanking? This chapter sets out some of the underlying tensions in the area and pins down key conceptual foundations for the book. It provides insights into the EU’s interests in the area of biobanking and maps out central elements of the research regime that has been built within the GDPR. Thereafter, it analyses the key concepts used in the book, including biobank and biobanking, scientific research as undertaken under the GDPR, individual rights and public interest. Lastly, it shares some preliminary reflections as starting points for the analysis to come.

The availability, accessibility, acceptability and quality of medical goods and services are of paramount importance to create conditions under which the highest attainable standard of health can be realised.'! In achieving these objectives,

'See ICESCR Article 12 and General Comment No. 14.E/C.12/2000/4 (2000).

S. Slokenberga (%4) Faculty of Law, Uppsala University, Uppsala, Sweden e-mail: santa.slokenberga @jur.uu.se

© The Author(s) 2021 11 S. Slokenberga et al. (eds.), GDPR and Biobanking, Law, Governance and Technology Series 43, https://doi.org/10.1007/978-3-030-49388-2_2 scientific research, the development of new medicinal products and devices is crucial. In the long term, personalised medicine bears the potential to deliver important changes in medicine as it offers hope for improving health care while also lowering costs. These advances are difficult to achieve unless solid foundations for biobanks are in place and research is furthered.”

When scientific research is conceptualised in terms of human rights, the link between biobanking and the right to enjoy the benefits of scientific progress and its applications emerges.* Even though the content of this right is still to be fully appraised,* it is clear that to enjoy the benefits of scientific progress and its applications, there has to be a benefit in the first place. Therefore, it is crucial that adequate circumstances are created to enable scientific progress to occur.

A coherent regulatory framework has long been seen as key to furthering scientific research and collaboration, within the EU, between the EU and third countries and among the third countries. As has been pointed out on many occasions,° the regulatory landscape is fragmented and this has been a challenge that needs to be tackled.’ The first EU legislation in the area of data protection, the Data Protection Directive, made a considerable contribution to shaping the data protection framework for scientific research. However, through foreseeing considerable room for national regulatory autonomy it created a divergent and fragmented lanscape. As will become apparent in this book, the General Data Protection Regulation (GDPR) does not seem to have a strong potential to rectify these divergences. It also has a predisposition to the fragmentation that stems from its DNA, which has already shown some far-reaching implications.

The aim of this chapter is to set out the conceptual foundations for this book. The hope is that it will provide insights into the EU’s interest in the area of biobanking and map out the research regime that has been built around the GDPR. To do this, it analyses the key concepts used in this book: biobank and biobanking, scientific research as undertaken under the GDPR, individual rights and public interest.

3As a human right, it is set forth in Article 27.1 of the Universal Declaration of Human Rights and Article 15 of the International Covenant of Economic, Social and Cultural Rights. Article 27.1 of UDHR states that ‘[e]veryone has the right freely... to share in scientific advancement and its benefits’. In a similar vein, Article 15.1.6 ICESCR states that ‘[t]he States Parties to the present Covenant recognize the right of everyone:... [t]o enjoy the benefits of scientific progress and its applications’.

“Among most recent contributions see Committee on Economic, Social and Cultural Rights, General comment No. 25 (2020) on science and economic, social and cultural rights (article 15 (1) (b), (2), (3) and (4) of the International Covenant on Economic, Social and Cultural Rights), E/C.12/GC/25.

> Slokenberga and Howard (2019).

°See, for example, Directorate-General for Research and Innovation (European Commission) (2012), pp. 46-48.

See, for example, Chen and Pang (2014), pp. 113-117. Furthermore, biobank governance remains also a regional challenge Kaye (2006), pp. 245-248. In that regard, solutions have also been sought, among which there is the Code of Conduct for international genomic research. See Knoppers et al. (2011).

Setting the Foundations: Individual Rights, Public Interest, Scientific Research... 13

Lastly, it shares some preliminary reflections as starting points for the analysis carried out in this book, namely on whether the research regime created within the GDPR, which entails the trade-off between the data subjects’ rights and adequate safeguards, is a means to further scientific research and ensure a high level of personal data protection in the EU legal order, and on the implications of such an approach for researchers, law and policymakers, research funders and other stakeholders.

2 EU and Biobanking: Building a Research Regime in the Data Protection Framework?

In Europe, historically, the competence to regulate biomedical research has to a considerable degree been placed at the national level, although often it has been exercised with due regard to the hard and soft law instruments in the international fora.® Except for such areas as clinical trials, in the area of biomedical research the EU has traditionally taken a back seat.? However, in biobanking, research is not merely about research regulation, which embraces such questions as the ethical recruitment of research participants and collection of human biospecimens, but also about data protection, which in the EU legal order is classified as a human right under Article 8 of the Charter of Fundamental Rights of the European Union (CFREU) and an area in which the EU has legislative competence under Article 16 of the Treaty on the Functioning of the European Union (TFEU). Against this backdrop, the GDPR, similarly to some degree to its predecessor the Data Protection Directive, faced a considerable challenge in how to effectively operationalise a fundamental right to data protection and further free movement of personal data whilst also accounting for the limits surrounding its competence in research set forth in Article 4(3) of the TFEU, and simultaneously furthering the EU’s objective of competitiveness in the global arena. Arguably, this tension and the legislator’s approach to tackling it is best captured in Recital 4 of the GDPR where it is explained that ‘[t]he processing of personal data should be designed to serve mankind’, and thereafter elaborated that the non-absolute nature of this right entails necessity to balance it against other rights in a proportional manner. Although some of the rights have been mentioned by way of illustration, neither freedom of sciences as protected under Article 13 CFREU nor health care as safeguarded under Article 35 CFREU is

$ For example, Council of Europe treaties, such as Convention for the protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine and its Additional Protocol to the Convention, concerning Biomedical Research, various recommendations in the field, as well as WMA Helsinki declaration, and CIOMS International Ethical Guidelines for Health-related Research Involving Humans.

°This, however, is undergoing changes. The Jn Vitro Diagnostic Medical Devices Regulation (applicable from 2022) contains provisions relevant to biobanking.

indicated. Nonetheless, as the GDPR scientific research regime structure suggests, these two aspirations are inherent elements of the GDPR.

Generally, for the EU, limitations to its competence have not been an issue. In fact, data protection, similar to other areas such as the framework for in vitro diagnostic medical devices, originated as a policy within the Internal Market.'° The factual circumstances were that at the time of the Treaty establishing the European Community the European Community’s general competence to regulate the Internal Market was deployed as a tool to develop policies within the Internal Market.'! With the Treaty of Lisbon, the circumstances changed and the data protection policy acquired its own legal basis in the Treaty.

This brief historical insight leads to an obvious question, namely, whether the EU’s competence in the area of data protection is now used to push for policies in the areas where the EU currently lacks the competence to adopt harmonisation measures. It is clear the GDPR establishes a research regime, which to some degree can be seen as research harmonisation through the back door: firstly, intra-EU; but secondly, through the extraterritorial clauses and data transfer rules, so also globally.” Yet, this acknowledgement does not come without a ‘however’. The GDPR is a sector-neutral legislation, but each research field comes with its own history and traditions. For example, the area of medical research has been influenced by the horrors of WWII, and the area of biobanking has faced some initial struggles to depart from the stringent rules surrounding research involving human beings.’ More recently, biobanking specific research governance measures have been adopted, such as the (revised) World Medical Association Declaration of Taipei on Ethical Considerations Regarding Health Databases and Biobanks (Taipei Declaration).'* In terms of competences, the national legal orders have retained varying degrees, and often these competences have been exercised differently, with due regard to the traditions, historical experiences, societal values and objects of public interest. Respect for this diversity was already afforded under the Data Protection Directive. With this background in mind, even if the EU might have possibly desired a different approach and was to assume the test for the limits of its interventions in the area where it lacks direct legislative competence, as the legislative history of the GDPR shows," this is neither easy to achieve nor realistic. In fact, awareness of the EU’s weakness in the field and the initially-perceived strength of the Council of Europe was demonstrated by an expert group on the ethical and regulatory challenges of international biobank research set up by the European Commission, where in the report “Biobanks for Europe. A Challenge for Governance’