Do we need a biobank law?

1 Introduction

Biobanks are today operated by many institutions for the purposes of medical research and therapy. As a rule, they do not only offer human biomaterials (such as tissue, blood, DNA, etc.), but also often provide numerous sociodemographic information about the respective donors of the materials. It goes without saying that this involves many legal issues, from data protection and general personality rights to contract issues (see Section 2). As many of these questions cannot be answered simply by looking at the codified law, the desire to regulate by law the set-up and operation of these collections of samples and the use of the materials and data stored in them was raised relatively early. In 2010/2011, this led to a first draft of a biobank law, which was later shelved in the ensuing period (see Section 3). Nonetheless, in 2015, some legal scholars again presented a so-called Augsburg-Munich draft for a bio-bank law (see Section 4). The General Data Protection Regulation (GDPR) adopted by the EU in 2016 could also give rise to the issue of the need to create a separate Biobank Act (see Section 5).

On the basis of their practical experience as legal advisors to biobank operators and the aforementioned approaches towards a biobank law, the authors seek to answer the question as to whether there is currently a real need for such a comprehensive biobank law or even legislative action on individual aspects (see Section 6). To begin with, they see such demand at best only to a limited extent.

2 Legal issues at biobanks

When human biomaterials, such as blood, tissue, cerebrospinal fluid, etc., are collected, processed, made available for internal or external research, and documented in donor-specific ways for biobanks, the associated actions of biobank operators and users of biomaterials raise a range of legal issues. These are only briefly outlined below.

Such questions arise already in the extraction of human materials and the collection of associated donor data. Through their separation from the body of the donor these materials become a “thing” within the meaning of Section 90 of the German Civil Code (BGB) (“things” within the meaning of the law are only corporeal objects). However, the donor of these materials remains their owner even after their removal from his body so that the operator of a biobank cannot easily make dispositions. Rather, this requires donors to grant ownership or at least rights of use to the materials obtained. As the donor’s general personality right continues to extend to the biomaterials that have been separated from his body, the donor is free to transfer his biomaterials to the biobank operator as “unencumbered” property or to impose certain conditions on his transfer of ownership (e.g. to exclude the use of the materials for specific purposes).

The donor’s general personality right also plays a role during the collection of data associated with the materials of the donor with respect to his right to informational self-determination, that is, his right to protection of his personal data under the rules of applicable data protection law. The latter, however, only comes into play if the donor becomes the “data subject” within the meaning of Art. 4 no. 1 GDPR, because according to the definition therein, “individual information on personal or factual circumstances” (=personal data) is collected, processed or used on the basis of which the donor is identified or identifiable as a natural person. If there is no element that allows data to identify a particular natural person or at least (with reasonable effort) for the possibility of identifying such a natural person (“identifiable” natural person), then data protection standards will not apply either. Increasingly, however, it is possible, with reasonable effort and using genetic evaluation of samples in combination with existing non-personal data from donors, to render such information at least “determinable”, which is why one must generally assume an obligation to observe data protection requirements in the context of a sample collection that also involves the collection of data. Genuine anonymisation in terms of data protection law is often no longer possible.

Outside of a specific treatment context of a patient, however, no statutory permission to obtain samples or to collect personal data from the sample donor is evident. If the collection of samples and data is to serve purposes that go beyond the respective treatment context or in any case is completely isolated from such context (e.g. participants in a scientific study), the operator of a biobank will have to obtain the consent of the donor in question if he wants to ensure that the collection of samples and data is legally compliant.

Generally, there is no explicit statutory permission that would allow for the requirement of obtaining consent to be waived. In particular, such permission cannot be derived from the fundamental right to freedom of research and teaching (Article 5(3) of Germany’s Basic Law=Grundgesetz) either, as in the context of the establishment and operation of biobanks, it comes into conflict with the fundamental rights of the affected donors to physical integrity and their general personality right – and freedom of research cannot take precedence over such rights. This conflict of interest is therefore solved in practice by informing the donors concerned about the purposes for which samples and data are collected and processed and thus obtaining the donors’ voluntary consent before taking the samples.

In the case of the consent solution, however, it will often be difficult to inform the affected donors, who are generally to be addressed as medical laypersons, comprehensively but in easy-to-understand language about the purposes and utilisation goals of biobanks and the samples and data collected. Such comprehensive and easy-to-understand information is essential, because only if “informed consent” exists the consent given in response to the information provided can be assumed to be effective. This is also logical, because only someone who understands to what he actually agrees understands the scope of his consent.

Following this basic principle of effective consent, it has been considered in the past that consent could always be given effectively only for specific research purposes. If these were not sufficiently substantiated, the consenting party would not be able to assess the scope of his consent, which would render the latter ineffective. On the one hand, this view fails to recognise that multiple sample collection and multiple data collection can be avoided by extending the scope of permitted uses by allowing what is generally known as “broad consent”. Incidentally, this also takes into account the principles of data avoidance and data economy. On the other hand, this view ignores the fact that ultimately it must be up to the consenting party to decide whether he deliberately waives detailed descriptions of possible projects and consents to the use of his samples and data in a context of research fields that are merely outlined in general terms (e.g. “used for cardiology research”). In the practice of research, therefore, the opinion has prevailed that “broad consent” obtained from the person concerned is also possible in the context of the establishment and operation of biobanks (a little more restrained and with further conditions: “Beschluss der 97. Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder zur Auslegung des Begriffs “bestimmte Bereiche wissenschaftlicher Forschung” im Erwägungsgrund 33 der DS-GVO“ of 3. April 2019).

However, Ethics Committees, in particular, see the need for a corrective element, which is implemented by giving data subjects a right to revoke their consent. Data subjects can exercise such a right (with future effect) at any time without giving reasons. This means that a data subject does not have to be bound by consent given previously, if, for example, he now believes that he cannot, or will not, support (any longer) the future research purposes pursued by the operator of a biobank. ^[1] In addition to this basically existing right of the person affected, further corrective elements must be added, such as the transparency of the biobank, the approval of an Ethics Committee for each individual research project, etc.

Meanwhile, legal questions continue to arise in the operation of bio-banks: on the one hand, with regard to internal organisational requirements (keywords: quality assurance, data protection concept), and on the other hand, with regard to the contractual arrangement of the relationship with cooperation partners (keywords: sample suppliers, merging of samples and data) and users (provision of samples and data).

As far as organisational requirements are concerned, there are now proven solutions that have also been coordinated with relevant specialist committees and supervisory authorities. ^[2] But also with regard to the contractual arrangement of the various relationships of an operator of biobanks, model texts that take into account both the interests of contractual partners (such as with respect to cooperation and provision of materials) and the legitimate interests of sample donors have been developed on the basis of the principle of freedom of contract. ^[3]

Beyond the organisational, data protection and contract law aspects, however, it is still being debated whether the concept of “biobank secrecy” should be introduced. ^[4] This is aimed, in particular, at professional secrecy required for all persons involved in biobanks in accordance with Section 203 of the German Criminal Code (StGB) and amended regulations of the German Code of Criminal Procedure (StPO); (keyword: protection against seizure). These legal aspects are still being discussed; immediate solutions are currently not foreseeable.

3 The first attempt towards a biobank law

A first attempt to create a biobank law was undertaken in November 2010 by the parliamentary groups ALLIANCE 90/THE GREENS and the SPD (Social Democratic Party of Germany). ^[5] ALLIANCE 90/THE GREENS based their initiative primarily on the fact that the Gene Diagnostics Act, which had been adopted not long before that, had a regulatory gap regarding the handling of samples and data that needed to be closed. They also explained that the personal rights of citizens required more appropriate and better protection with respect to the collection and use of genetic samples and data. But ALLIANCE 90/THE GREENS did not present its own bill and instead called on the Federal Government to introduce a bill that covered the following aspects: stricter purpose limitation in the use of samples and data in research; involvement of an Ethics Committee prior to the start of any research project; allowing for a patient’s/test subject’s global consent; ensuring comprehensive information before the collection of samples and data; improved pseudonymisation and anonymisation; destruction of samples and data upon achieving the research objective; information to data subjects about the research findings; and more.

The motion of the SPD parliamentary group went in a similar direction. According to this, the Federal Government’s bill for a biobank law was to regulate the following topics: a legal definition of the biobank; rules to ensure a high level of data protection in the processing of samples and data; clear criteria for auditing biobanks; the inclusion of Ethics Committees in the work of biobanks; procedural rules for the use of samples and data; regulation of minimum standards for the documentation of declarations of consent; an extension of the right to refuse to give evidence to employees of biobanks and a ban on seizure; criminal provisions for non-compliance with the provisions of the Biobank Act and others.

After a relatively short discussion in the Bundestag Committee on Education, Research and Technology Assessment, which dealt with the arguments of all parliamentary groups represented therein, ^[6] the committee voted to reject the two applications of ALLIANCE 90/THE GREENS and SPD. Which is what happened then. The Committee on Budgets and other committees of the German Bundestag also voted in the same way. The reason given was, above all, a lack of need for such a law. As is stated in Printed Matter 17/8873 on page 6, right-hand column: “At the moment, the Federal Government sees no need to initiate a specific human biobank law. The recommendations of the German Ethics Council could essentially be implemented on the basis of existing legal regulations. Furthermore, it will be examined, together with the German research community, whether the award criteria for project funding could be optimised in view of the high standards.” Thus, the first attempt to create a federal biobank law failed.

4 The Augsburg-Munich draft for a biobank law

A second attempt to launch a biobank law was initiated in 2015 by several law professors from the Universities of Augsburg and Munich. They published a small booklet, the so-called Augsburg-Munich draft for a biobank law. ^[7] The authors justify the need for such a law above all by the fact that the creation and operation of a biobank are subject to fundamental rights [essentially freedom of science under Art. 5(3) of the German Basic Law and the right to human dignity and physical integrity according to Art. 1(1) of the Basic Law and Art. 2(2) Sentence 1 of the Basic Law], which are to be reconciled with each other. ^[8] Therefore, they believe, the state must above all prevent the misuse of donated samples and the associated data of as well as discrimination against donors through regulations in a biobank law. ^[9]

As the purpose of the law, this is also repeated in Section 1 of this draft, followed by a discussion of several individual aspects in different sections: Definitions (Section 3), obligations to inform (Section 4), consent (Section 5), the possibility of revocation (Section 7), the protection and violation of biobank secrecy (Sections 8 and 9), as well as the licensing requirement for setting up a biobank (Section 10), regulations on data protection for quality assurance and documentation (Sections 12–14), the appointment of a biobank officer (Section 17), regulations as to what should apply when a biobank ceases its operation (Section 18), the establishment of a biobank registry (Section 19), and regulations on fines to be imposed if operators violate the provisions of the Biobank Act.

Certainly, the points or sections mentioned address the key issues that need to be considered and resolved when setting up and running a biobank. But does that require a separate bill?

Looking at the regulatory points in the bill, it quickly becomes clear that there are many aspects that have already been addressed in the day-to-day practice of biobanks. This applies, for example, to the duty to inform and to consent, for which the biobanks have developed tried and tested model texts in cooperation with the working group of the Ethics Committees and also the TMF. Proposals on data protection and data security were also developed by the TMF and agreed with the data protection officers. A biobank registry has long been established, and the future handling of samples and data in the event that a biobank ceases operations is usually set out in the legal basis for the biobank organisation (articles of association, partnership agreement). It would appear that the rules of the Augsburg-Munich draft were developed in “splendid isolation”, without considering what the bio-bank community had already developed on its own.

From the authors’ point of view, that leaves, as the remaining topos of the draft, only the institutionalisation of biobank secrecy, as well as a regulation in the Code of Criminal Procedure on protecting samples and data against being seized. However, this does not require a biobank law, but at best a selective addition to the Code of Criminal Procedure by the legislator in Section 97(1) No. 3 in conjunction with Section 53(1) Sentence 1 No. 3 of the Code of Criminal Procedure.

5 Biobanks and the General Data Protection Regulation (GDPR)

On 25 May 2016, the General Data Protection Regulation of the EU ^[10] entered into force, whose provisions apply from 25 May 2018. As the legal implications of the establishment and operation of human biobanks are not least influenced by data protection law, it is also important to take a brief look at the possible effects of the GDPR provisions on the biobank sector.

In particular, Art. 89 GDPR, which deals with the processing of personal data for scientific research purposes, bears mentioning in this context. It allows for derogations “from the rights referred to in Articles 15, 16, 18 and 21” insofar as “such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes” (Art. 89(2) GDPR).

The rights of data subjects to access, rectification, restriction of processing and data portability may therefore be restricted or excluded in a research context. It should be noted that the GDPR also allows national legislators to provide for such derogations or restrictions. The German legislator has made use of this opening clause in § 27 BDSG (Bundesdatenschutzgesetz) followed by the federal states with almost identical regulations of the respective state data protection laws.

Section 27 of the BDSG therefore permits the processing of special categories of personal data (e.g. health data), even without the consent of data subjects, for scientific research purposes under certain conditions. However, those conditions are very narrow, as legitimacy is established only “if the processing for these purposes is necessary and the interests of the controller with respect to the processing significantly outweigh the interests of the data subject in excluding the processing” (Section 27(1) S.1 BDSG). In addition, the controller (in this case, as a rule, the operator of a biobank) must ensure the technical, organisational and documentary measures provided for in Section 22(2) BDSG in order to safeguard the interests of data subjects. Generally, these conditions would likely create a situation where the consent of the data subject would still be required.

6 Opinion and conclusion

In conclusion, the authors of this paper consider the following to be worthy of note. Human biobanks are an indispensable and important tool for medical research. The German Ethics Council has comprehensively presented in its two opinions on biobanks the areas where there may be legal problems with the establishment and operation of biobanks. One of the main problems is the effective informed consent of the donor also in respect of future uses, which often cannot be clearly defined at the time the sample is submitted. However, a broad consent in connection with procedural framework conditions (obtaining an ethics vote, the possibility of revoking the consent at any time) seems to be sufficient from a data protection point of view. Therefore, the authors conclude (and as such in agreement with the German Federal Government, see German Parliament [Bundestag] Printed Matter 17/8873 of 29 June 2011, page 6) that there is still no need for a specific human biobank law. Instead, it is sufficient to implement the recommendations of the German Ethics Council on the basis of existing legal regulations. The research practice and its associations (such as the working group of the Ethics Committees and the working group on biobanks of the TMF) have developed pragmatic proposals as well as model texts that are now used by many active biobanks (see the TMF model texts at www.tmf-ev/Produkte/Uebersicht.aspx and there “Biobanken – Musterverträge”). From the point of view of the authors, at most, consideration could be given to “selective amendments or additions” to laws, such as extending to the activities of biobanks the prohibition of seizure in Section 97(1) No. 3 in conjunction with Section 53(1) Sentence 1 No. 3 of the German Code of Criminal Procedure. In times of comprehensive access by security authorities to any source of information, this may well be appropriate. However, the authors fail to identify any further need for a comprehensive biobank law. On the contrary, the model solutions and texts prepared by the biobank community seem to address all possible legal issues.