Discrepancies in biobank research regulations have commonly been regarded as one of the most significant hurdles for effective research collaboration. One of the more central aspects of biobank research regulation concerns the use of personal data—health and genetic data and other information related to individuals, either as individual research subjects or participants in a particular scientific study or as one of many in a registry. Accordingly, the adoption of the EU General Data Protection Regulation (GDPR) in 2016 and its applicability from May 2018 had been long awaited by the biobank community. Although the GDPR is not a research regulatory instrument, in the attempt to regulate personal data processing activities it creates a rather complex ‘research regime’, also known as ‘scientific research regime’ or ‘research exemption’, through which it shapes how scientific research in so far as personal data are concerned is regulated by the EU and could further be shaped either by the EU itself or the Member States. The GDPR sets forth stringent requirements for the processing of health and genetic data and a set of data subject rights and imposes considerable obligations on biobanks and researchers, while simultaneously allowing for considerable derogations, directly applicable or enabled through the Member State or the EU law, for the purposes of scientific research. Occasionally, further derogations from individual rights could be possible and other requirements apply if research can be regarded as in the public interest.

Article 89 is the central provision that regulates scientific research under the GDPR. It is also a key provision in enabling derogations from individual rights for the purposes of scientific research. Following operationalisation of Article 89, these derogations can be made by directly invoking the provisions of the GDPR on a case-by-case basis, as well as through the national laws of the Member States of the EU, as well as laws of the EU. Consequently, although the GDPR harmonises data protection requirements for resarch, and in that way contributes to the governance of biobanking, considerable divergences between requirements in different EU Member States could occur. Additionally, the Member States of the EU as well as the EU may address questions of public interest that could open up for further fragmentation. This room for divergence, while it offers flexibility for accommodating various standards and values, also creates uncertainty and poses questions about scientific collaboration and data sharing when different standards apply. One can therefore question whether the EU has built a platform upon which biobanking can accelerate or it has created a platform that allows for fragmentation of the regulatory landscape, and thereby creates risks of slowing down research collaborations and scientific advances.

In this book, a comprehensive approach is taken to determine how the GDPR affects the regulatory regimes on the use of personal data in biobank research in the EU Member States. The aim is to examine the GDPR research regime in biobanking starting with the research exception enabled through Article 89 GDPR. In order to achieve this aim, the book takes on two tasks: first, to scrutinize the GDPR research regime, its objective and constituting elements, impact on biobanking, as well as role in a changing EU landscape, especially post-Brexit arrangements; second, to review how various derogations have been operationalised nationally, and what challenges and opportunities this diversification can bring. It thereby captures the complexity GDPR creates for biobanking and sheds light on various approaches to tackling the challenges that have emerged.

More specifically, Part I sets the foundations for this book. The approach in this part rests on three main pillars, namely, the notion of individual rights, public interest and scientific research. In Chapter, ‘Individual rights, public interest and biobank research’, Santa Slokenberga maps out how biobanking has found its place in the GDPR and traces the main avenues of co-existence of these three pillars.

Biobanking is a field with well-established research ethics traditions in which the research ethics committees have a considerable role to play. In Chapter, ‘Striking a balance between personalized genetics and privacy protection from the perspective of GDPR’, Mats G. Hansson takes an ethicist’s perspective examines how Research Ethics Committees could balance the need for scientific research for scientific advances, on the one hand, and privacy protection, on the other hand, in the absence of clear guidance from law and policy makers. In his contribution, Hansson proposes three premises that could help balancing the aspiration to further research with the aim to ensure the study participants privacy protection.

Part II is devoted to the analysis of GDPR requirements for biobanking. In research, data access and data sharing are of paramount importance. One of the critical concerns is how to comply with the GDPR while still allowing for these two to occur. In Chapter, ‘Biobank governance and the impact of the GDPR on the regulation of biobank research’, Mahsa Shabani, Gauthier Chassang, Luca Marelli examine the governance models for accessing genomic and health data, and key tools and mechanisms to further compliance with the GDPR. It is clear the GDPR leaves considerable room for further governance interventions by policy makers to uphold good research practices, to ensure research is not hindered and to safeguard the privacy of research participants as sample donors and data subjects. These governance mechanisms need to be up to date in order to be able to mitigate risks and take advantage of the opportunities brought by new and emerging technologies.

In Chapter, ‘Biobank and Biomedical Research: Responsibilities of Controllers and Processors under the EU General Data Protection Regulation’, Ana Nordberg scrutinises key obligations biobanks and researchers face as controllers and processors. She also identifies key compliance challenges faced by biobanks as data controllers and processors, and discusses different compliance avenues. Furthermore, she highlights challenges that emerge in the area of biobanking as we move towards a data-driven society in which artificial intelligence and big data have a prominent role to play.

In Chapter, ‘Individual rights in biobank research under GDPR’, Ciara Staunton examines what rights the GDPR provides to the data subjects and their operationalisation in the area of biobanking. She takes a close look at each of the individual rights protected by the GDPR and considers their impact in biobanking. She argues that even though the individual rights in the GDPR are intended to give greater autonomy and control over the use of a data subject’s personal data, this may not necessarily be so in the area of biobanking. Not only might data subjects lack awareness about their data being processed, and hence be unable to protect their rights, but they might also be left with few, if any, enforceable rights as a result of different derogations. As a compensatory measure to ensure a high level of data protection, adequate safeguards are offered instead.

Anne-Marie Duguet and Jean Herveg in Chapter, ‘Safeguards and derogations relating to processing for scientific research: Article 89 analysis for biobank research’, scrutinize the requirement of adequate safeguards and argue that failing to comply with them could render the intended processing for scientific research purposes non-compliant with the GDPR. The GDPR might not appear overly generous in specifying what these safeguards could be but, together with the established research standardsand practice in the field, the authors have found it possible to highlight three elements: respect for the essence of data protection, proportionality and appropriate and specific measures to safeguard the fundamental rights of the data subjects. The authors put forward eight measures that could serve as appropriate safeguards and accordingly as tools to operationalise the generous research exemptions offered by the GDPR.

In Chapter, ‘Biobank Oversight and Sanctions under the General Data Protection Regulation’, Dara Hallinan examines the function and problems with the oversight and sanctions mechanisms outlined in the GDPR as they relate to the biobanking context. Hallinan has identified four types of oversight (ex ante assessment, prior notification and approval, ongoing oversight and general oversight) and two key types of sanction (liability and compensation sanctions, and administrative sanctions). Although these mechanisms are prima facie comprehensive, as Hallinan argues, they are not immune from critique. His chapter shows that problems appear in relation to the standard of protection provided for data subject rights, the disproportionate impact on legitimate interests tied up with the biobanking process—particularly genomic research interests—and their practical implementability in biobanking.

The requirements the GDPR sets forth apply to the EU Member States and the European Economic Area (EEA) states, and through extraterritoriality clauses to others targeting EU data subjects. It also sets forth stringent rules when personal data are being transferred to third countries. Brexit presents an interesting situation as on the one hand the UK is expected to leave the EU, becoming a third country for the purposes of data protection, but on the other hand the UK is a current Member State of the EU as of June 2020 and has adopted a national data protection framework in line with the GDPR. It could transpire that the EU Member States are required to comply with the GDPR through Chapter V rules, namely rules that address data transfers to the third countries or international organisations. In Chapter, ‘Brexit and biobanking: GDPR perspectives’, Andelka M. Phillips and Tamara K. Hervey provide insights into possible post-Brexit legal futures. In addition to illuminating possible scenarios Brexit poses for biobanking and highlighting the possible post January 31, 2021 scenario, this chapter also provides an insight into the situation for biobanking that any EU Member State could face if an analogue to Brexit occurs.

Part III, Chapters are focuses on how GDPR has been implemented in the selected EU Member States. Teodora Lalova, Anastassia Negrouk, Laurent Dollé, Sofie Bekaert, Annelies Debucquoy, Jean-Jacques Derèze, Peggy Valcke, Els Kindt and Isabelle Huys provide ‘An Overview of Belgian Legislation Applicable to Biobank Research and its Interplay with Data Protection Rules’. Mette Hartlev examines the ‘Balancing of Individual Rights and Research Interests in Danish Biobank Regulation’. Kärt Pormeister provides insights into the ‘Regulatory Environment for Biobanking in Estonia’. Tom Southerington scrutinizes ‘Access to Biomedical Research Material and the Right to Data Protection in Finland’. Gauthier Chassang, Michael Hisbergues and Emmanuelle RialSebbag examine ‘Research biobanking, personal data protection and implementation of the GDPR in France’. Nils Hoppe scrutinizes ‘The Regulation of Biobanking in Germany’. Olga Tzortzatou and Anastasia Siapka have provided ‘Mapping the Biobank Landscape in Greece’. Simone Penasa and Marta Tomas have examined ‘The Italian Way for Research Biobanks after GDPR: Hybrid Normative Solutions to Balance the Protection of Individuals and Freedom of Research’. Anne Kjersti Befring has provided insights into ‘Norwegian Biobanks: Increased Complexity with GDPR and National Law’. Carla Barbosa and Andreia da Costa Andrade have offered ‘Biobanks and GDPR: a look at the Portuguese panorama’. Carlos M. Romeo Casabona has offered insights into ‘The new European Legal Framework on Personal Data Protection and the Legal Status of Biological Samples and Biobanks for Biomedical Research Purposes in Spanish Law’. Finally, Magnus Stenbeck, Sonja Eaker Fält and Jane Reichel have provided insights into ‘Swedish law on Personal Data in Biobank Research: Permissible but Complex’.

These country studies have several common central pillars. They begin by providing an overview of the biobank infrastructure and regulatory environment in the respective country. In particular, they cover issues such as what types of biobanks are there in their respective countries, how biobank research is regulated, how individuals are involved in the sample collection and what procedures are being followed, what are the oversight bodies in the field etc. Thereafter they examine the approach to individual rights and safeguards in the respective national legal order and assess how the rules work in practice and how the balance between individual rights and development of science is struck in the country. Finally, they reflect on the GDPR impact and future possibilities for biobanking, and cover other issues that have been of relevance, such as reflections on the biobank and research governance, the capacity building and sustainability and the collaboration challenges, in the respective country’s settings.

In the final Part IV, some conclusions are drawn to the central question this book set out to examine; the impact of the GDPR in the area of biobanking.

In Chapter, ‘Biobanking Across Europe post-GDPR: A Deliberately Fragmented Landscape’, Olga Tzortzatou and scholars representing 19 countries, namely Teodora Lalova, Anastassia Negrouk, Laurent Dollé, Sofie Bekaert, Annelies Debucquoy, JeanJacques Derèze, Peggy Valcke, Els Kindt and Isabelle Huys (Belgium); Radek Halouzka (Czech Republic); Maja Šutalo (Croatia); Mette Hartlev (Denmark); Kärt Pormeister (Estonia); Tom Southerington (Finland); Gauthier Chassang, Michael Hisbergues and Emmanuelle Ria l-Sebbag (France); Nils Hoppe (Germany); Olga Tzortzatou, Anastasia Siapka (Greece); Katharina Ó Cathaoir (Ireland); Simone Penasa and Marta Tomas (Italy); Ruth Vella Falzon (Malta); Evert-Ben van Veen (the Netherlands); Anne Kjersti Befring (Norway and Liechtenstein); Jakub Pawlikowski, Dorota Krekora-Zajac and Lukasz Kozera (Poland); Carla Barbosa and Andreia da Costa Andrade (Portugal); Carlos M. Romeo-Casabona (Spain); Magnus Stenbeck, Sonja Eaker Fält and Jane Reichel (Sweden); and Santa Slokenberga (Latvia) take a comprehensive insight into the fragmented landscape that GDPR has created. It reviews the biobank regulatory environment; whether and how derogations under Article 89(2) GDPR are enabled; the legal basis for scientific research and the role of consent in biobanking post-GDPR; the balance between individual rights and public interest in national law; and finally, GDPR impact and future possibilities for biobanking. In the conclusion, this chapter underlines the importance of research ethics committees and the coalition regarding data flow or exchange issues, among the several ongoing sector-specific initiatives for Code of Conducts.

In Chapter, ‘Allocation of Regulatory Responsibilities: Who Will Balance Individual Rights, the Public Interest and Biobank Research Under the GDPR?’, Jane Reichel takes a bird’s eye view of the situation and reflects on the allocation of regulatory responsibilities for research under the GDPR. The question is what legislator will in the end perform the balancing of the competing interests of individual rights, the public interest and biobank research? An analysis is given of the division of powers within the regulatory space created by the GDPR in relation to the processing of personal data for research; the legislative competences of the EU and the space left to the Member States. Further, international obligations within bioethics are taken into account. Building on the analysis presented throughout the book, it is concluded that the GDPR has not fulfilled its aim to diminish regulatory fragmentation in regard to processing of data within biobank research. Two mechanisms of overcoming fragmentation in practice are discussed; via forum shopping and via administrative cooperation and soft law tools provided by the GDPR. The conclusion of the chapter it is while forum shopping in ethical issues might be problematic, it is more likely that unity could be brought by the later, administrative cooperation and soft law tools. Even though these tools lack the democratic legitimacy of statutory law, as the law stands today it may be the best we can hope for.

The editors would like to acknowledge the contributions of BBMRI-ERIC in meeting the research goal of the comparative analysis in chapter ‘Biobanking Across Europe post-GDPR: A Deliberately Fragmented Landscape’. In the context of the H2020 project ADOPT BBMRI-ERIC (GA No 676550), BBMRI-ERIC, the research infrastructure for biobanking, set up a first screening table based on which national laws were screened for further details relating to operationalization of the GDPR in the national context. For the purpose of this book project, the table was further adapted and enlarged beyond the member states of BBMRI-ERIC. To date, it consists of 20 member states and one international organization. Among other things, its ELSI Services and Research unit provides guidance on ethical, legal and societal aspects relevant for facilitating access to Pan-European biobanks. Several authors of this book are affiliated to BBMRI-ERIC or its National Nodes in various capacities.Footnote 1

Finally, on behalf of the editors team, we would like to thank Nick Cleary for his help with the editing the text and BBMRI-ERIC for covering the open access fee.