Biobanks and GDPR: A Look at the Portuguese Panorama

Abstract

The need for the existence of biobanks for health research purposes is something of which government authorities have been aware for several years. One year after the full entry into force of the GDPR, the Portuguese legislature has finally passed the law that ensures the full implementation of the data protection regime’s points left open by the European legislature. However, Portugal has also in place a range of legislation regulating the establishment and functioning of biobanks. The regulation of biobanks for research purposes imposes special protection duties on scientific research activity in which biological samples and associated data are used in order to guarantee protection of privacy and confidentiality.

1 Introduction

Medical research is recognized vital in enabling general improvement of citizens’ health through progress achieved by medicine. Nonetheless, the benefits are not immune to the risks inherent in the indispensable intervention of human beings, either by the provision of biological samples or by the mere sharing of personal data. Prevention of risk and possible damage entails compliance not only with the principles and rules elaborated by the scientific community, but also with technical and clinical rules, and respect for the dignity of the human person (as the overriding principle of the international legal order) and its various dimensions.

The guiding and conforming principles for the treatment of biological samples and the personal data of participants in scientific research studies are derived from the conjunction of the provisions set out in the Convention 108 of the Council of Europe, of January 28, 1981; in the UE Regulation 2016/679 of the European Parliament and the European Council, of April 26, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereafter GDPR); but also in national law as article 26°/1, article 35° and article 73°/4 of the Constitution of the Portuguese Republic (hereafter CPR); Law n° 21/2014, of April 16, and repealing Law n° 73/2015, of 27 July, Law on Medical Research (hereafter LMR); and the Law n° 12/2005, of 26 January, on personal genetic data and health data, as well as the regulation thereof made by Decree-Law n° 131/2014, of August 29.

Given the aforementioned legal framework, and the guiding principles, one year after the full entry into force of the General Data Protection Regulation (GDPR), the Portuguese legislature has finally passed the law that ensures the full implementation of the data protection regime’s points left open by the European legislature. Law n. 58/2019, from August 8th, that ensures the implementation, in the national legal order, of Regulation (EU) 2016/679 of the Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal and free data circulation of this data.¹ The long period without national laws adopted to adapt personal data protection norms to the Portuguese reality largely affected the development of scientific research, in that on the one hand most projects entail analysis of data and biological samples, in the absence of a safe, conclusive regulatory framework, and on the other hand they rely on EU funding which required the resolve and the guarantee of compliance with national and EU norms on data protection, thereby putting Portuguese researchers at a disadvantage vis-à-vis their counterparts. There is still ongoing discussion about the national law adopted.

Meanwhile, precisely in light of the untouchable value of the dignity of the human person, the Portuguese legislature considered it lawful to impose special protection duties on scientific research activity in which biological samples and associated data are used. The purpose of regulation is to ensure that scientific research into human health is conducted in a transparent way and in accordance with ethical standards, promoting its excellence and credibility as well as the protection of society and the individual. Draft Law n° 142/XIII,² which aims at approving the legal framework for the harvesting, processing, analysis, provision and destruction of human cells (stem cells included) and tissues for scientific purposes, although it has expired it should be discussed again.

2 Biobank Infrastructure and Regulatory Environment

2.1 General Remarks

Portugal has in place a range of legislation regulating the establishment and functioning of biobanks. There is legislation in force to regulate stem cells biobanks,³ biobanks for criminal and civil purposes,⁴ and biobanks (so called bio data banks) for health care provision, including disease diagnosis and prevention, and basic or health research.

2.2 Legal Framework

To biobanks for research purposes we are applying Law n° 12/2005, of January 26 (hereafter Law 12/2005) repealed by Law n° 26/2016, of August 22, and regulated by Decree-Law n° 131/2014, of August 29. Article 19/1 of Law 12/2005 defines biobanks as ‘any repository of biological samples or their derivatives, with or without limited storage life, whether using prospective harvesting or previously harvested material, or being obtained as part of routine health care, whether in screening programmes, or for research purposes, which must include personally identified, identifiable, anonymized or anonymous samples’.

For a biobank to be created, prior authorization is needed from an entity duly accredited by the department in charge of the protection of health (Law 12/2005). Until the application of General (EU) Data Protection Regulation,⁵ in May 25, 2018, prior authorization of the National Data Protection Commission was required too, to the extent that personal data were involved. Currently, therefore, these entities (i.e. the biobanks) are mostly under the regulatory authority of the Health Authority and the National Data Protection Commission. However, full compliance with the legal requirements also entails a favorable opinion from the Ethics Commission.

2.3 Collection of Samples

Once biobanks are lawfully established, their functioning is subject to tight rules, especially with regard to consent. Collection of biological products and the taking of DNA samples for genetic testing must be the subject of separate informed consent for the purpose of medical tests and for research purposes stating the purpose of the collection and the shelf life of samples and products derived from them.⁶ In other words, purpose determines the use of the sample obtained and included in the biobank.

A sample obtained and incorporated into a biobank for medical purposes cannot be used for research purposes, save in cases where retrospective use is possible, as we will see below.

Informed consent shall be in writing, and it is required to get and use the material in a bank of biological products; in the written consent form, the purpose of the biobank, the person responsible, the types of research to be undertaken, potential risks and benefits, conditions and duration of storage, measures taken to ensure privacy and confidentiality of the persons involved and the provision as to the possibility of communicating or not the results obtained with this material, must be stated (article 19°, n° 5 of Law 12/2005). Hence, it is necessary to obtain two consents: a first consent to obtain the biological sample, and a second one to inclusion of that sample in the biobank.

The law that ensures the implementation, in the internal legal order, of GDPR, provides in article 31°/4 that the general rules on consent provided for in the GDPR shall apply, in that such consent may cover several areas of research, and the ethical standards recognized by the scientific community must be respected. This is an opening vis-à-vis the specificity previously required, and one that will have a huge impact on the development of scientific research in the field of health.

Consent to inclusion in the biobank may be revoked at any time. Consent may be withdrawn at any time by the person to whom the biological material belongs or, after his/her death or disability, by his/her family members, in which case the biological samples and stored derivatives must be destroyed for good (article 18°/3 of Law 12/2005). At stake here is the application of the fundamental medical principle—the patient’s self-determination—to the holders of the samples incorporated into a given biobank. It is always (or almost always) the subject of that sample who agrees to withdraw the sample, or include the sample in the biobank, or revoke consent to include that sample in the biobank.

In exceptional cases, consent may be waived. This occurs in those situations—which we have already mentioned—where retrospective use of samples is made, or in special situations where the consent of the persons concerned cannot be obtained due to the amount of data or individuals, their age or other comparable reason; the material and the data can be processed, but only for scientific research purposes or the collection of epidemiological or statistical data (article 19°/6 of Law 12/2005). The fact that this situation is provided for in the legislation is of paramount importance for health research using biological samples, especially in research cases with secondary use of samples, that is, samples collected for use in a given research, a use that proves relevant to further research not covered by the original consent.

The fact that someone agrees that their biological sample is incorporated into a biobank does not mean that s/he loses the possibility of exercising any rights over that sample. In fact, the law establishes that stored biological material is considered property of the person from whom it was obtained or—after his/her death or disability—of their relatives, and should be stored as long as it is of proven use for current and future family members (article 19°/13). In other words, despite being delivered to a biobank, the sample still never ceases to be the property of the person who has delivered it. This raises another issue directly related to it. In the case of information relevant to the health of the individual who yielded the sample (for research purposes) being discovered during the research process, should this information be communicated to him/her? It is our contention that this should always be taken into account when consent is sought, and the person who provides the sample and gives consent should inform the researchers whether or not s/he would like to be contacted, in the case of information that is relevant to his/her health is discovered—incidental findings. The law pointed in this direction by providing that, if the bank has personally identified, or identifiable samples, and if the possibility of reporting results of the studies carried out is provided, a medical expert in genetics must be involved in this process (article 19°/12).

2.4 Regulation of Biobank Research

Another aspect of great importance in the regulation of biobanks for research purposes in Portugal is the protection of privacy and confidentiality. The storage of personally identified material should be avoided by controlling access to collections of biological material, by limiting the number of authorized personnel to do so, and by ensuring its safety with respect to loss, alteration or destruction. In this regard, and similarly to what happens with respect to the current legislation on protection of personal data, the use of anonymized biological samples is required. Article 19° states in this regard, that only anonymous or irreversibly anonymized samples may be used, and the personally identified or identifiable samples should be limited to studies that cannot be done otherwise (n° 9). It also stresses that if there is an absolute need to use personally identified or identifiable samples, they should be coded, with the codes being stored separately, but always in public institutions (n° 11). In this connection, it is very interesting that article 19°/10 here provides for the impossibility of storage of non-anonymized (identify or identifiable) human biological material by commercial entities. It is also interesting to note that for several years, until the entry into force of Law n° 12/2009, of March 26, there was in Portugal a ban on stem cell biobanks which had a double mission—health care and research—and entirely owned by private entities; precisely because of this legal provision, these for-profit, private entities used do store personally identified biological samples. This situation ceased to exist with the entry into force of the aforementioned legislation in 2009, as stocks of stem cell biobanks owned by for-profit, private entities became permitted.

Although at no point does it refer to the legislation in force on the subject, the draft law on the legal framework for the harvesting, processing, analysis, provision and use, storage and destruction of human cells and tissues for scientific purposes, including stem cells, that was under discussion at the Assembly of the Republic, maintains the general principles, while introducing some innovation in relation to the requirements of the establishment of the biobank, in particular as regards its sustainability. In fact, article 18° of the draft law lists a dense set of requirements for the establishment of a biobank for scientific research purposes, which if it is approved in its current version (there is an expectation to be presented again in this version), will determine the elaboration and submission to the (still to be created) Committee for the Coordination of Research in Human Cells and Tissues, of a strategic plan of operation and medium term financial viability.

And this, of course, in addition to the descriptive document of the purposes of the bank, the characteristics of the collections and inclusion criteria of the samples, as well as the organic and operating regulation of the bank, and the strategic plan of operation and medium term financial viability, and the terms of consent and information to the donors.

2.5 The Portuguese Biobank Landscape

Over the last decade, we have witnessed a proliferation of these infrastructures in Portugal, with numerous biobanks dedicated to research. We find very different examples: some biobanks are larger and some of a smaller size, some dedicated to a specific pathology and some to several. Given their relevance we will give here four examples: two national biobanks (of particular note, due to their size in a country like Portugal), a network of tumor banks and a consortium of biobanks.

The biobank of the Oporto University Institute for Public Health (Instituto de Saúde Pública da Universidade do Porto—ISPUP) is in place for almost two decades. With over 200,000 samples, this is a pioneer structure in Portugal, the biobank was created to be useful for research in the area of determinants of human health, and focus on relatively frequent conditions in the general population, such as diabetes, cardiovascular disease, rheumatic diseases and cancer or obesity, and behavioral disorders. The biobank of ISPUP has an immense amount of data from the participants of four Portuguese population cohorts (longitudinal studies that assess the evolution of population health over time), spanning different generations: EPIPorto (Oporto’s adult population), EPITeen (Oporto’s young adults) Generation XXI (Oporto’s children) and Bitwin (twins), and also cross-cutting samples representative of the Portuguese continental population. These samples preserved in the biobank are linked to data on an immense diversity of variables such as socioeconomic class, housing, food, cognition, among others.

The biobank of IMM, a structure created by the Institute of Molecular Medicine (IMM) within the Lisbon Academic Center of Medicine (CAML), about 6 years ago, which hosts and stores a collection of biological samples, voluntarily donated, with the aim of boosting biomedical research. Currently with thousands of samples (200,000, approximately) and their clinical data, the IMM-Biobank is a unique platform of technical support for research into the origin of diseases with a major impact on public health, such as cancer or osteoporosis. The IMM-Biobank collects samples in several ways. Through people who spontaneously donate their samples, or, for example, in the case of patients, samples are collected mainly in hospitals, at the proposal of a doctor, which is then examined by an ethics committee.

Subsequently, collections of biological material are coded with a separate number to safeguard the identity of their donor. The biobank of IMM CAML currently comprises 14 collections in areas as diverse as Neurology, Rheumatology, Orthopedics, Oncology, Cardiology, Endocrinology, among others. The IMM CAML Biobank creates conditions for the study of the pathogenesis of several diseases with a huge impact on human health, making it possible to identify new diagnostic and prognostic tests, as well as new therapeutic targets. It should be noted that the IMM-Biobank is part of the BBMRI—European Network of Biobanks.

Another very interesting example is the National Network of Tumor Banks (RNBT). ‘A Tumor Bank (TB) is a particular type of biobank consisting of the organized collection of tumor samples (neoplasias), which may comprise non-neoplastic tissue. The purpose of a TB is to record this type of material and the associated data (epidemiological, clinical, anatomic-pathological and molecular), under ideal conditions for biomedical research. The availability of this type of material, when collected under optimum conditions, allows the development of translational research and the application of basic biomedical research knowledge to clinical problems’.⁷

Finally, we should also mention the existence in Portugal of a consortium of biobanks: Biobanco.pt. It is a biomedical research infrastructure that aims to maximize national and international scientific collaboration based on the use of human biological samples and their clinical data.⁸ It presents as its commitments the following: (i) facilitate access to high quality biological samples and related clinical data; (ii) standardize the infrastructures, and the procedures of existing biobanks such as the processing and storage of the samples, to ensure quality; (iii) share resources and services so as to promote a global characterization of the sample as well as knowledge exchange; and (iv) assist the development of the BBMRI platform, fostering Portuguese participation in the infrastructure (BBMRI-ERIC.pt).

3 Individual Rights and Safeguards

In the national legislative framework set out above, a definition of scientific research that meets the demand in Recital 159 of the GDPR, is not offered in clear and distinct terms. Although a definition of scientific research that spells out the scope of the concept is not advanced, the legislator uses the concept in the normative stipulations pertaining to the theme, as in the case of Article 19°/3 of Law n° 12/2005, which limits the establishment of biobanks (or to use the legal expression: biological product banks) to the purpose of health care provision, and basic or applied health research.

Recital 159 of the GDPR sets out in general terms the characteristics of data processing for scientific research purposes, including technological development and demonstration, the fundamental and applied research as well as privately funded research. The national legislature has acknowledged that the GDPR leaves open the possibility for each Member State to establish weighting standards where data processing for scientific research purposes is concerned, and the legislature considered it appropriate to enshrine specific standards in this area. Article 31° of the law that ensures implementation of the GDPR in the national legal order, while not exclusively focused on the subject of the protection of personal data in the context of scientific research using biological samples, here discussed, refers it without providing a definition, nor detailing what should be considered scientific research; still, it goes on recognizing that ‘treatment for scientific research purposes shall respect the principle of data minimization and include the anonymization or pseudonymization of the data, provided that the objectives can be achieved by one of these means’.

Within the framework of the GDPR, the national law also states that in these cases, ‘rights of access, rectification, limitation of treatment and opposition provided for in articles 15°, 16°, 18° and 21° are inhibited, where the exercise of those rights has become impossible, in particular in the event of anonymization of the data collected’, or is likely to seriously jeopardize to achieve the purposes underlying the processing of the data. The national law further states that ‘the general rules on consent, as provided for in the GDPR, apply [to data processing for scientific research], considering that it may cover several research areas, and the ethical standards recognized by the scientific community must be complied with’. In this context, it should also be noted that the national legislature has made no distinction between public sector—or private sector-funded data processing for scientific research purposes, thereby demonstrating the unwillingness to develop the crux of the matter, to wit: public interest linked to scientific research.

In the national law, the national legislature does not develop in sufficient detail the concepts of personal data or pseudoanonymization, in that they are referred as set out in Article 4 of the GDPR. While it is true that the previous legislation, now repealed, defined in the exact terms of the directive that transposed the concept of personal data, the new proposal does not deal with this particular aspect, limiting itself to stating that ‘treatment for scientific research purposes should comply with the principle of data minimization’—without expanding further on the concept—and to ‘include their anonymization or pseudonymization where the aimed ends can be reached by one of these ways’, in Article 31° thereof, included in a chapter that seeks to summarize all specific situations of processing of personal data. It is true that the scientific community and researchers from the various centers and areas of biomedical research have long resorted to the coding technique as a safe and efficient means to protect participants’ privacy while still promoting satisfactory results in the studies developed on the basis of samples and data collected and processed.

The clause in Article 5(b) of the GDPR is critically important in particular in the health care research sector, as it admits that further processing for record purposes in the public interest, or for scientific, historical research or statistical purposes, is not considered to be incompatible with the initial purposes, in accordance with Article 89(1).

Article 5(1)(e) of GDPR states that personal data must not be kept in a form which permits the identification of subjects for no longer than is necessary for processing purposes. However, an exceptional clause has been added concerning data processing for scientific research purposes, which allows personal data to be kept for longer periods, in accordance with Article 89(1), although they are subject to the application of appropriate technical and organizational measures to safeguard the rights and freedoms of the data subject.

While debatable whether this is a real exception or an additional constraint regime, the Portuguese legislature has only put forward a general proposal as to the data retention period. In Article 21° of the law on adaptation to the GPDR, the legislature makes the period of retention of personal data dependent on a legal stipulation or imposition or, in cases where by the nature and purpose of the treatment, it is not possible to determine in advance the time when it is no longer necessary, the preservation of personal data for an unlimited period is lawful. This might clearly be the case with medical scientific research.

GDPR Articles 4(1), 11 and 7, articulate a concept of informed consent that is based on a free, specific, informed and explicit manifestation of will, through which the data subject accepts, by means of a declaration or unequivocal positive act. However, Recital 33 admits that it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognized ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose. We have already referred the primary character of Informed Consent in the development of scientific research based on the processing of personal data, health data, and especially genetic data and biological samples. Hence, it will suffice here to highlight the requirement made by the Portuguese legislature in the draft law on the regulation of biobanks for scientific research purposes.

In accordance with Article 5° of that proposal, donors should be informed in advance, in a manner suitable to their level of literacy, in writing, of the objectives of the collection, the research to be carried out, the known benefits and risks inherent in the procurement of cells and tissues of human origin for the purposes of scientific research, as well as their ethical, social and legal implications, storage conditions, confidentiality and access, as well as the conditions for alteration or destruction of samples. Therefore, the validity of informed consent has not been restricted to a defined area or study, as provided for in the legislation still in force.

Prohibition in principle of the processing of sensitive personal data such as health data, genetic data and biometric data, is subject to the exceptions in article 9 (2), with special focus on the provisions in paragraph i), according to which the processing of the aforementioned data is permitted if the processing is necessary on public interest grounds in the field of public health. In this respect, legal, European or national provisions ensuring appropriate and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy, are required, as already mentioned in Recital 156.

In this particular point, Law of Public Health Surveillance System, governs in Portugal. It establishes a public health surveillance system that identifies risk situations, collects, updates, analyzes and disseminates data on transmissible diseases and other public health risks, as well as prepares contingency plans in the event of emergency situations, or as serious as those of public disaster.⁹ This system replicates the guidelines of the World Health Organization (WHO) in the control of compulsory notifiable diseases by collecting data to fulfill the obligations falling within the scope of the national and international epidemiological surveillance competences.

Also with regard to the treatment of sensitive data, such as genetic and biometric health data, the GDPR allows Member States to determine new conditions or limitations. In the bill that was under discussion, the Portuguese legislature merely cited the principle set out in the regulation, without further ado on this.

Normally, data processed for scientific research purposes are not collected by researchers, but rather communicated by an entity (health care provider or other) who reports them without any identification, as this is not relevant to the success of the study. In compliance with the principle of minimization, Article 11 of GDPR allows the maintenance of such treatments without connection with the identification of the data subject. In the same vein, the national law on the implementation of the GDPR in Portugal provides in article 31° of the discussed draft, that treatment for record purposes in the public interest, and for scientific research purposes, should comply with the principle of data minimization, limiting itself to the data essential for the success of the study, and include anonymization or pseudonymization of the data, where the objectives can be achieved by one of these ways. This is certainly the best privacy by concept strategy.

In cases where the personal data were not collected by the person in charge of processing them—i.e. the researcher, for the matter at stake here—and where it is possible to identify the subjects, the reporting obligations set out in Article 14 of the GDPR will not apply, as this would constitute a disproportionate effort for researchers. However, protective measures will have to be taken, and measures that in some way materialize the transparency advocated in the legal statement, such as the publication of the study.

It is also important to highlight the provisions of Article 31°/ 2 of the law that adapt the GDPR norms, according to which ‘where personal data are processed for purposes of record in the public interest, scientific or historical research or official statistical purposes, the rights of access, rectification, limitation of the processing and opposition provided for in GDPR articles 15, 16, 18 and 21 of the are undermined where the exercise of those rights has become impossible, namely where the data collected are anonymized, or liable to seriously undermine the attainment of those objectives’.

In with the possibilities for exceptions in GDPR, the Portuguese legislature did not recognize data subjects within the scope of scientific research purposes as being entitled with the right to be forgotten, Article 17 GDPR.

4 Law in Context: Individual Rights and Public Interest

At the moment of the establishment of a biobank and during the management performance process, in the overwhelming majority of cases the public interest and markedly individual values and interests are pitted against each other, as if they were antagonistic realities. Still, it is possible to strike a balance between science development and individual rights by means of a legal regime that, fully compliant with the primacy of the dignity of the human person, provides the scientific community with the right conditions for the development of scientific research activity, thus opening the way to generate new knowledge in the health area that will ultimately benefit individuals in the civil community.

With the new draft law on the establishment of biobanks for scientific research purposes, the Portuguese legislature sought a balance solution between the injunction to strengthen research institutions and scientific output, as well as boost innovation and the development of new products and processes by the institutions that in Portugal are dedicated to scientific research and technological development in those areas. And the requirements that scientific research in human health be carried out in a transparent manner, in accordance with ethical principles, which promotes its excellence and credibility as well as the protection of society and the individual.

To this end, it sought to establish the legal framework for the collection, processing, analysis, distribution and use, storage and destruction of cells and tissues of human origin for scientific research purposes, including stem cells, based on the principles of Autonomy, Vulnerability, Scientific Integrity, Confidentiality, Gratuitous donation of samples of human origin, Non-discrimination and Non-stigmatization, which together conform and apply the principle of the dignity of the human person (Article 3° of the bill).

The bill sets out that in practice the establishment and management of the biobank to be created under the terms of the draft law under consideration will be previously controlled by the National Data Protection Commission (CNPD), and also by the Commission for Coordination of Research in Human Cells and Tissues, still to be created.¹⁰ In addition to technical requirements regarding infrastructure conditions and storage of samples and associated data, these entities will assess the other requirements directly associated with the rights of subjects of samples and data kept in the biobank. For this, ethical and legal standards will be mobilized, namely those in the GDPR as well as in the Law of Personal Genetic Information and Health Information, approved by Law n° 12/2005, of January 26, regulated by Decree-Law n° 131/2014, of August 29, with a special focus on the rules of conformation of Informed Consent, and regarding measures for the protection and organization of the data.

Concerning this point, the legislature can only determine how the various laws dealing with the collection and preservation of samples and personal (health and genetic) data will be combined, especially in conflicting norms. For example: Law 12/2005 lays down in Article 19°/10 the ban on storage of non-anonymized material by for-profit private entities, even if the samples are intended for scientific research. However, the draft law that was under discussion is mute on this point, always referring to entities and public or private repositories.

Still in the framework of the protection of individual rights, the Portuguese legislature innovated vis-à-vis the previous legislation in that it lays down a set of guarantees, with emphasis on the requirement to present a strategic plan of financial viability in the medium term (Article 18°/4 c) of the draft law), and also periodical control (Article 20°) and rules for the extinction of the biobank (Article 19°/2).

5 GDPR Impact and Future Possibilities for Biobanking

Most biobanks have a personal database aggregated to the biological samples repository. These infrastructures are therefore subject to rules not only on biobanks legislation but also on the protection of personal data. This was the case before the application of the GDPR started; however, it is now clearer, in the sense that the Regulation explicitly refers biobanks. In terms of national law, the law that will operationalize the application of various aspects related to the GDPR makes no reference to biobanks. Moreover, the bill is also very parsimonious with regard to the provisions concerning research using personal data, almost doing a transposition of what is laid down in the Regulation.

The only distinguishing aspect that the Portuguese case may bring is that it provides for a vacatio legis of three years for public institutions. That is, for the latter the application of the rules of the GDPR will not begin on May 25, 2018, having instead an additional three year period to adapt, after the entry into force of the Portuguese law. Considering that most (or at least the largest) biobanks for research purposes in Portugal are dependent on public institutions, this would mean that the GDPR rules do not apply to them. This, in our view, does not favor these infrastructures, considering that the GDPR is clearer and facilitates research using personal data.

Thus, apart from this aspect—the creation of a double scheme for the private sector and the public sector—the application of the GDPR in Portugal will not bring major differences regarding research using biobanks with personal data.

We believe that research will be easier, but this will be the result of greater permissiveness in research—a result stemming from the Regulation itself, and is not tied to Portugal alone.

The new regulation seems to have adopted principles which, at first sight, facilitate the pursuit of scientific research using personal data. Personal data for research purposes may be defined as ‘the generation of knowledge about human populations through scientific and/or statistical methods, which does not need to contribute to the common interest, through the determination of new insights in a particular field of research’.¹¹

From a practical point of view, the Regulation continues to establish a clear preference for conducting scientific research using anonymous data to establish that, if the purpose of the research can be achieved through this type of data; in such case this ‘can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects (paragraph 1)’. However, where this is not possible, the pursuit of scientific research is possible with the use of personal data, provided that adequate safeguards are adopted in accordance with the Regulation itself. Those safeguards include technical and organizational measures to ensure respect for the principle of data minimization (i.e., appropriate processing which is relevant and limited to what is needed for research purposes) which includes the pseudonymization explicitly mentioned in GDPR Article 89 (1) that we will analyze below.

A comparison with the 1995 Directive shows a number of differences worth being reported. While the Directive adopted a more conservative stance by establishing the general principle of prohibiting personal data processing for scientific research purposes and only allowing it to be carried out through case analysis and the corresponding authorization from the regulatory authorities of each Member State,¹² the new regulation allows such research to be carried out. It does demand the adoption of such appropriate safeguards. In this regard, one difference between the two texts that we should point out is that the Regulation expressly refers pseudonymization as an appropriate measure, whereas the Directive never mentions this process.

Nevertheless, we think that the new Regulation establishes a general principle, in theory more favorable to research. However, there are points that only practice shall clarify the way Member States will be applying it. Therefore, the derogation of the rights of access, rectification, opposition and limitation on processing is unclear and has not been implemented. It can also be left to each Member State’s discretion. The expression used is ‘Union or Member State law may provide for derogations’. The question that remains unclear is: ‘In what form? And what about consent? Is it possible to talk about broad consent?

The recital 33 of the Regulation does meet researchers’ actual needs. Personal data are often collected for health research purposes, but the specific area of research is not actually identified, because at the time of collection that area is still unknown. However, how can this recital be harmonized with the requirement set forward in the wording of Article 9 of the Regulation? This rule establishes a prohibition on the processing of special categories of personal data. This limitation shall not apply if the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject (Article 9(2)(a)).

Research carried out in the health sector has kept the issue of consent and its various forms very much alive in Portugal. Research using health data, where the model used for consent is provided by the subjects of this data, is no exception to this rule. On the one hand, this is a traditional model of informed consent (the one set forward in the wording provided in the legal section of the Regulation) in which required informed consent—which is free and explicit—from the data subject makes it difficult to advance scientific research. On the other hand, new currents are emerging with alternative models such as broad consent (the one that appears to be mentioned in recital 33), which we can define as those situations where the donor consents to his/her sample(s) being used once at the beginning of the research experiment. If additional analyses need to be performed or new experiments are designed, the donor is not contacted again, provided the new research is not a significant deviation from what was agreed to initially.¹³ Apologists for the traditional model argue that such broad consent is not true consent, as it cannot be taken into account. However, we agree with David Townend, who argues that the difficulty behind this problematic debate is that informed consent and broad consent are presented as opposites of each other. However, informed consent and broad consent are not polar opposites, neither are they points on a continuum or spectrum. They refer to different issues within consent. Informed consent concerns the quality of the consent, whereas broad consent concerns the subject matter of the consent.¹⁴

The future and the practical application of the Regulation will tell what will be the option of the member states regarding consent models. However, in the best interest of research, we hope that flexibility will begin to be implemented in the area of consent requirements, provided protective measures appropriate to the rights of personal health data subjects are duly safeguarded.

Another aspect not covered by the regulation is the secondary use of personal information for research purposes—secondary use refers to the use of data originally collected for a purpose other than the current one. This is a point on which the Regulation is mute. Hopefully, it will not prevent this secondary use, which, though essential for research using personal health data, is impossible to anticipate. Very often, a new purpose is only known after the processing of personal health data has begun, and the reality is that ‘all data derived from genome-wide associated studies and large-scale population studies which increasingly use electronic health records (EHRs) and/or electronic medical records will fall under this legislation.¹⁵ There is also no doubt that data sharing and provision of secondary data access can have a profoundly beneficial impact on progress in biomedicine and the health sciences’.¹⁶

Finally, the Regulation does not specifically address the processing of personal data for research developed with the use of biological samples. However, the Regulation will necessarily apply to research, developed using samples stored in biobanks, where it is possible for researchers to relate these biological samples to personal data (the Regulation explicitly defines personal health data as information obtained from the analysis or examination of a body part or bodily substance, including genetic data and biological samples).¹⁷ With regard to research biobanking, the approval of the Regulation could hamper or halt various medical research procedures, including retrospective as well as prospective research.

It is indisputable that biobanks are essential tools for the development of research. Still, these infrastructures face various challenges: whether at the level of governance or economic sustainability. The truth is that biobanks create bio-value, which is defined by Catherine Waldby as ‘the surplus of in vitro vitality produced by the biotechnical reformulation of living processes’.¹⁸ Portugal is a small country, and for this reason one of the main problems that often arises, and one that frequently comes up whenever biobanking-related issues are discussed, is the economic sustainability of biobanks. Now, sustainability is a critical element in the development of these infrastructures.

Biobanks maintenance and their economic sustainability might rely for the most part of it on their being integrated into public institutions with public funding (considering that these biobanks do not have nationwide scope, and to that extent they may not have problems similar to those of biobanks such as in the case of Iceland). Hence the need national biobanks have felt to be increasingly integrated into European or international biobank networks.

In this respect, the fact that Europe has a common legislation—the GDPR—might facilitate as far as personal data processing is concerned. However, this can only be said from an abstract point of view. In practice, though, what I think will happen is that very different national laws will lead to different legal systems with regard to the use of biobanks.

The other problem directly related to sustainability is, as we have said, governance. In Portugal we have biobanks for research purposes in private and public institutions; in the case of private institutions, with the limitation we have seen above: the legislation prohibits private for-profit institutions from having identified samples. For the most part, however, the financing and governance system stems from a public model. It has been the government, either through its direct administration or through decentralized institutes (such as universities or hospitals), that has borne the costs of these infrastructures. In fact, few private institutions have biobanks for research purposes or biobanks that have been created in accordance with existing regulations. For example, of the consortium existing in Portugal which we have mentioned above, only two of the infrastructures are located in private institutions: the Biobank of the Calouste Gulbenkian Foundation, and the Biobank of the Champalimaud Foundation. It is interesting that the institutional nature of the two of them is the same: a Foundation.

We believe that Portugal will continue above all, to be committed to support public biobanks. Not so much the establishment of more biobanks, but rather the expansion of the existing ones, and also their inclusion into international networks of biobanks. The need for the existence of biobanks for health research purposes is something of which government authorities have been aware for several years. The allocation of public funds and the financing of some reputable private entities will therefore allow the growth of these infrastructures in terms of size in Portugal. This is actually what we have been witnessing: the increase in the number of samples in existing biobanks; integration into networks; creation of biobanks consortia. As for the GDPR, we think it will facilitate the research developed in Portuguese biobanks. However, only future practice and the National Data Protection Commission’s own stance in this regard will confirm this perception.

6 Conclusion

Portugal has various laws regulating the establishment and functioning of biobanks. The legislation in force includes the law regulating stem cell biobanks, biobanks for civil and criminal purposes, and biobanks (or biological product banks, as the Portuguese law prefers to label them) for health care purposes (including diagnosis and disease prevention), or basic research and applied medical research.

One year after the full validity of the GDPR the country, Portugal finally has a law to adapt European standards to the national predicament. The approved law is unsatisfactory and merely repeats what was already established in the European law, since the legislator has so far not exploited the room left open by the GDPR for each Member State’s arrangements, which limits all sectors of activity, but in particular the scientific research carried out by the national research centers which, due to this gap, are in unequal circumstances vis-à-vis their peers.

Once the process of discussion and approval of the bill on the establishment and management of biobanks for scientific research purposes is complete (that we don’t know when it ends as the process has to be restarted), it is likely that Portugal will continue to focus on the expansion of existing structured biobanks, and also on their inclusion in international biobanks networks. The existing structures will have to adapt themselves to new legal requirements and seek to comply with national and international legal requirements that seek a balance between the development of scientific research and the protection of the rights of individuals.