1 Introduction

For several decades now, biomedical research has increasingly resorted to biological material, particularly in view of the enormous potential for the future of a better knowledge of the DNA of all living beings and even the possibility of modifying it by means of various techniques, including gene editing. Precision Personalised Medicine (PPM) is based on adapting the treatment to the individual genetic characteristics of each patient.Footnote 1 For PPM the support of biobanks is also a very important tool.

Spain has been a pioneer in the creation of systematic collections of human biological samples and, subsequently, of biobanks for different purposes.Footnote 2 Policy-makers and legislators have been particularly concerned about the use of human samples for biomedical research and biobanks as a very useful tool for this purpose. Maintaining a balance between scientific needs and progress, on the one hand, and an environment very respectful of the fundamental rights of those affected (i.e., the so-called ‘source subject’ of the samples), on the other, has been a constant concern for the Spanish authorities involved.

Spain has also been a relevant reference (i.e., some European countries and Latin America) to achieve a regulatory environment on these issues and for the collection and use of human biological samples for various scientific purposes.Footnote 3

In relation to the protection of personal data, some European countries have quickly implemented and adapted their internal laws to the GDPR. This is the case of Spain, which its new Organic Act 3/2018 of 5 of December on Protection of Personal Data and guarantee of digital rights is generally applicable. The new Act implements and completes some features of the GDPR, including those related to the provisions of Articles 9 and 89, in particular health related data and big data. In this way and by means of this ‘bridge’ Act, an attempt has also been made to guarantee the harmony between the GDPR and the pre-existing legislation, trying to ensure at the same time in effectiveness in promoting scientific research and in respecting for the rights of samples’ donors.

2 Biobank Infrastructure and Regulatory Environment

2.1 Biobank Infrastructure

2.1.1 General Remarks

The legal regime of each type of biobank is different according to its specific purpose, although there are some common points. In order to situate ourselves better in the Spanish regulatory context, I will now mention only the different banks of human material and/or the data extracted from these materials, which are managed in the biobanks.

2.1.2 Banks for Diagnostic and Biomedical Research Purposes

First of all, we can mention biobanks for diagnostic and biomedical research purposes. In Spain, some of these biobanks specialise in human samples of diverse nature: cells, tissues, tumours, DNA, fluids, etc. The study of these banks and their impact on the regulatory framework established by the GDPR, especially Article 89, will be the main focus of this study.

We will advance at this point only that Spanish regulations legally define what is to be understood by a ‘biobank’: a public or private, non-profit establishment that houses a collection of biological samples conceived for diagnostic or biomedical research purposes and organised as a technical unit with criteria of quality, order and destination (Act on Biomedical Research—Ley de Investigación Biomédica, LIB-, Article 3 (d)).

2.1.3 Banks for Therapeutic Purposes (Transplantation of Cells, Tissues and Organs)

The coordination of the procurement of human organs and tissues for transplant purposes, and more recently of cells of the same origin, has been a priority for Spanish health authorities. The National Transplant Organisation has led this national coordination activity worldwide in order to identify potential live and deceased donors and more suitable recipient patients, according to the established protocols. Thanks also to an adequate legal framework, which has persisted unaltered over time,Footnote 4 Spain is the country that leads, in relative terms and for many years, the number of donors and transplants performed.Footnote 5 For this reason, the concept of bank in the strict sense, that is, as a deposit of organs or tissues for transplantation, is relative in this sector, disregarding the fact that it can occur with some cells and tissues (e.g. bone marrow and other bone and cartilage elements).

2.1.4 Banks for Reproductive Purposes (Gametes and Embryos)

Specific legislation on assisted human reproduction techniques provides for the preservation of cryopreserved in vitro embryos as well as gametes for reproductive purposes and for scientific research relating to human reproduction.Footnote 6 If another scientific purpose is pursued, it will be governed by the law that regulates biomedical research.Footnote 7 The centres that apply these techniques are considered exclusive banks of these materials and embryos in vitro, but require prior authorisation, which means that it is the centres that select their reproductive use according to the criteria established by law. Consequently, gametes donors do not have any power to decide on the reproductive destination of the donated material, nor recipient women.

There is a duty of confidentiality in the access and use of donors’ personal data, and the protection of donors’ identity is guaranteed by law. Gametes and embryo banks are legally considered as health centres and services. There is an obligation to register the embryos deposited in a specific register. Embryos will be deposited for a limited time. The National Commission for Assisted Human Reproduction is legally entrusted with various functions that may include the use of embryos and gametes intended for reproduction or for scientific research purposes related to human reproduction.Footnote 8

2.1.5 Population Studies Banks

Spain has not created a national database nor has it collected massive biological samples from citizens for purposes of population studies, mainly referring to the health of citizens; there are some local banks for purposes of epidemiological studies or studies of the prevalence of certain diseases in certain territories or in certain sectors of the population (genetic screening), which in any case will require the consent of the interested parties (LIB Article 54 (5).Footnote 9 The competent authorities and various social sectors consider that in the interest of observing the principle of proportionality, this practice could significantly affect certain fundamental rights of citizens.

2.1.6 Forensic Investigation Database (DNA Profiles)

As in many other countries, in Spain there is a national police database of identifiers obtained from the analysis of non-coding DNA profiles. It is in charge of the Ministry of the Interior and pursues two main purposes: criminal investigation and identification of cadaveric remains and investigation of missing persons.Footnote 10 That means that the use of these biological materials for biomedical research is not allowed, nor scientific research biobanks samples for criminal investigation purposes.

Obviously, although people may voluntarily offer to have some biological material extracted for any of these purposes, DNA profiles may be included in the database without the consent of the subject under investigation.Footnote 11 Only identifiers obtained from DNA, in the framework of a criminal investigation, which exclusively provide genetic information revealing the identity of the person and his or her sex and ethnic group may be registered in this police database.Footnote 12

2.2 Biobanks for Biomedical Research Purposes: Their Implementation in Spain

2.2.1 General Remarks

There are a high number of biobanks for biomedical research purposes in Spain. Several of them got the rank of national that, according to the law, cover the needs of samples whose availability is not assured by the territorial banks or that due to the importance of certain biological materials are intended to ensure coverage throughout the Spanish territory. The Carlos III Health Institute (Instituto de Salud Carlos III), an autonomous body that belongs to the Ministry of Health, coordinates in some way the different existing biobanks, notwithstanding the autonomy enjoyed by the biobanks dependent on the Autonomous Communities (autonomous and local biobanks). National banks depend directly on this Institute.

2.2.2 The National Banks Are as Follows

  1. (i)

    The National Bank on Cell Lines (Banco Nacional de Líneas Celulares) is structured in the form of a network (with nodes in Granada (central node), Barcelona and Valencia) and covers the entire national territory. It has a specific regulation,Footnote 13 according to which other biobanks for biomedical research purposes are obliged to make available to the National Bank a certain number of free samples, which the National Biobank also distributes free of charge among Spanish researchers, once they have justified the need for the samples requested and the research objectives pursued. In reality, the structure of the National Bank is not based on the deposit, treatment, storage, conservation and distribution of biological material, but on the registration of the existing samples in each biobank associated to the National Bank and on a part of them the latter directly takes the assignment decisions.

  2. (ii)

    The National DNA Bank (Banco Nacional de ADN) is based at the University of Salamanca and has been linked for some years to the Carlos III Health Institute, on which the biobank is organically dependent.Footnote 14

2.2.3 The So-Called Autonomous Communities Banks

They have been created in some Autonomous Communities (institutional territorial units in which the whole country is organised) in order to supply the needs for biological samples of researchers from the respective Autonomous Community, although they also attend to requests that may be made by researchers from other Spanish territories (e.g. BIOEF, in the Autonomous Community of the Basque Country).

2.2.4 Health Centre Banks (Hospitals)

They are located in large hospitals throughout Spain, mainly to meet the needs of researchers linked to each hospital (e.g. university hospitals).

2.2.5 Banks Specialised in Specific Biological Samples

Since most of the local and some autonomous banks do not have the capacity and infrastructure to have all kinds of samples that researchers may need, some biobanks have been created that specialize in collecting and treating some biological materials necessary for certain lines of research, and in fact cover the entire national territory. The most important that exist in Spain are the Neurological Research Centre Foundation (Centro de Investigaciones Neurológicas, CIEN) and The Cancer Tumor Bank (Banco de Tumores Oncológicos).

Neurological Research Centre Foundation biobank is dedicated to having biological samples of the central nervous system (mainly brain tissue, muscle and nerve, cerebrospinal fluid, blood and derivatives, and DNA). While the donation of brain tissue is carried out logically post mortem (‘brain bank’), the other samples can be obtained in life from the donor or source subject.

The Cancer Tumor Bank specializes in the collection of tissue and cancer cells, usually extracted in the course of surgery. It is a precious biological material in order to carry out studies on the various types of cancer that exist. The Bank of the Centro Nacional de Investigaciones Oncológicas (CNIO) maintains samples of this nature but also others of interest for research other than cancer.

Finally, some of these banks (firstly local biobanks) can meet the custody and maintenance needs of certain samples that are linked to a given private research project, without actually being incorporated into the overall structure of the biobank in which they are deposited and therefore cannot be transferred to third parties and the agreement is established in a remunerated basis.

Different are the collections called by the Law, whose existence is exceptionally permitted insofar as biological samples have been obtained to carry out one or more specific research projects on similar matters from the remaining samples or for diagnostic purposes for the treatment of the source subject (Articles 60 (2) and 67 LIB). Once the research project or projects similar to the project for which the remaining biological samples were initially consented are concluded, they must be destroyed or transferred to a biobank, depending on the terms of the consent given by the source subject (Article 61 LIB). This regulation means that so-called blank consent has been excluded.

2.3 The National Network of Biobanks (Red Nacional de Biobancos)

Spain has a stable network of biobanks to promote scientific cooperation in the field of biomedical research. With the National Network having a fundamentally hospital base, its creation seeks to ensure that the existing multiplicity of biobanks is not uncoordinated or chaotic, while ensuring rapid access to the set of existing biobanks by researchers in the biomedical sector. Its network configuration allows to know in greater detail the type of samples existing in each biobank, their characteristics and their availability, so that by being united in a network the scientific community can obtain the maximum performance from all the biobanks existing in the country.Footnote 15 The main objective of the National Network of Biobanks is to provide a public service to biomedical researchers throughout the country, assuming in any case the relevant ethical principles and strict compliance with current legislation. The National Network has been promoted and is funded by the Carlos III Health Institute.

The National Network of Biobanks is made up of 63 institutions distributed in 15 Autonomous Communities. Of these institutions, 52 correspond to hospital biobanks of the National Health System and the other 11 are associated centres and are distributed among private hospitals, networks of territorial biobanks, national banks and other institutions with biobank activity, such as some universities. The samples that make up the National Network of Biobanks are very varied and their characteristics are easily identifiable as the different biobanks that guard them are part of the Network: oncological samples (tumor bank), nervous system samples (brain banks), samples that collect nucleic acid derivatives, solid samples of various pathologies, serotheques and plasmotheques and diagnostic collections.

2.4 Applicable Regulatory Framework

The regulatory framework that can most directly affect the creation, structure, organization and operation of biobanks is found in the first place in the Act on Biomedical Research,Footnote 16 whose Title V (Chapter IV Articles 63 to 71) is devoted to biobanks, as well as to genetic tests and biological samples (Chapters II and III). Probably this Act was innovative at the time of its approval (i.e., giving the option for a flexible or ‘open’ consent for further use of samples for related biomedical researches and promoting anonymisation of personal data that are collected in biobanks) and remains still with respect to the conception and purposes of biobanks, having managed to make compatible and facilitate access by scientists to well-ordered biological samples of human origin identified in aspects of interest for research with respect for the rights of the people from whom these samples come, such as their autonomy and privacy.Footnote 17

The implementation of this Act regarding biobanks and human biological samples has been achieved by a Royal Decree of 2011, which regulates biobanks for biomedical research purposes, the treatment of biological samples and the National Registry of Biobanks.Footnote 18

In relation to the protection of personal data, Organic Act 3/2018 is generally applicable,Footnote 19 which succeeds the previous Organic Act on the Protection of Personal Data of 1999 and is adapted to the GDPR, as well as GDPR itself. The new Act 3/2018 implements and completes some features of the GDPR (in no case modifies or replaces it), including those related to the provisions of Article 89, in particular data related to health, that have been established in great detail. In this way and by means of this ‘bridge’ Act, an attempt has been made to guarantee, and it can be stated that quite correctly, the harmony between the regulations of the GDPR and the pre-existing legislation, adding details that in many cases try to ensure that the normative framework is at the same time effective in promoting scientific research and respect for the rights of donors of biological samples.

3 Guarantees for the Rights and Interests of Source Subjects

3.1 Legal Requirements

The provisions of Chapter III of Title V of Act 14/2007 (Articles 58 to 62, LIB) regarding obtaining, prior information, consent, confidentiality, transfer, conservation of data and samples, access to data and the right not to be informed, as well as the provisions of RD 1716/2011 and the concordant regulations mentioned above, shall apply to biological samples deposited in biobanks. The biological samples incorporated into biobanks may be used for any biomedical research, under the terms prescribed by this Act, provided that the source subject or, as the case may be, its legal representatives have given their consent under the terms and conditions provided by law.

It is possible to highlight some demands that reinforce the safeguard of the rights of the people involved, or that suppose a certain non-essential weakening of the same justified, as established in the new Organic Act 3/2018. In any case, it must be borne in mind that this Act does not deal directly with human biological samples for research and biobanks, but only with data relating to health. Therefore, the application to biological samples of the provisions relating to health data will be acceptable to the extent that the samples have given rise to some personal data, but not the sample itself, if no information has yet been obtained from it. In conclusion, Organic Act 3/2018 does not provide for an automatic equation between data and samples.Footnote 20 It will be necessary to combine this latter with specific provisions in LIB and RD 1716/2011.

3.2 The Collection of Samples

The collection of samples will be carried out in accordance with the provisions for direct biomedical research with biological samples (research projects). The following requirements must be met: justify the purpose for which the samples are to be used and describe the lines that will make up the collection; indicate the identity of the person responsible for the biobank; these will be specific transfers for specific purposes; description of the characteristics of the biobank. The source subject shall also be informed that the sample is to be transferred for biomedical research and of the availability of information. The possibility of the donor establishing some restriction for its use has been discussed.

3.3 The Informed Consent of the Involved Person

3.3.1 General Rule

The consent of the person concerned shall always be required.Footnote 21

3.3.2 Reuse of Personal Data

However, the reuse of personal data for health and biomedical research purposes shall be considered lawful and compatible when, having obtained consent for a specific purpose, the data are used for purposes or research areas related to the area in which the initial study was scientifically integrated.Footnote 22

3.3.3 Public Health Research

For public health reasons, scientific studies may be carried out without the consent of those concerned in situations of exceptional relevance and seriousness to public health.Footnote 23

3.3.4 Pseudonymisation of Data

In cases of transfer of samples, the principle of transfer of pseudonymised data/samples is enshrined, which currently no longer requires additional consent when the researcher makes a transfer to third parties (e.g. to other researchers working on the same project).

The new regime established in 2018 for the use of data for biomedical research purposes is as follows:

The use of pseudonymised personal data for health research purposes, and in particular biomedical research, is considered lawful and will be required:

  1. 1.

    a technical and functional separation between the research team and those who carry out pseudonymisation and conserve the information that makes re-identification possible;

  2. 2.

    that pseudonymised data are only accessible to the research team when:

    1. (i)

      there is an express commitment to confidentiality and not to carry out any re-identification activity;

    2. (ii)

      specific security measures are adopted to prevent re-identification and access by unauthorised third parties. Data may be re-identified at source when an investigation using pseudonymised data reveals a real and specific risk to the safety or health of an individual or group of individuals, or a serious threat to their rights, or is necessary to ensure adequate health care.Footnote 24

As a general rule, the biobank will deliver samples in a anonymised or pseudonymised basis according to the case. When the characteristics of the research require the identification of the samples, this should be evaluated previously by the Biobank Ethics Committee (see below, Sect. 5.1, b: External Committees).

3.4 Free Nature of Assignments

The biobanks will operate on a non-profit basis for research projects that have been scientifically approved, without prejudice to charging for the costs of obtaining, purifying and preserving and managing the application for biological samples, including their transport,Footnote 25 which will have to be paid by the applicant researcher.Footnote 26

This requirement implies that biobanks must in fact act for non-commercial purposes, whether they belong to public or private institutions (e.g. private foundations promoted by patient associations).Footnote 27

3.5 Incorporation Into the (Clinical) Research Ethics Committees of the Data Protection Officer

It is a standard that all clinical trials and other research projects involving an intervention in human beings, access to their personal data or their biological material be subject to prior evaluation by an independent clinical research ethics committee, whose opinion must be favourable in order to carry out the research (in addition to any other necessary authorisations).Footnote 28 The new Organic Act (3/2018) establishes the incorporation of a Data Protection Officer to all Ethics (Clinical) Research Committees with Medicines or, failing this, an expert with sufficient knowledge of Regulation (EU) 2016/679 when dealing with research activities involving the processing of personal data or pseudonymised or anonymised data.Footnote 29

3.6 Situations of Special Risk

Those responsible for or in charge of the files must assess the risks and, where appropriate, adopt the opportune measures when, among other cases:

  • The processing of data of affected groups in a situation of special vulnerability and, in particular, of minors and persons with disabilities is carried out.

  • There is a massive processing that involves a large number of affected or entails the collection of a large amount of personal data.

  • The personal data are routinely transferred to third States or international organisations for which an adequate level of protection has not been declared.Footnote 30

3.7 The Transfer of Samples

All researchers in Spain may apply for getting human biological samples to the competent biobank. The application shall contain information about the project to be developed and the explicit commitment of the applicant centre and/or of the researchers participating in the project not to use the material requested for any use other than that indicated therein. The transfer of samples may be accompanied by the associated clinical information, which entails the use of procedures that guarantee the protection of personal data, unless they have been previously anonymised or pseudonymised. The refusal to transfer the samples requested will be motivated by the responsible person, who will have at sight the respective previous reports of the scientific director and both of the biobank scientific and ethical committees (see below, Sect. 5.1, b).

4 Law in Context: Individual Rights and Public Interest

The Act on Biomedical Research explicitly includes a principle that comes from the 1997 Council of Europe Convention on Human Rights and Biomedicine (Oviedo Convention, Article 2), which forms part of the Spanish internal legal system: the health, interest and well-being of the human being who participates in biomedical research will prevail over the interest of society or science (Article 2(2)(b) LIB), adding that research from human biological samples will be carried out within the framework of respect for fundamental rights and freedoms, with guarantees of confidentiality in the treatment of personal data and biological samples, especially in the performance of genetic analysis (Article (2)(c) LIB). The applicable regulations are consistent with these general principles of this Act and are reflected in numerous provisions of the same that guarantee information, consent (notwithstanding this in a more open way than the GDPR), confidentiality and other rights of affected persons.Footnote 31

On the other hand, it is also established that freedom of research and scientific production in the biomedical sciences will be guaranteed (Article (2)(d) LIB), which could not be otherwise, since it is a fundamental public freedom proclaimed by the Spanish Constitution. In this way Spanish legislation maintains a balance between the priority interest of individuals, but at the same time promotes biomedical research, in this case facilitating access to human biological material. However, it should be remembered that the new Organic Act 3/2018, introduces some exceptions to the interest of parties, specifically on a more extended consent approach than the GDPR to the detriment of the widespread accessibility of data (and samples) by researchers,Footnote 32 although it can be considered that they are still in agreement with the framework of the latter.

5 GDPR Impact and Future Possibilities for Biobanking

5.1 Biobanking and Samples Research Governance

Spanish previous legislation (LIB and RD 1716/2011) has paid special attention to issues directly or indirectly related to the governance of biobanks and biological samples. In this place we will only mention which are the aspects most linked to governance that have been regulated:Footnote 33

(a) Requirements for the Creation of a Biobank

Authorisation is required (Article 64 LIB); the scientific interest of the biobank must be justified (Article 63 LIB); non-commercial purpose must be guaranteed, as the profit motive is excluded; a distinction is made between holders, managers and director of the biobank.

(b) External Committees to Biobanks

Two independent committees are established within the biobank and between themselves: the scientific committee and the ethics committee.Footnote 34 Its main functions are:

  1. (i)

    Ethics Committee: the ethical evaluation of applications (binding nature of the report if negative), advice on quality procedures and on the ethical aspects of the good practice document, responding to consultations presented by the director of the biobank and deciding cases of individualised sending of information.Footnote 35 It is therefore a different committee from the Research Ethics Committee, as that one has specific functions exclusively related to the transfer of samples by biobanks.

  2. (ii)

    Scientific Committee: the scientific evaluation of applications (binding nature of the report if negative), advice on quality procedures and on scientific aspects of the good practice document, responding to queries from the director.

5.2 National Register of Biobanks

Registration is mandatory for all biobanks that provide for primary or secondary research purposes.Footnote 36 The Register depends on the Instituto de Salud Carlos III, but it is also necessary to register the biobank, like any other file, in the Register of the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).

5.3 The Future of Biobanking and of the Related Norms

We can state that with the current European regulatory framework, and the Spanish regulation itself, obstacles have been eliminated and procedures have been facilitated to be able to research with human biological samples, without posing serious risks to individual’s fundamental rights.

The availability of big data is a new and very important legal challenge that is not yet certain that the GDPR has effectively addressed. For its part, the Spanish Data Protection Organic Act 2018 deals with an issue arising from the use of big data: the risk of re-identification. It is a matter that requires a great deal of attention, especially in sectors that are more vulnerable to it, such as health data and genetic data. The foreseeable appearance of illegal re-identification cases will test the effectiveness of the legal provisions in this respect, which at the moment seems doubtful.

There are several ways in which it will be necessary to go further in the future to ensure effective protection of the subjects who are the source of biological samples: extend and reinforce the duties of confidentiality of any person who, for any circumstance or legal provision, has access to the data of third parties, including those known unexpectedly; extend the anonymisation practices of personal data before handing over data or biological samples to third parties; this category should include, as the current regulations already do, pseudonymised data whose identification codes are under the exclusive control of responsible persons and are not transferred to third parties when they receive the data and/or biological samples. Practices (e.g. unjustified addition of mass data, mass analysis of data of one or more persons) which, intentionally or accidentally, allow the re-identification of the persons from whom the data originate will be discouraged, the personal data protection regulations will then be fully re-applied and immediate anonymisation of these data will be obligatory. The principles of data quality must also be reinforced, in the sense that data that have been processed are only used for the declared purpose for which they were collected and are not passed on to third parties, save for very strictly established exceptions.

6 Conclusion

The GDPR represents a major challenge for the authorities of the EU MS, in particular for their lawmakers. The Spanish legislator, by means of Organic Law 3/2018, has made a great effort to implement the GDPR and to harmonise it with pre-existing domestic law, particularly in relation to personal data in the field of biomedical research. It is certain that the new internal legal regime, with the support of the GDPR, will decisively facilitate biomedical research which requires the processing of personal data and human biological samples.

However, it is also probable that this Act has not been sufficiently clear in relation to some key issues, since in addition to going beyond the GDPR in such decisive matters as the consent of the interested party, it presents relevant interpretative doubts in other matters, possibly due to ambiguous wording, such as, for example, the process of pseudonymisation (not the use of data that are already pseudonymised), that is, whether or not it also requires the prior consent of the interested party.