1 Biobank Infrastructure

1.1 What Is a Biobank

The applicable Belgian legislation defines a biobank as ‘the structure which, for the purpose of scientific research, with the exclusion of research with human medical applications, obtains, processes, stores and makes available human body material, and, where appropriate, the associated data relating to the human body material and the donor’ (see Figure 1).Footnote 1 It is sufficient to carry out one of the activities listed above for scientific purposes in order to be characterized as a biobank.Footnote 2 Such structure may be established within an accredited hospital or faculty of medicine and health sciences, or it may also be created outside of a hospital, for instance by a private organization, such as a pharmaceutical company.Footnote 3 The law further requires the positive opinion of an ethics committee concerning the objectives and activities of the biobank.Footnote 4

Human body material (HBM) is defined as ‘any human biological material, including human tissues and cells, gametes, embryos, foetuses, as well as substances derived therefrom, and regardless of the degree of their transformation, with the exception of substances of non-human origin’.Footnote 5

The majority of Belgian biobanks are organized at a central level, within the framework of an institution, e.g. a hospital or a university. In such situation, these hospitals/universities require their researchers to use that central biobank infrastructure. However, it is possible that even a sole researcher can be regarded as a biobank and will have to abide to the strict applicable legislation. This will be the case if his activity formally falls within the scope of the Belgian biobank legislation.Footnote 6

The biobank manager (often referred to in literature as custodian) is the central responsible authority in the Belgian biobank infrastructure.Footnote 7 The custodian must be a doctor who fulfils the conditions laid down in Article 25 of the Law on the exercise of health care professions or a national of one of the Member States of the European Union who is authorized to practice medicine in a Member State other than Belgium.Footnote 8 The rights and responsibilities of the custodian, as elaborated in the Act on HBM, are critical for the conduct of biobanking activities and translational biomedical research.Footnote 9

1.2 Types of Biobanks and Biobank Networks in Belgium

On a broader European level, there are many different types of biobanks, established for various purposes and reasons. A report issued by the European Commission (EC) has provided a classification of biobanks that can be translated to the Belgian context.Footnote 10 According to the authors of the report, there are certain biobank characteristics that can be used to distinguish between different types of biobanks. These include size, research design, the types of biological samples collected, the method of sample collection, processing and storage, and the disease/research focus.Footnote 11 Hence, the following types of biobanks can be enumerated: large-scale biobanks, small collection biobanks, population-based biobanks, disease-oriented biobanks, case-control biobanks, tissue banks, biobanks in the context of clinical trials, and other specific biobanking formats, such as Guthrie cards (newborn screening), cord blood, or stem cells.Footnote 12

It is hard to provide an exhaustive overview of the types of biobanks in Belgium, as the Belgian legislator has not pronounced itself on the matter and because no official record exists.Footnote 13 The only exception concerns the distinction between biobanks created in the context of a clinical trial and biobanks in general.

The sampling and operations carried out on HBM in the context of a clinical trial on medicinal products for human use, are excluded from the scope of the Belgian Act on HBM.Footnote 14 The provisions for biobanks created in the framework of a clinical trial are containted in the Act of 10 April 2014. Attention must be paid to situations where HBM and associated data which were initially collected in a clinical trial, are used later for purposes other than the ones defined in the clinical trial protocol. In this case, the collected data and material would fall within the scope of the Act on HBM.Footnote 15

In addition to the foregoing, the concept of a biobank network must be discussed. The term is not defined in the legislation, however a working definition is established in literature, together with a classification of such networks. A biobank network could be described as ‘a group of institutions who freely assume the commitment to collaborate in the domain of biobanking and who (often) share the same procedures and quality policies, and who are (or might be) helped by a central hub for coordination in terms of service’.Footnote 16 In Europe, Biobanking and BioMolecular Research infrastructure—European Research Infrastructure Consortium (BBMRI-ERIC)Footnote 17 is the largest and most significant example of a biobank network, as it connects biobanks and researchers from 20 countries.Footnote 18 Belgian’s BBMRI-ERIC node has been in operation since 2013, under the name of BBMRI.be. It unites the historically established Belgian biobank networks,Footnote 19 one of which formally no longer exists.Footnote 20 In the period 2013–2019, BBMRI.be has matured into a solid partner network on biobanks in Belgium and has proven to reach out to a broader community beyond the founding partners. From 2019 onwards, BBMRI.be invites all Belgian biobanks with translational research potential, as well as biobank users that are seeking structural research collaborations with the BBMRI.be network to join the BBMRI.be network.

2 Regulatory Environment for Biobank Research in Belgium

2.1 Legal Framework for Biobanks

2.1.1 The Act of 19 December 2008 on Human Body Material

The Act on HBM applies to the donation, collection, procurement, control, treatment, storage, distribution, and use of HBM and manufactured products derived from HBM, intended for human applications or for scientific research purposes.Footnote 21

Regarding the scope ratione materiae, the rules of the Act on HBM are applicable to any human biological material.Footnote 22 Although exceptions exist,Footnote 23 the scope of application remains extremely broad. For instance, within the scope fall all derived substances irrespective of their degree of transformation.Footnote 24 It follows from the foregoing that the Act on HBM is in principle also applicable to DNA and proteins.Footnote 25 Gametes, embryos, and foetuses, even if to a limited extent, also fall under the scope of the legislation.Footnote 26 The broad scope of the law ratione materiae has been subject to criticism from stakeholders in the field, as it does not provide for an adequate nuancing of the different types of HBM, and thus imposes too strict regulations in all cases. Such conclusion follows when the most recent proposal for amendment of the Act on HBMFootnote 27 is taken into consideration.

Regarding its scope ratione loci, the Belgian Act on HBM applies, first, to HBM removed on Belgian territory,Footnote 28 but also, second, to samples imported from abroad and used in Belgium.Footnote 29

Finally, regarding the scope of the law ratione personae, three conditions must be fulfilled cumulatively to regard any entity as a biobank: (1) the entity must be carrying out one or more of the activities enumerated in the law (obtains, processes, stores and makes available of HBM and/or associated data); (2) the use of HBM must be done for the purposes of scientific research;Footnote 30and (3) the activities that a structure has to perform in order to be established as a biobank, include the obtaining, processing, storage and making available of HBM for scientific research.Footnote 31

The initial text of the Act on HBM contained legal rules on the procurement and use of HBM by biobanks for research purposes that did not enter into force for 10 years, and in the meantime were amended several times. Changes were introduced, first, by the Act of 19 March 2013 containing diverse provisions concerning health. Second, the Act of 10 April 2014 containing diverse provisions concerning health established specific rules for biobanks created in the framework of a clinical trial. Finally, The Act of 22 June 2016 introduced further modifications to the legal framework. All three Acts were scheduled to enter into force only after the publication of one or more executive Royal Decrees.Footnote 32 With the adoption of the Royal Decree of 9 January 2018, the legal framework described above finally entered into force.Footnote 33

A recent amendment of the Act on HBM that requires attention, is the Act of 30 October 2018. With its entry into force, the scope of Belgian biobank rules ratione materiae was extended to the donation, procurement, control and import of HBM intended for use exclusively in manufactured products, in particular medicinal products, advanced therapy medicinal products (ATMPs)Footnote 34 or medical devices.Footnote 35 Another significant change brought by the new amendment act, is the establishment of a new service within the Federal Agency for Medicines and Health Products (FAMHP), which should provide advice on access to HBM.Footnote 36

2.1.2 The Royal Decree of 9 January 2018

The Royal DecreeFootnote 37 establishes rules pertaining to, inter alia, the biobank notification procedure; the collection of human material; the approval by and reporting to ethics committees; the organization of a biobank register; the content of the agreement between a biobank and the recipient of the human substances.

2.1.3 The Compendium on Biobanks, Issued by the Federal Agency for Medicines and Health Products (FAMHP)

The Compendium is a form of self-regulationFootnote 38 which strives to shed clarity as to how to interpret and implement the complex system of legal requirements. During the preparation of the Compendium, the input of relevant stakeholders was sought, namely representatives of academic and industrial biobanks, ethical committees and juridical experts. By providing answers to 47 consolidated questions, the document covers a broad range of topics such as, inter alia, the scope of the biobank legislation, consent, notification procedure, transformation of HBM, traceability and anonymization, ethics committees.

2.1.4 Belgian Data Protection Legislation

Data protection legislation must always be considered when it comes to biobanking activities. The reason for this lies in the fact that access to associated dataFootnote 39 is of crucial importance for the proper conduct of most biomedical research. Limited access to such data could result in a lack of reproducibility and risk of misinterpretation of the research results.Footnote 40

2.1.5 ‘Associated Data’ as Personal Data

The Belgian Privacy CommissionFootnote 41 brought attention to the fact that information about a number of characteristics of the donor must be provided every time an operation is conducted on HBM.Footnote 42 This is in line with Article 2 (27) of the Act on HBM, which states that within the scope of the law is also ‘where appropriate, associated data relating to the human body material and the donor’. The Belgian biobank legislation refers to personal data, although it does not provide a definition of the term itself. However, the Belgian Privacy Commission further established that such biological and medical characteristics of the donor (i.e., associated data) have to be regarded as personal data in relation to the health of the donor in the sense of Article 7 of the Act of 8 December 1992 on the protection of privacy.Footnote 43

2.1.6 The Act of 30 July 2018

The Act of 8 December 1992 was replaced by the Act of 30 July 2018.Footnote 44 It can be argued that the authoritative guidance issued in the past by the Belgian Privacy Commission applies to the new legislation as well.

The Act of 30 July 2018 stipulates that the definitions of GDPR apply directly.Footnote 45 Hence, central concepts such as ‘personal data’, ‘controller’, ‘processor’, or, in the context of biobanking, ‘data concerning health’ and ‘genetic data’, are to be understood as they are defined in the GDPR.Footnote 46

2.1.7 Interplay Between the Belgian Data Protection and Biobank Rules

In addition to the reference to personal data described above, the Belgian biobank legislation provides for an interplay with data protection rules on several other grounds, listed below.

  • Data controller and data subject in the context of biobank research: Responsibility for the processing of personal data in the framework of a biobank is allocated to the biobank custodian.Footnote 47 Logically, the data subject is the donor of HBM.Footnote 48

  • Record of processing activities: On the one hand, Article 191 of the Act of 30 July 2018 lists the additional elements that the controller should add to the record of processing activities in case data is processed for scientific purposes. Besides this list, the legislation does not provide any further guidance or template for this record. On the other hand, the Act on HBM establishes that a biobank should keep a ‘register’ with information about the nature, origin and destination of the stored HBM,Footnote 49 and a template for such a register is provided in the Royal Degree of 9 January 2018. The two types of records complement each other, and the lack of a unified format could be perceived as an additional burden for the data controller/biobank custodian.

  • Storage period: The maximum storage period for personal data is 50 years after procurement of HBM.Footnote 50

  • Traceability and identification of personal data:Footnote 51 Traceability is a crucial concept in biobanking. It constitutes the ability to locate and identify HBM and associated personal data at any stage of the biobank process, from procurement to distribution for use, or destruction.Footnote 52 Concerning HBM obtained by a living donor, traceability depends on the consent of the donor or of the person who is legally authorized to grant permission for the procurement of HBM.Footnote 53 In the case of residual HBM obtained from a diseased person, the determination of whether the material should be traceable could be made by several people, which the law enumarates in a limited manner, including the custodian of the biobank.Footnote 54 Hence, such HBM is collected based on a presumed (non-explicit) consent procedure. As traceability is necessarily linked to the processing of personal data, the discussed provisions also bear influence on the degree of control that a donor will have regarding his privacy.Footnote 55

  • Further processing of personal data: Pursuant to Article 194 of the Act of 30 July 2018, where personal data are not collected from the data subject, the controller should conclude an agreement with the original controller. The Article 195 lists the essential elements of the agreement: the contact details of the original controller and of the controller of the further processing; or, in cases where derogations from certain data subject’s rights (i.e., right to access, right to rectification, right to restriction of processing, and right to object) have been adopted, the reasons why the exercise of these rights is likely to make the achievement of the purpose of further processing impossible or seriously hinder it.

    These rules are directly related to Article 21(1), Article 22(2)(3) of the Act on HBM, and Article 10 of the Royal Degree of 9 January 2018, pursuant to which each provision of HBM by a biobank, whether the HBM is transferred to another biobank or a third party, should be subject to a written agreement with the person or institution receiving the material. The agreement should govern the possible processing of the donor’s personal data by the entity to which the material is made available.Footnote 56 The biobank legislation requires that this type of agreements containt more elements, than what is prescribed in the data protection rules, e.g. the subject of the scientific research for which the HBM is made available; the responsibilities for ensuring traceability; a description of the appropriate technical and organization measures to be taken in the case personal data is also communicated; a coded copy of the consent of the donor.

    Finally, Article 11 of the Royal Decree of 9 January 2018, expressly forbids the transfer of personal data to third parties, but permits it if it occurs between biobanks.

Questions remain regarding the practical implementation of the provisions discussed above. For instance, a detailed account of the appropriate technical and organizational measures to be taken in cases of personal data transfers lacks in the current Belgian data protection legislation.

2.2 Procedure for Samples Collection

2.2.1 In Theory

The procedure for samples collection is established in the Act on HBM. Removal of HBM for scientific research is permitted on the condition that it is performed for a specific purpose.Footnote 57 The aim should be specified, precise and relevant for the scientific research.

Again, attention should be paid again to the fact that associated data, and more specifically personal data, are collected alongside samples. Hence, in the context of HBM procurement, data protection rules apply as well. According to the purpose limitation principle established in Article 5(1)(b) of the GDPR, personal data must be processed for ‘specified, explicit and legitimate purpose’. The purpose limitation principle is thus in line with the condition established in the Act on HBM as regards the obtaining of samples. However, in contrast to the Act on HBM, the GDPR allows the possibility for a broad consent for research, as long as ethical oversight is provided. Pursuant to Recital 33, ‘it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research.’

  • Informed consent: A central place in the samples collection procedure holds the requirement for informedconsent.Footnote 58 Consent is also one of the possible legal bases for the valid processing of associated personal data.Footnote 59 According to the biobank legislation, informed consent for biobank research shall be given without prejudice to the applicable data protection rules.Footnote 60 Pursuant to the Act on HBM, the donor’s consent for biobank research must be given in an informed, conscious and free manner, and it must be written, dated and signed.Footnote 61

An interesting parallel between the GDPR and the biobank rules can be made vis-à-vis the right to withdrawal. The Act on HBM provides for a right to withdraw one’s consent that can be exercised at any time before the HBM has been subjected to any action after having been obtained.Footnote 62 It is not necessary to motivate the withdrawal. In literature, this right to withdrawal is perceived as rather symbolic, since the donor loses such it as soon as the custodian stores or processes the HBM.Footnote 63 The GDPR also establishes a right to withdraw consent,Footnote 64 which holds relatively more weight than the same right under the Act of HBM. Hence, consent for the processing of associated data can be withdrawn at any time, and if done, this would mean that the custodian must delete all processed data, unless the data can be processed on another legal ground. However, the right of withdrawal under GDPR does not affect the lawfulness of the processing conducted before withdrawal.

  • Distinction between primary and secondary use of HBM: Another important consideration related to the Belgian biobank legal framework pertains to the distinction between primary and secondary use of HBM. Primary use is defined as ‘any use of human body material to which the donor has explicitly and specifically given consent in the context of the collection’,Footnote 65 whereas secondary use is ‘any use of human body material other than that to which the donor has given his consent in the context of the collection’.Footnote 66 In Article 20(1) an informed and explicit consent is required for the secondary use of HBM. However, pursuant to the same provision, in cases where it is impossible to seek consent, or where such a request would be exceptionally inappropriate, the positive opinion of an ethics committee would be sufficient to allow the collection of samples.

  • Use of residual HBM: A further essential point relates to the use of residual HBM. Residual HBM is defined as the material collected for ‘the diagnosis or treatment of the donor which, after a sufficient and relevant part has been stored for the establishing, refining or completing the diagnosis or treatment of the donor on the basis of new scientific data, is redundant in relation to these purpose and could therefore be destroyed’.Footnote 67 In the case of residual HBM, consent is presumed, unless, prior to any operation with the material, the donor announced his/her refusal.Footnote 68 The refusal must be addressed to the medical specialist referred to in Article 4(1)(1) of the Act on HBM, or to the chief medical officer of the hospital where the sample was taken.

  • Who obtains consent: The person responsible for obtaining the consent must be a medical specialist.Footnote 69

  • Sample collection from minors and incapacitated persons: The Act on HBM provides for the possibility to obtain HBM from minors and incapacitated persons (as defined in Article 492 of the Belgian Civil Code) only in cases whereby the collection of samples cannot have serious consequences for the donor and the removal involves cells and tissues that regenerate, or in cases where the removal is carried out with an autologous purpose.Footnote 70 Informed consent is required, and it should be given by the donor’s representative in accordance with the Belgian Act of 22 August 2002 on Patients’ Rights.

  • Sample collection from diseased persons: The Act on HBM provides that a presumption, established in Article 10–14 of the Act of 13 June 1986 regarding the removal and transplantation of organs, applies for research biobanking as well.Footnote 71 According to the relevant provisions, anyone who has been domiciled in Belgium for 6 months, is presumed to consent to a sample collection after his death, unless he has expressed his oppositionFootnote 72 (orally or in writing, with the municipal administration, their general practitioner, or online via MaSante.Belgique.be). This is known as the ‘opt-out’ system. A new Royal Decree, issued on 9 February 2020, further details the rules on the registration of declarations of will concerning post mortem removal of HBM and organs. The decree enters into force on 1 July, 2020. Of interest is Article 11, which introduces a sensibilization step. Namely, a month before reaching the age of maturity, all persons will receive a letter which would inform them about the opt-out system, and their right to opt-out or explicitly opt-in. The future consequences of this law cannot be predicted. It may be assumed that the new generation will be more aware of the system of opting-out, in comparison to many people today who do not know about it. However, it can also be argued that as long as the general public is not structurally informed about these provisions, this could induce yet another obstacle in accessing HBM for research purposes. They key lies in setting up information campaigns, which are not yet foreseen by the government.

  • The no (commercial) advantage rule: The Act on HBM prohibits that any financial or material advantage is offered or received in exchange for the donation of HBM.Footnote 73 The donor can only receive a compensation for the cost or loss of income that is direct results of the donation.Footnote 74

  • Who removes the sample: The categories of health professionals that have the right to physically obtain HBM are listed in Article 2 of the Royal Decree. These are medical doctors, dentists, nurses, midwives, pharmacists and licensees or masters in chemical sciences authorized to perform clinical biology analysis, and finally, holders of the professional title ‘medical laboratory technologist’. It is possible that the collection of HBM from a living donor takes place outside of a hospital, as long as this occurs in an environment where health, safety and discretion are guaranteed.Footnote 75

2.2.2 In Practice

In general, the institutions strictly follow the rules described above. The reliance on presumed consent for the use of residual HBM has not yet become widespread. Because of the need for clarification on the applicable stipulations, explicit consent is often asked also for residual material, as such material in most cases is not anonymized.

Moreover, it could be argued that it anonymization itself is only possible with the donor’s consent. The reason lies in the provision of Article 11 of the Act on HBM, according to which, if important information concerning the donor’s state of health has been generated during operations conducted on traceable HBM, an obligation is triggered for the biobank to inform the donor about the discovery.

When HBM is procured for secondary purposes, practice shows that in most cases it is impossible to obtain the donor’s consent, or it is excetionally inappropriate to seek it.

3 Biobank Research Oversight

3.1 General Remarks

In Belgium research oversight in the context of biobanking, other than by the Belgian Supervisory Authority for data protection, is provided by three main bodies. These are ethics committees, the Federal Agency for Medicines and Health Products (FAMHP), and Data Protection Officers, as required by the Act of 30 July 2018, in implementation of the GDPR.

3.2 Ethics Committees

The positive opinion of an ethics committee is required for the establishment of a notified biobank.Footnote 76 Pursuant to Article 22(1)(3) of the Act on HBM, such opinions can only be given by ethics committees with full competence.Footnote 77

Once a positive ethics opinion has been obtained in view of a biobank’s general aims and activities, the biobank can also rely upon it as an approval covering particular projects.Footnote 78 Thus the biobank is alleviated from the burden to seek ethical advice for each new procurement of HBM.Footnote 79

In addition, prior to any secondary use of HBM, an ethics committee must provide a favorable opinion.Footnote 80 The ethics committee decides on the relevance of the secondary use and its purpose, the adequacy of the information provided to the donor, and the sufficient specificity and the scope of the donor’s consent.Footnote 81

Finally, in cases where it is impossible to seek the donor’s consent, or where such a request would be exceptionally inappropriate, the positive opinion of an ethics committee is sufficient to allow the collection of HBM. Whereby such a situation arises, it is also the ethics committee’s responsibility to evaluate whether it appears impossible or exceptionally inappropriate to request the donor’s consent.Footnote 82

3.3 The Federal Agency for Medicines and Health Products (FAMHP)

All biobanks in Belgium have to submit a notification on their activities to the FAMHP (see also Figure 2).Footnote 83

For a biobank that has been in operation before the entry into force of the Royal Decree (meaning that samples have already been collected before November 2018), the notification procedure had to be finalized before 1 May 2019, following a 6 months grace period.

For all new biobanks, the notification must be done before the start of any samples collection.

3.4 Data Protection Officer

Article 37.1 of the GDPR stipulates that in cases where the core activities of a controller or processor consist of processing special categories of data pursuant to Article 9 (i.e., genetic data, biometric data, and data concerning health) on a large scale, a data protection officer shall be designated. Having in mind the sensitive character of biobank activities and of HBM and its associated data, it is to be concluded that most biobanks would have to appoint such Data Protection Officer (hereafter DPO). The DPO can be perceived to have a critical role in the oversight of biobank research.

The DPO must be designated on the basis of his professional qualities, in particular expert knowledge of data protection law and practices.Footnote 84 The DPO’s tasks include, inter alia, informing and advising the controller or the processor, and the employees who carry out processing, of their obligations pursuant to the GDPR and to other relevant national provisions; monitoring compliance with the relevant EU and national data protection provisions, as well as the internal policies of the biobank; providing advice as regards data protection impact assessment; cooperating with the data protection supervisory authority.

The Belgian Act of 30 July 2018 also provides for the designation of a DPO, specifically in the cases where personal data are processed for scientific research purposes and the processing may result in high risk.Footnote 85 When personal data is processed for scientific purposes, the controller must anonymize or pseudonymize it after it is collected. In cases of further processing, it is possible to de-pseudonymize the personal data only when necessary for the research purposes and, where applicable, after consulting the DPO.Footnote 86 Furthermore, under Article 204, the DPO must issue opinions on the use of the various pseudonymization and anonymization methods employed. However, the legislator’s decision to createthis obligation may be questioned, as at the current moment there are not enough guarantees that DPOs are sufficiently equipped and educated to provide such opinions.

4 Law in Context: Individual Rights and Public Interests

4.1 General Remarks

Several examples could be provided as regards the question how the legal rules outlined above are applied in practice, and more specifically, how the balance between individual rights and the development of science is struck in Belgium.

4.2 Issues Pertaining to (Presumed) Consent for Obtaining HBM

As established above, informed consent constitutes the general principle in biobank research for the valid procurement of HBM and associated data. However, consent is absolutely required only in situations whereby samples are collected for primary use.

For secondary use of HBM for research purposes, the Belgian legislation gives the possibility to procure HBM without consent. This will be the case if it is impossible to seek the donor’s consent (for instance, the donor is deceased), or if such a request would be exceptionally inappropriate. In such instances, the positive opinion of an ethics committee would be sufficient to allow the collection of samples.Footnote 87

Even more significantly, the concept of presumed consent for residual use of HBM is part of Belgian law. It is always presumed that consent has been given, unless the donor has explicitly refused before any operation was performed on the samples.Footnote 88 This could be seen as a unique ‘opt-out’ consent system with very practical roots.

The concept of informed and explicit consent has had a central place in biomedical research since it was first embedded in the Nuremberg code.Footnote 89 It is inextricably linked to the principles of human dignity and autonomy, and to the protection of the privacy of the individual, and it is seen as the practical implementation of the right to self-determination.Footnote 90 Henceforth, at first glance the Belgian presumed consent system may seem to be in contradiction to the protection of fundamental rights. Indeed, according to some authors the opt-out consent system is ‘highly problematic’.Footnote 91 However, when discussing the procurement of HBM in practice, and the balance between relevant interests, regard should be held of the following considerations.

The nature of current biomedical research as such calls for the establishment of large pools of samples to ensure genetic representation for the correct testing of research hypotheses. This is especially prominent as the precision medicine approach is becoming more widespread. If HBM stored by biobanks is unrepresentative of society as a whole, future treatments for those not represented are likely to become increasingly scarce.Footnote 92 A practical way to deal with under-representation is presumed consent. When consent has been already obtained for the procurement of HBM for diagnostic/therapeutic uses, going back to the donor for a second consent for research purposes would result in additional costs (as it will require more time and efforts), or it might prove impossible to obtain. Thus, the Belgian presumed consent fosters the development of science. Koslakidis and el. further argue that an opt-out system may be seen as part of an ‘altruistic societal obligation’ for the common good.Footnote 93 This directly refers to the principle of solidarity, part of the broader bioethical discourse surrounding transplantation for years. For instance, in Belgium, presumed consent for organ donation was established in 1986 with the Law regarding the removal and transplantation of organs. Therefore, the opt-out system in the framework of research biobanking could be viewed as a logical continuation of a long-standing tradition.Footnote 94

4.3 Issues Pertaining to the Processing of Data Associated to HBM

With respect to the processing of associated personal data, the GDPR and the implementing Belgian Act of 30 July 2018 apply.

A legal basis is required for the valid processing of personal data. The choice of the correct legal basis is responsibility ofthe data controller.Footnote 95 In practice, there is a lack of sufficient authoritative guidance pertaining to the choice of the most suitable legal basis, and much uncertainty remains.

Recently, the European Data Protection Board (EDPB) issued Opinion No 3/2019 which concerns the interplay between the EU Clinical Trials Regulation (CTR) and the GDPR. At the moment, it is the first EPDB opinion to discuss biomedical research. Biobanking is neither harmonized at EU level, nor regulated in the EU CTR, however, some important conclusions related to it can still be drawn on the basis of Opinion No 3/2019, by way of analogy.

Firstly, the EPDB expressly stipulated that explicit consentFootnote 96 should not always be regarded as the preferred legal basis for the conduct of scientific research. In the context of a clinical trial, this is especially the case when processing is carried out for reliability and safety purposes, such as e.g., safety reporting or inspection by national competent authorities. The appropriate legal basis, as established by EPDB, is Article 9(2)(i)—‘processing is necessary for reasons of public interest in the area of public health’ read in conjunction with Article 6(1)(c)—‘legal obligations to which the controller is subject’.

Secondly, for pure research activities conducted in the framework of a clinical trial, the EPDB rightly acknowledged that the informed consent for participation in a trial must not be confused with consent as legal basis for the processing of data. Extrapolated to the context of biobanking, it seems reasonable to draw a similar distinction as regards the informed consent required to obtain HBM for primary use.

Further, the EPDB brought attention to the imbalance of power between a trial participant and the investigator/sponsor of a trial, which could affect one of the conditions for valid data processing consent, namely that it has to be ‘freely given’. In the context of biobank research conducted outside the context of a clinical trial, it could be argued that the power imbalance is not of the same nature, by virtue of the fact that sample donation does not involve the same risks pertaining to possible institutional or hierarchical dependencies that could inappropriately influence a patient’s decision to participate in a clinical trial. However, consent should still be regarded with caution when considered as the suitable legal basis for processing.Footnote 97

4.4 Issues Pertaining to Information Provided to the Donor of HBM

As established above, pursuant to the Belgian Act on HBM the consent of the donor for the procurement of HBM must be informed. In addition, concerning associated personal data, the GDPR in its Article 13 establishes an information obligation for the data controller. At the time the personal data is obtained, the data subject, i.e. the donor, must receive all of the information specified in Article 13(1) and (2).

The practice in Belgian biobanks is to provide general information about the biobank research via a patient brochure. This general information is not repeated later to the individual donor. It could be argued that, pursuant to Article 13 and 14 of the GDPR, for each research conducted on human body material and for each related processing of personal data, the donor should be individually informed.

Furthermore, more specific information is provided by the biobank when the donor’s informed consent is obtained. At the current moment a national sensibilization campaign is in development with the aim to inform the general public about the nature and aims of biobank research, similar to organ donation campaigns in the past.

When it comes to information considerations within the Belgian context, one practical challenge might be present in the case of residual use of HBM, as consent for it is presumed, henceforth the donor does not have access to the more specific information that is typically provided during the informed consent procedure. Another unresolved issue is that under the current legal framework, donors cannot indicate that they do not want to receive information. A parallel could be made with the ongoing debate regarding return of research findings in biomedical research and the psychological stress endured by some donors.Footnote 98

5 GDPR Impact and Future Possibilities for Biobanking

5.1 The Impact of GDPR on Biobanking in Belgium

In addition to the points already presented throughout this Chapter, several more issues related to the impact of GDPR on biobanking in Belgium can be selected for discussion. This part aims to open room for debate and pose questions for further research on the theoretical and practical challenges that the current legal frameworks present.

5.2 Allocation of Responsibilities According to Biobanking and Data Protection Rules

Article 5(2) of the GDPR establishes the principle of accountability, according to which the data controller is responsible and should be able to demonstrate compliance with all other data protection principles. In the Belgian biobank framework, the unique concept of custodian is established. According to the law, the custodian can only be a natural person, more specifically a medical doctor, and should fulfill a specific set of strict eligibility conditions.Footnote 99 It is the custodian who is specifically entrusted with the responsibilities of a data controller.Footnote 100 However, the custodian carries a set of additional obligations, assigned to him under the legal framework for biobanking.

It is outside the scope of this article to carry out an in-depth comparative study of the figures of the data controller and the biobank custodian, and more specifically, on how the custodian may exercise most suitably the dual responsibilities allocated to him by the two set of applicable rules. However, a meaningful line for further research may concern the influence that the notion of controller has over the performing of custodian duties in practice. Vice versa, insights into how the concept of custodian may bear an impact on the notion of controller in Belgium would be useful. Such research would be of help for the much-needed alignment between data protection and biobank rules.

Further layers of complexity as regards the allocation of responsibilities exists in the field of clinical trials and other interventional studies. As stated in Sect. 1.2 above, the Act on HBM is not applicable to the sampling and operations conducted in the framework of a clinical trial on medicinal products for human use. However, when it comes to studies performed to test medical devices,Footnote 101 studies for in vitro medical devices,Footnote 102 or other types of studies, e.g. a surgical study, no such exception is provided for and the biobank legislation applies in full. A collision might be envisaged between the figures of the sponsor of such a study, the biobank custodian, and the notion of data controller. Pursuant to biobank rules, the custodian is in all cases a data controller.Footnote 103 In the context of an investigational study, it could be argued that the study sponsor would be the data controller, as the natural or legal person that determines the purposes and means of the processing of personal data, associated to the HBM.Footnote 104 A more in-depth discussion is necessary as regards the responsibilities of sponsor and custodian in such a context and vis-à-vis the possibilities for joint controllership. Moreover, the foregoing begs further investigation into the national legislator’s reasons to exclude only one type of interventional study, namely clinical trials on medicinal products for human use, from the scope of the Act on HBM.

Finally, it is also of interest to discuss the fact that the Act on HBM becomes applicable to data and samples collected in the scope of a clinical trial, if they are later used for other research (i.e., secondary use). To illustrate, we use a hypothetical case, see Fig. 3. First, HBM and associated data are collected and used in the scope of a clinical trial: the Belgian biobank law would not be applicable, and the clinical trial sponsor would be the data controller. The biobank in which, tissues, samples, and associated data are stored, would be sub-contractor of the sponsor, and, moreover, data processor acting on behalf of the sponsor. Second, a number of years after the end of the trial, the sponsor may decide to conduct new research with the previously collected HBM and data. This would be possible, as long as all legal and ethical requirements for secondary use of data are complied with. In this situation, the Belgian biobank law would become available. Regarding roles and responsibilities, whereas the sponsor would remain data controller for the original full data set, the biobank manager would turn into joint-controller for the sub data set stored and processed in the biobank. Potential issues emerge. For instance, the biobank remains subcontractor, but pursuant to the Act on HBM, the biobank manager would now have the power to agree or not to the release of samples and data for research. Uncertainties exists also with respect to the agreements for further processing of data and samples, described in Sect. 2.1.7 above, as it is not clear whether the contract between the sponsor and a new recipient of HBM would be sufficient, or whether the biobank would have to sign their own agreement.

5.3 Allocation of Research Oversight Responsibilities Between Data Protection Officers and Ethics Committees

Another question that has not been investigated yet and that could present practical challenges in the future, is about the allocation of research oversight responsibilities between DPOs and ethics committees. On the one hand, some of the rights and responsibilities with which DPOs are entrusted seem to require expertise in ethics matters, especially when data processing activities are situated in a biobanking context. For instance, confusion may be brought up by the possibility for a DPO to provide opinion prior to the collection of personal data.Footnote 105 In such cases, it is generally expected that the DPOs would seek the advice of an ethical committee. However, ethics committees themselves are often lacking specific expertise when it comes to data protection matters. The right balance should be sought between these two important actors. Furthermore, efforts in education and cross-sharing of experience are required.

6 Future Possibilities for Biobanking

In relation to the many remaining uncertainties in the interpretation of the relevant legal rules, Article 40  of the GDPR offers a welcomed solution by encouraging the drawing up of codes of conducts. The codes of conduct are intended to contribute to the proper application of the data protection legislation in a specific processing sector, and their aim is to overcome fragmentation in implementation. Having in mind the particularly sensitive link between biobanking and data protection, such a comprehensive common interpretation of GDPR norms would have positive influence for fostering biobank research. At present, BBMRI-ERIC is in preparation of a code of conduct. As Belgium is among the few Member States who have a distinct biobank legal framework, it could be envisaged that the Belgian experience in regulating biobanking would be of high significance during the drafting of the code.

A second point to be considered when discussing the future, is collaboration, both on a national level (between biobanks), and on a broader European level. In this respect, the Belgian node of BBMRI-ERIC (BBMRI.be) is currently working on strengthening the harmonization of relevant Belgian policies within the broader framework of BBMRI-ERIC policies. In addition, the structure and governance of BBMRI.be was recently changed to allow biobank users to become part of the network besides the biobank providers. This change is an attempt to improve the interaction and best practices for sharing and mutual understanding of needs and challenges in the use and custodianship of HBM.

7 Conclusion

This chapter aimed to shed clarity on the intricate legal framework for biobank research in Belgium, and its interplay with data protection rules. We outlined the key legislative acts and soft law guidance in the field, and critically discussed their practical application. Belgium is among the few countries in Europe which have adopted a specific law for research biobanking. However, gaps and uncertainties remain, especially in relation to the joint application of the biobank and data protection laws. Creating a code of conduct applicable in daily research practice may be the way forward for a pragmatic implementation of all relevant legal and regulatory frameworks. Further suggestions for future investigations and discussions on pertinent questions on the topic were systematically made throughout the chapter.