1 Introduction

Denmark possesses excellent opportunities for biobank research and other forms of research relying on collections of human biological material and comprehensive datasets. Biobank and data-based research is facilitated by the use of a unique personal civil registration number, which was introduced in 1968 and is used widely in both the public and private sectors. The Danish legislation is also known to promote biobank research, due to a liberal attitude to the use of tissue samples for research purposes, the presumption being that the population is willing to contribute to research by providing both data and tissue samples.Footnote 1 Generally, the data- and biobank resource is also seen as an important competitive asset in attracting and retaining foreign research and investment in Denmark, in particular in the area of personalized medicine.Footnote 2 Given the number of biobanks and the strong interest in promoting biobank research, it is surprising that there is no specific biobank act in Denmark. Instead, the collection, storage and use of tissue samples for various purposes is regulated in a number of different laws, creating a rather complex legal situation.

2 Biobank Infrastructure and Regulatory Environment

2.1 The Danish Biobank Landscape

The Danish biobank landscape is composed of a vast number of public and private biobanks of various sizes and purposes. There are different categories of biobanks: clinical, research, donor, and commercial biobanks. Clinical biobanks deposit human tissue samples obtained and stored in a clinical context in which patients have been tested and received treatment in the health care services. Research biobanks are established with a research aim and with samples obtained from research participants or from other (clinical) biobanks. Donor biobanks have the aim of storing and providing human tissue samples for the treatment of patients. Finally, there are a few commercial biobanks that provide storage facilities for individuals, who wishes to deposit biological materials which cannot be stored within the public health care services.Footnote 3 In some situations, a biobank could seem to fall within two categories; e.g. when surplus material is collected in a clinical context with the explicit view to store it exclusively for research purposes. In this context, the sample has been obtained in a clinical context and from a patient (and not a research participant), and would therefore still be considered a clinical biobank.

There is no central register of all biobanks. Consequently, the exact number of biobanks and stored biological samples is unknown. There are a number of larger biobanks, most of which are located in the public sector, and with different functions (treatment, quality assurance, research). In the private sector, most biobanks are related to either private research projects or private companies, which uses samples for research (e.g., the pharmaceutical industry) or for commercial purposes (sperm or stem cell biobanks).

The Danish National Biobank was established in 2012, with the aim of strengthening the Danish infrastructure in biobank research to provide an overview easier access to samples for both Danish and international researcher. Organizationally, it is a department under the Statens Serum Institut (SSI), a public body coming under the Ministry of Health. The Danish National Biobank has three pillars (1) a register with detailed information about the samples available in the participating biobanks,Footnote 4 and which can be linked to disease codes and demographic information from national administrative registers on an individual level, (2) a physical biobank that stores and retrieves samples for researchers, and (3) a coordination center that offers know-how to researchers and external biobanks. The Danish National Biobank does not store the samples from all the participating research biobanks, but the biobanks regularly submit data to the above mentioned register. This should facilitate access for researchers who wish to obtain data from the biobanks and databases involved.

The register holds information about 13 biobanks among which the biggest and most important are:

  • The Danish Patobank (more than 17 million tissue samples from pathology departments in Danish hospitals)

  • Blood samples from all newborn (in Denmark) since 1982 (more than 2 million samples)

  • Cancer biobank (blood and tissue samples from cancer patients).

  • Danish birth cohort (more than 600,000 samples from pregnant women and newborns).

2.2 Collection of Samples

In contrast to other countries, there is no special biobank legislation in Denmark. The regulation of biobank research in Denmark relies on cluster of acts, of which the Act on Research Ethics Review of Health Research ProjectsFootnote 5 together with the Data Protection ActFootnote 6 are the most important. The Health ActFootnote 7 is also relevant.

In order better to understand how the different pieces of legislation interact, it is important to know how tissue samples are collected, and how they can end up in biobank research. The focus will here be on clinical and research biobanks, which are the most important tissue collections in regards to biobank research. Most tissue samples are collected when patients seek diagnosis and treatment from the health care services. The right to self-determination is an important patients’ right in Denmark, and collecting tissue samples will, according to section 15 and section 16 of the Health Act,Footnote 8 normally require the patient’s informed consent, as it involves an intrusion of the body. After having served their clinical purpose, some tissue samples are stored in a biobank, and may subsequently be used for research or other purposes. The storage of tissue samples does not require a separate consent, as it is considered to be authorized by section 7(3) of the Data Protection Act, which refers to Article 9(1) of the GDPR (see more details below).

The general provision regarding informed consent is concerned with consent to treatment and medical interventions and does not automatically imply a duty to inform the individual patient about the storage and possible future use of tissue samples. However, it is considered to be part of a general administrative service obligation owed to patients to provide general information for example in a general patient information leaflet. The GDPR may also prescribe an obligation to inform the patients (see below).

Patients’ right to self-determination in relation to stored samples is also recognized in the Health Act (section 29), which entitles patients to opt out with regard to the further use of samples, obtained in a clinical setting, for research purposes. This can be done by signing up in a special ‘Use of Tissue Register’ (Vævsanvendelsesregisteret). There is no obligation to provide individual information to patients about Use of Tissue Register, but it is expected that general information about the register is available, e.g. in a general patient leaflet.Footnote 9 Around 3000 individuals have signed up since this register was introduced in 2004.Footnote 10 In addition, patients are normally entitled to retrieve the samples or demand their destruction (Health Act, section 33–34). This allows them to have some control over the further use of samples obtained in a clinical setting. Furthermore, it imposes a duty on biobanks to ensure that samples are not handed over for research purposes, when patients have registered in the Use of Tissue Register.

Tissue samples can also be obtained from deceased persons, and this will normally also require informed consent from either the deceased person (advance directive) or the relatives (when they consent to an autopsy). Before consenting to an autopsy, the person or relatives must be informed that parts of the deceased’s body may be used for research purposes (Health Act, section 187).

Another important setting for collection of tissue samples is research projects, where tissue samples are taken from individuals who participate in a research project. The rights of research participants follow from the Act on Research Ethics Review of Health Research Projects.Footnote 11 Research participants must provide a written, informed consent to research participation and to the interventions involved in the participation, and they must on beforehand be provided with proper and comprehensive information about the project including the aim of the collection of tissue, the predicted future use and the storage period. Consequently, in this situation, a specific consent is required for both collection, storage and further use of tissue samples.

Tissue samples are also increasingly being collected outside the context of a specific research project, that is, with the aim instead of building up a research biobank, which could be used for unspecified future research projects. Collection for this purpose is taking place in both clinical and research settings, in which patients are asked to donate surplus samples to be stored specifically for future research. The Danish legislation on research ethics review of health research projects does not apply in this situation, as it is restricted to assessing actual research projects. However, collection of samples for those biobanks must comply with the provisions in the Health Act (and in the Data Protection Act) regarding informed consent.

In addition to the Health Act and the Act on Research Ethics Review of Health Research Projects, the Danish Data Protection ActFootnote 12 and GDPR also have an impact on collection of tissue samples. The Data Protection Act supplements the GDPR in areas where there is room for national discretion. Together with the GDPR, the Data Protection Act substitutes the previous Act on the Processing of Personal Data, which was based on the former EU Directive on Processing of Personal Data. When the Act on the Processing of Personal Data came into force in year 2000, it was debated and decided that tissue samples, which could be related to an identifiable person, should be considered as personal data under the Act.

The new Data Protection Act does not explicitly state in the Act or the preparatory work whether it generally applies to processing of human tissue samples or not. However, the Act has a specific provision concerned with processing of tissues sample (section 10 (3)). Accordingly, it is the general view that the Data Protection Act, like the previous Act on Processing of Personal Data, applies to processing (e.g. collection and storage) of tissue samples, which can be related to an identifiable person.Footnote 13 Collection and storage of tissues samples in the health care services is authorized by section 7(3) of the Data Protection Act which stipulates, that processing of data covered by Article 9(1) of the GDPR, can take place, if the processing is ‘…necessary for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment, or the management of medical and health care services, and where those data are processed by a health professional subject under law to the obligation of professional secrecy, see point h) of Article 9(1) of the General Data Protection Regulation’. This implies, that no explicit consent is needed for the collection and storage of samples. However, there is an obligation to inform the individual about the collection and storage of the data.Footnote 14

To summarize: The collection of tissue samples will always require an informed consent from the patient/research participant. The storage of samples in a biobank requires informed consent when samples are collected in a research project, whereas samples collected in a clinical context can be stored without consent. However, the patient has in certain situation a right to retrieve the samples or demand their destruction according to the Health Act. Research participants are entitled to comprehensive information, including information regarding storage of samples and the storage period. Patients’ are not entitled to this information according to the Health Act, but the GDPR requires that such information should be provided to all data subjects.

2.3 Regulation of Biobank Research

The complexity of the legal framework regarding collection of samples also exists in regards to regulation of biobank research, where the same pieces of legislation interacts.

The Act on Research Ethics Review of Health Research Projects governs the establishment of research ethics committees at regional and national level and lay down rules for ethical evaluation and authorization of health research projects. This also includes regulation of informed consent to collection and storage of data and tissue samples for scientific purposes (sections 3–6),Footnote 15 and the further use of previously collected tissues samples for scientific purposes (sections 10). The Act applies exclusively to health research projects and not to research within other disciplines. Most biobank research will be categorized as health research projects.Footnote 16

All health research projects involving human research subjects or human tissue in biobanks must according to section 14(1) of the Act, obtain prior authorization from a research ethics committee (REC) before it can commence.Footnote 17 The overall aim of the Act on Research Ethics Review of Health Research Projects is to ensure a balance between the interests and protection of research subjects and the interests of society and science. Its main focus, therefore, is on scientific quality, risk assessment and respect for research participants’ autonomy and right to self-determination. Section 1 of the Act emphasizes, that in balancing the respective interests, the priority should be given to the interests of the research participant. Data protection issues are not explicitly mentioned in the Act, but they are part of the risk assessment, and they are also addressed in an executive order issued with a legal basis in the Act.Footnote 18

In research project involving individuals as research participants, the informed consent of the research participant is needed for the collection and storage of tissue samples, and information about the predicted future use and the storage period must also be provided (see also above in Sect. 2.2). However, research projects can also be based exclusively on tissue samples from a biobank. Such projects are also subject to the requirement of prior authorization from a REC. The normal rules of the Act on Research Ethics Review of Health Research Projects apply to biobank research projects, which imply that the tissue donor’s informed consent is required. However, with regard to biobank research, section 10 of the Act provides for derogation from this legal principle, and the REC may decide to make an exception, provided the project does not possess any risks, or if it would be impossible or disproportionately difficult to obtain consent or proxy consent.Footnote 19

This implies that biobank research based on samples from a clinical biobank can take place without the consent and knowledge of the patient, from which the sample was collected. However, as explained above (Sect. 2.2), the patient can prevent the use of samples for research purposes by registering in the Use of Tissue Register. Biobank research can also be based on samples from a research biobank, where samples have been collected for another research project (and purpose). Even though the tissue donor has consented to the collection and storage of samples for the original project, this consent does not necessarily cover subsequent use of the samples for another project. The REC will assess the project, but the research participant, from whom the sample was collected, does not have the same option as the patient to prevent further research on the samples by registering in the Use of Tissue Register.Footnote 20

All research projects involving research participants and tissue samples will imply processing of personal data. The Danish Data Protection Act takes advantage of the research exemption laid down in Article 89 of the GDPR. According to section 10(1) of the Act, ‘Data as mentioned in Article 9(1) and Article 10 of the General Data Protection Regulation may be processed where the processing takes place for the sole purpose of carrying out statistical or scientific studies of significant importance to society and where such processing is necessary in order to carry out these studies’. This means that personal data—including tissue samples which can be related to a person—can be used for research purposes without the data subject’s prior, explicit consent. In general, the processing of data and tissue samples must respect the GDPR and the Data Protection Act, but there are some exemptions from the data subjects’ rights (see below in Sect. 3). In order to secure the data subjects’ rights and interests, section 10(2) stipulates that data used for research purposes may not subsequently be used for other purposes, and according to section 10(3) disclosure of data to third parties requires prior authorization of the Data Protection Authority, if the disclosure involves human tissues samples, or if data are disclosed to thirds parties outside the jurisdiction of the GDPR.Footnote 21 It is generally expected, that data and tissue samples are anonymized or pseudonymized whenever possible, and that the results of the research project are not communicated in a form making the individual, from whom the tissue sample was collected, identifiable.

In general, researchers are themselves responsible for complying with the legislation. However, a number of bodies have supervisory authority. The regional research ethics committees together with the National Research Ethics Committee and the Danish Medicine Authority have supervisory and oversight authority in regards to health research projects. The Medicines Authority supervises clinical trials, and the regional research ethics committees and the National Research Ethics Committee supervises other health research project, which they have approved.Footnote 22 General supervisory functions ensure that results from research projects are reported after being completed, that the researchers apply for an extension of the project, if it cannot be completed within the timeframe set out in the authorization. More targeted supervision and oversight can be initiated based on information received from research participants or third parties, or if a specific research project gives rise to concern in terms of compliance with the rules and regulations. The National Research Ethics Committee also serves as a complaints board for decisions taken by the regional research ethics committees. The Danish Data Protection Agency, which is an independent body, has the responsibility laid down in Chapters VI and VII of the GDPR to monitor the processing of data and tissue covered by the Data Protection Act, the GDPR and other legislation. It can also receive complaints and perform inspections.Footnote 23 There are examples of supervision and oversight of research projects which has provoked criticism from the Data Protection Agency.

3 Individual Rights and Safeguards

Individuals have important interests and rights in regards to the use of tissue samples for research purposes, such as the right to self-determination and the right to privacy. The general data protection principles stipulated in the GDPR (Article 5) also emphasises the importance of proportionality and transparency in regards to the processing of data and tissue samples. In addition, the GDPR also outlines more specific right of the data subject (Articles 13–22) and requires that safeguards are in place, when national laws accept the use of sensitive personal data for research purposes (Article 89 (1)).

As will be clear from the analyses and description of the regulatory framework for biobank research (Sect. 2), the rights and safeguard for individuals, who contribute with tissue samples to research, depends on how the samples are collected. In general, the protection of privacy seems to be observed both when samples are collected in the clinic and as part of a research project. In regards to the right to self-determination, it seems that the rights of research participants are better protected than those of patients. In contrast to patients, each individual research participant is entitled to comprehensive written and oral information about the storage and further use of tissue samples, and must give an explicit written consent to research participation. This both support a right to self-determination and serves to ensure transparency. In comparison, patients are not entitled to receive individual information about storage and further use of tissue samples. It is sufficient that general information is publicly available; e.g. in a leaflet or on a website.

However, in regards to the further use of tissue samples stored in clinical or research biobanks, patients’ right to self-determination may be better protected than the rights of research participants. If patients are aware of their right to retrieve and demand the destruction of tissue samples, they may retain control over the samples. In addition, they have the right to opt out of the further use of the samples for research purposes by registering in the Use of Tissue Register. In comparison, the research participant may experience that tissue samples are handed over to other researchers, or used for other research purposes, without having the same right to opt out as the patient. This is because the Use of Tissue Register only applies to samples stored in clinical biobanks. Consequently, both patients and research participants may end up in situations, where their right to self-determination is poorly protected and with a lack of transparency.

Some of the specific rights of data subjects stipulated in the GDPR could potentially be helpful in this regard, e.g. the duty to inform the data subject, when data are not collected directly from him (Article 14). However, this obligation does not apply, if it is impossible or would involve a disproportionate effort to fulfil it (Article 14(5)(b)). Processing of data for research purposes, subject to the conditions referred to in Article 89(1), is specifically mentioned as an example. Similarly, the right of access (Article 15) could provide some transparency to patients or research participants, who wishes to know for which purposes their data and tissue samples have been used. However, the Danish Data Protection Act (section 22(5)) in accordance with GDPR Article 89(2) explicitly derogates from the rights of the data subjects laid down in GDPR Article 15, and the same derogation apply in regards to GDPR Article 16 (right to rectification), Article 18 (right to restriction of processing) and Article 21 (right to object). Consequently, it seems that the research exemption is a ‘carte blanche’ for derogation from other rights of the data subjects.

The GDPR Article 89(1) requires that certain safeguards must be in place when sensitive data are processed for scientific purposes. These safeguards shall include technical and organizational measures to ensure respect for the data minimization principle, e.g. the use of anonymization or pseudonymization whenever this is possible without hampering the research purpose. According to the preparatory work to the Danish Data Protection Act anonymization or pseudonymization should be used when possible. In addition, the Act also prohibits the use of data obtained for research purposes for other purposes (e.g. administrative purposes). It is, however, possible to derogate from this prohibition by rules laid down by the Minister of Health in situations, where such processing is necessary for safeguarding the vital interests of the data subject (section 10(5)). This could e.g. apply in situations where genetic research reveals incidental findings, which could be of significant importance for individuals’ health.

Further safeguards are outlined in section 10(3) which stipulates that an authorization from the Data Protection Authority is needed, when data are transferred to a third party outside the territorial scope of the GDPR, and in all cases where tissues samples are transferred to third parties (both within and outside the territorial scope of the GDPR). In addition, authorization is needed in situations where data will be transferred with a view to be published in a widely recognized scientific journal (or the like).

4 Law in Context: Individual Rights and Public Interest

The Danish Act on Research Ethics Review of Health Research Projects, place the individual at the center of attention when stressing (in section 1) the priority of the research subject against the interests of society and science. However, with regard to biobank research the Act allows for derogations from the consent requirement, and in practice derogation seems to be the main rule and not an exception. This reflects a perception of biobank research being less harmful, than other kinds of research—if just the privacy of the research subject is protected, and data cannot be used for other purposes, what should be the concern? This perception ignores the individual’s interest in transparency and self-determination in regards to the use of sensitive data, which are important elements in paying respect to the dignity of the individual. It could also be added, that the possibility of protecting research subjects’ privacy may be reduced or disappear in big data and genetic research (as personalized medicine). The Danish National Committee on Health Research Ethics has issued guidelines for genomic research (including biobank research) to ensure better awareness of the interests of research participants.Footnote 24

As explained above (Sect. 2.3), the Act on Research Ethics Review of Health Research Projects only applies to research involving research participants and tissue samples from human beings. Research projects exclusively based on data does not fall under the scope of the Act. This has proven to be problematic in regards to data generated by comprehensive genetic analyses of tissue samples (e.g. using WGS or GWAS techniques). Whereas the analyses of the samples would need REC authorization, subsequent research on the retrieved data (bioinformatic data) was until recently exempted from ethics review. As the data reflects the information embedded in the samples, and are just as sensitive and worthy of protection as the actual sample, a recent ammendment to the Act on Research Ethis Review of Health Research Projects (December 2019) requires mandatory ethics review for research projects based on sensitive bioinformatics data, where there is a risk of secundary findings.Footnote 25 This reflects how the boundaries between the body and data is being increasingly blurred.

5 GDPR Impact and Future Possibilities for Biobanking

So far, the GDPR has not had any major impact on the Danish legal regulation of biobank research; apart from slightly weakening the former safeguards. Under the previous act, the authorization of the Data Protection Authority was needed for any kind of disclosure of data to third parties, also third parties within Denmark and the EU. However, the GDPR could potentially have an influence on the Danish regulatory environment, especially in regards to stimulating awareness of the rights of data subjects. It will e.g. be interesting to see, whether the Court of Justice of the European Union will require more substantial justification for derogations from the rights of individuals whose data and tissue samples are used for research (e.g. pseudonymization and notification requirements, access rights and right to be forgotten). The Danish Data Protection Act express the perception that any kind of rights assigned to the research subject, will impede the research process. This perception could be challenged to ensure more general awareness of data subjects’ rights. In addition, the GDPR could also encourage the development and use of technical solutions which could promote privacy and informational self-determination by design.

6 Conclusion

As will be clear, the Danish regulatory framework for biobank research can be characterized as ‘research friendly’. The explicit consent from the research participant is only necessary in projects where individuals are directly recruited as research participants. In other situations, it is presumed that patients and persons, who have previously participated in research, are willing to contribute with samples for research. If this is not the case, the individual must actively opt-out—and in some situations it is even not possible to opt-out. This raises the issue of whether the legal situation is compliant with section 1 of the Act on Research Ethics Review of Health Research Projects which prescribes, that priority should be given to the interests of the research participant, when balancing the interests of respectively society, science and the individual research participant.

However, it also provokes the question what we as individuals owe to society, especially in the context of a welfare society as the Danish. Respect for individual rights are beyond doubt important. However, a solidarity-based approach to research is also needed to ensure that we together with all other individuals can profit from new advances in medical technologies.Footnote 26