The Italian Way for Research Biobanks After GDPR: Hybrid Normative Solutions to Balance the Protection of Individuals and Freedom of Research

Abstract

The Italian context of biobanking is made up of a vast number of collections, in some cases well-organised and connected in virtuous networks and in others not identifiable as structured biobanks. From a comparative perspective, Italy can be regarded as a hybrid model, positioned between countries with full and detailed legislation concerning biobanks and those that rely only on guidelines published by national ethics committees or professional societies that have no binding legal value. In countries like Italy where the need for specific regulation is more urgent, the entry into force of the GDPR could have offered a chance to fill the gap in the legislation with regard to biobanking for medical scientific research purposes. This overview highlights the improvements made and the obstacles that persist.

Although the work is the result of a joint reflection of the two authors, paragraphs 2 and 5 can be attributed to Marta Tomasi and paragraphs 3 and 4 to Simone Penasa. Paragraphs 1 and 6 were elaborated by both authors. In writing the chapter the authors also took advantage of their previous publications, in particular, of Macilotti M, Penasa S, Tomasi M (2015) Consent, Privacy and Property in the Italian Biobanks Regulation: A Hybrid Model within EU?. In: Mascalzoni D (ed) Ethics, Law and Governance of Biobanking. Springer, Dordrecht, pp 53–77.

1 Introduction

The Italian context of biobanking is made up of a vast number of collections, in some cases well-organised and connected in virtuous networks and in others not identifiable as structured biobanks. Italy lacks ad hoc regulation for biobank research activities. Thus, the protection of participants and donors’ rights must be derived from different legal sources, and these concern, in particular, personal data protection. Among these, a key role is played by non-legislative regulations adopted by administrative authorities upon delegation by the legislator. This approach has created a hybrid model of protection that positions Italy comparatively between countries with full and detailed legislation concerning biobanks and countries which only rely on guidelines published by national ethics committees or professional societies that have no binding legal value. The main reference points in Italy are the general Authorisations issued by the Italian Data Protection Authority (DPA): Authorisation no. 8/2016 on the processing of genetic data, and Authorisation no. 9/2016 on the processing of personal data for scientific research purposes.

The GDPR offered Italian legislators the opportunity to reconsider the whole system and to design a more comprehensive framework of protection. The Italian legislature decided to take advantage of the possibility given by the GDPR to Member States to introduce further limitations with regard to the processing of some kinds of data¹ and to instruct the DPA to identify the special conditions for the processing of health and genetic data.² To update the general Authorisations adopted in the past, the DPA opened up a public consultation which it was hoped would prove an effective instrument for different stakeholders involved in biobanking activities to highlight the deficiencies of the existing regulatory framework and to suggest structural improvements.

2 Biobank Infrastructure and Regulatory Environment

2.1 The Italian Biobank Landscape

The Italian biobank landscape is composed of a vast number of collections of samples and data, not always identifiable and organized as structured biobanks. The main categories of biobanks are clinical and research biobanks. Clinical biobanks are deposits of human tissue samples stored in a clinical context and obtained from patients who have been tested and received treatment in healthcare services. Research biobanks are ones established with a research aim and with samples obtained from research participants or from other (clinical) biobanks.

The only official collection at the national level is the Italian DNA database, the establishment of which was provided for by Law no. 85/2009 titled ‘Adhesion of the Italian Republic to the Prüm Treaty. Establishment of national DNA database (NDNADB) and the central laboratory for the NDNADB’, with the aim to facilitate the identification of those who might have committed crimes.³ With regard to clinical and research biobanks, there is no central register. Consequently, the exact number of biobanks and stored biological samples is unknown.

To improve and strengthen the Italian infrastructure for biobank research and to provide an overview and easier access to samples for both Italian and international researchers, the Italian node of BBMRI was established through a joint effort by the Ministry of Health and the Ministry of University & Research. This brings together the National Institute of Health (Istituto Superiore di Sanità), the National Center for Research (Consiglio Nazionale delle Ricerche), 18 universities, 22 institutes for care and research (IRCCS), institutions for hospitalisation and care closely linked to translational research, and patient associations. BBMRI-IT has two main goals: to provide new common services for the community of the Italian biobanks, and to contribute to pan-European research infrastructure BBMRI-ERIC.⁴

According to their website, a survey has been designed to assess and select well-established Italian biobanks in terms of quality and richness of samples and data and to identify biobanks available to provide services to the BBMRI network. Indeed, according to their website, ‘the Italian node has specific scientific skills that it can share with the other national nodes about informatics, molecular analysis in archive tissues and ELSI’.⁵ BBMRI-IT includes 90 biobanks/biological resource centres/collections, mainly disease-oriented (oncological, genetic, multi-specialist), and organised into thematic and regional networks.

With regard to participation in activities organised as partnerships which give birth to national and international networks focused on specific objectives, a relevant example is the Telethon Network of Genetic Biobanks. It was founded in 2007 and is a research project financially supported by Fondazione Telethon. It is presently composed of 11 biobanks and stores about 100,000 biological samples, representing approximately 950 distinct rare genetic diseases.⁶

The Italian biobank landscape is completed by networking initiatives carried out at the regional level: Italian Regions, in fact, are in some cases involved in a series of initiatives to organise activities connected with biobanking and are in charge of the recognition of regional accredited biobanks.⁷

Population biobanks are also an important reality, given the existence in Italy of populations that can be considered genetic isolates. A recent example that was widely reported concerns the events that affected a collection of biological samples and data in the region of Sardinia.⁸ The collection belonged to Shardna, a company created in 2000 through a public-private partnership as the first of its kind in Italy in the field of genomics research. Shardna’s research focused on identifying genetic and environmental factors that carry a predisposition to common multifactorial diseases through the study of a genetically homogeneous population from the isolated communities in the Ogliastra region in Sardinia. The biobank included 230,000 biological samples from the almost 13,000 fully genealogically-linked residents of that region. Nearly 10 years after its creation a controversial bankruptcy case engulfed the company, which sparked concern among the participants. The case led to a couple of decisions by the national DPA and one by the Tribunal of Cagliari which represent a fascinating point of reference to investigate how the interests of participants and freedom of research can be assessed in the Italian regulatory framework.⁹

2.2 Regulation of Biobank Research and Collection of Samples

In contrast to many countries, there is no special biobank legislation in Italy. The regulation of biobank research can be framed under the general data protection legislation and also in terms of the processing of biological samples.

More precisely, Italy can be regarded as a ‘hybrid model’,¹⁰ as mentioned earlier. The hybrid nature of the Italian model is mainly due to the role played by the national DPA, an independent administrative authority which is also established as the supervisory authority responsible for monitoring application of the GDPR. In the broader framework of the Italian legislation primarily related to the protection of personal data, it is the DPA which implements the GDPR and is in charge of identifying the conditions under which some personal data processes can occur. In particular, the DPA issued a general Authorisation concerning the processing of genetic data, considered as a category deserving special conditions of protection (general Authorisation no. 8/2016) and a general Authorisation for the processing of personal data for scientific research purposes (general Authorisation no. 9/2016). The conditions set out by the DPA mainly give regard to the purposes of use, the requirements for collection and storage, and communication and information duties. However, as will be explained below, the contents of both Authorisations are being reconsidered in the light of the new framework created by the entry into force of the GDPR.

In general terms, in Italy samples can be collected for clinical purposes or for research purposes. The patient/participant’s informed consent is normally required as procedures involve intrusion into the body. Beyond international and European provisions (such as Article 5 of the Oviedo Convention¹¹ and Article 3 of the Charter of Fundamental Rights of the European Union¹²) the principle of consent is enshrined in Article 32.2 of the Italian Constitution and it has recently been reinforced in ordinary legislation.¹³

After having served their clinical purpose, some tissue samples can be stored in a biobank and may subsequently be used for research or other purposes. In this case, unless anonymisation occurs, the rules relating to the processing of personal data apply. Biological samples, which are considered as mere ‘supports’, basically follow the rules relating to the processing of personal data.

Before the entry into force of the GDPR, the Code of Privacy¹⁴ provided that data disclosing health and sex life should be kept separate from any other personal data and that they might not be disseminated¹⁵ without the written consent of the data subject.¹⁶ The Code strictly specified the cases in which the processing of health data could be allowed—under the prior DPA’s authorisation and when the purposes concerned either a third party or the community—even without the data subject’s consent in the cases expressly provided for by the legislation.¹⁷ With regard to genetic data, the Code of Privacy provided that their processing was legitimate only under the conditions set by the Authorisation released by the DPA. Legislative decree no. 101/2018, which was adopted to implement the provisions of the GDPR, introduced art. 2-septies to the Italian Code of Privacy that provides for special guarantees for the processing of genetic, biometric and health-related data, and modified Article 110 of the Code of Privacy. The normative changes introduced by this reform uphold the mechanism of general Authorisations to be issued by the DPA, but their contents are undergoing a process of revision and reconsideration, also through a public consultation.¹⁸

The general Authorisation for the processing of personal data for scientific research (no. 9/2016) allows the processing of data suitable for disclosing health, even without the data subjects’ consent, for scientific research purposes in the medical, biomedical or epidemiological sectors, subject to compliance with the limitations and conditions laid down by the same Authorisation and exclusively if the data are indispensable to achieve the purposes of the research. The Authorisation, in particular, sets out four requirements: (i) the processing must be necessary to conduct studies; (ii) the research project should not have any significant, personal impact on the data subjects themselves; (iii) the research project should rely on data or samples collected beforehand for healthcare purposes or should implement prior research projects; in addition (iv) the project must obtain a reasoned and favourable opinion from the competent ethics committee.¹⁹

In the case of genetic data, Authorisation no. 8/2016 requires the written informed consent of the ‘person concerned’, who can freely, and at any time, withdraw consent. With specific regard to the processing for scientific and statistical purposes, the Authorisation requires the data subject to be informed about whether the data and/or biological samples are to be retained and used for other scientific and statistical research purposes, which shall also be specified appropriately. Where it is impossible to inform the data subjects, and all reasonable efforts have been made to contact them, further retention and use of the data or samples is allowed for research projects other than the initial one. However, this is only when: (i) research for similar purposes cannot be performed by processing data relating to individuals who can, or have been able to, provide their informed consent; (ii) the processing does not allow the identification of the data subjects; (iii) there is no proof that the data subjects have objected; and (iv) an ad hoc authorisation by the national DPA is released after obtaining a reasoned and favourable opinion from the competent ethical committee.

It is clear that neither of the two Authorisations contains provisions directly addressing biobanks. Their regulation should therefore be based on general provisions concerning storage of samples and data and the possibilities of secondary uses for research purposes.

3 Individual Rights and Safeguards

3.1 General Remarks

The way in which the balance between the interests of the participants and the interests of the research is configured can be deduced from the joint reading of some legislative provisions that have been introduced following changes brought by the GDPR and of some provisions adopted by the national DPA.

3.2 ‘Further Conditions’ and the Role of the National DPA

Legislative decree no. 101/2018 introduced Article 2-septies in the Italian Code of Privacy that provides for special guarantees for the treatment of genetic, biometric and health-related data. It specifically implements the clause provided by Article 9, paragraph 4 of the GDPR (processing of special categories of personal data), according to which ‘Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data’. Further conditions, in particular, have to be found in Authorisations issued by the national DPA.

At the legislative level, Article 110 of the Code of Privacy, which has been amended by the Legislative decree no. 101/2018 in order to adapt it to the GDPR, states that consent of the data subject for the processing of health data, for the purpose of scientific research in the medical, biomedical or epidemiological fields, is not necessary when the research is conducted on the basis of laws or EU law, in accordance with Article 9, paragraph 2, point j) of the GDPR.²⁰ According to the same provision, consent is also not necessary when, due to particular reasons, informing the interested parties is impossible or implies a disproportionate effort, or risks seriously damaging or making the achievement of the aims of the research impossible. The Legislative decree does not clarify the exact scope of the concept of ‘particular reasons’ which makes it impossible to contact the interested person, thus leaving quite a broad margin of appreciation.

At the same time, in order to balance the lack of consent with other conditions, Article 110 provides that in such cases:

• (a) the data controller adopts appropriate measures to protect the rights, freedoms and legitimate interests of the data subject;

• (b) the research programme is the object of a motivated favourable opinion by the competent ethical committee at the territorial level; and

• (c) the research must be submitted to prior consultation of the guarantor pursuant to Article 36 of the Regulation.²¹

3.3 Balance Between the Lack of Consent and Further ‘Appropriate Measures’ of Protection: Secondary Use of Data and Samples

The possibility to bypass the need to receive the written consent of the data subject is counterbalanced by the establishment of a set of requirements that are both substantive and procedural. These should be ‘appropriate measures’²² to protect rights and freedoms, and involve an ethical committee (favourable opinion) at the local level and the authority at the national level (consultation).

This regulatory framework is further developed by the national DPA Authorisation no. 9/2016. When it is not possible to acquire the consent of the data subjects, the data controller must document in the research project the existence of the reasons, considered entirely special or exceptional, why informing the interested parties is impossible or entails a disproportionate effort, or seriously prejudices or makes impossible the achievement of the aims of the research. This occurs, in particular, in three cases.

The first is when ethical reasons arise related to the circumstance that the data subject ignores his/her condition. This category includes research for which the information on the processing of data to be made to the interested parties would involve the disclosure of information concerning the conduct of the study whose knowledge could cause material or psychological harm to the data subjects themselves (for example, epidemiological studies on the distribution of a factor that predicts or can predict the development of a morbid state for which there is no treatment).

The second is when it is not possible to acquire consent due to organisational impossibility attributable to the fact that the failure to take into account the data referred to the estimated number of data subjects that cannot be contacted to inform them, with respect to the total number of subjects involved in the research, would have significant consequences for the study in terms of alteration of the relative results; this related in particular to the inclusion criteria included in the study, the recruitment modalities, the statistical number of the chosen sample, as well as the period of time elapsed since the data referring to the interested parties were originally collected (for example, in cases where the study concerns subjects with diseases with a high incidence of mortality, in the terminal phase of a disease, or in old age and with serious health conditions).

The third is when health reasons exist which are attributable to the severity of the clinical status of the person in question because of which he/she is unable to understand the indications given in the information and to give valid consent. In such cases, the study must be aimed at improving the clinical status of the person concerned. Furthermore, it is necessary to prove that the purposes of the study cannot be achieved through the treatment of data referring to persons able to understand the indications given in the information and to provide valid consent or other research methodologies. This should have regard, in particular, to the inclusion criteria foreseen by the study, to the enrolment modalities, to the statistical number of the chosen sample, as well as to the reliability of the results achievable in relation to the specific aims of the study. When the genetic data treatment is due to health reasons, the consent of persons with an incapacity or inability to act must be acquired as soon as health conditions allow it.

The deontological rules for treatments for statistical or scientific research purposes apply to all treatments carried out for statistical and scientific purposes.²³ These should be in accordance with the methodological standards of the relevant disciplinary sector which are held by universities, research institutes and scientific societies, as well as researchers operating within them. In expressing his/her consent to a medical or epidemiological investigation, the interested party is required to declare whether he or she wants to know about any unexpected discoveries that emerge about him/her during the research. If the party declares such an interest, the personal data that can reveal the state of health can be disclosed to him/her or, in the case of physical incapacity or inability to understand, to those who legally exercise representation, to a near relative, a family member or a trustee (Article 8).

3.4 Pseudonymisation, Minimisation and the Storage of Data and Samples

In the light of Article 89 GDPR, general Authorisation no. 9/2016 concerning the processing of personal data for scientific research purposes provides that encryption or pseudonymisation techniques or other solutions are to be adopted where the research cannot achieve its goals without the identification, even temporary, of the interested parties. These techniques, considering the volume of the data processed, the nature, the object, the context and the purposes of the processing, make data not directly traceable to the interested parties, allowing them to be identified only when necessary. In these cases, in general, codes cannot be deduced from the personal identification data of the data subjects. This rule can be overturned upon written justification in the research project if the particular characteristics of the treatment require so and if it implies a manifestly disproportionate use of resources. The link between the research material and the data identifying the interested party, which is temporary and essential for the result of the research, is also justified in writing. In application of the principle of minimisation, the processing of personal data for scientific research purposes in the medical, biomedical or epidemiological fields may concern data able to reveal the health status of the data subjects, their sex life or their racial and ethnic origin, only if they are indispensable for the achievement of the research objectives (Article 5, paragraph 1, letter c) GDPR).

According to Article 99 of the Code (as modified by Legislative decree no. 101/2018), the processing of personal data for archiving purposes in the public interest, for scientific or historical research or for statistical purposes may be carried out even after the period of time necessary to achieve the different purposes for which the data were previously collected or processed. For the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, the personal data of which, for any reason, the processing of which has ceased, may be stored or transferred to another data controller in compliance with the provisions of Article 89, paragraph 1 of the GDPR. According to Article 106 of the Code, the Guarantoris allowed to establish ethical rules suitable to integrate the rules of the legislative decree, also with reference to the length of data conservation.

Authorisation no. 9/2016 provides that data and biological samples must be maintained only for a period of time not exceeding that necessary for the purposes for which they were collected or subsequently processed. A research project must declare a conservation period for the retention period, following the conclusion of the study, at the end of which the aforementioned data and samples should be anonymised.

According to Article 110-bis, the national DPA may authorise the further processing of personal data, including the special categories referred to in paragraph 9 of the GDPR (genetic data, biometric data or data concerning health) for the purposes of scientific research or for statistical purposes by third parties who mainly carry out such activities. This requirement is needed when, due to particular reasons, informing data subjects is either impossible, involves a disproportionate effort, or risks seriously prejudicing or making the achievement of the aims of the research impossible. In any case, appropriate measures to protect the rights, freedoms and legitimate interests of the interested party must be adopted in accordance with Article 89 of the GDPR, including preventive forms of data minimisation and anonymisation. Genetic data are subject to more restrictive rules.

3.5 Special Rules for Genetic Data

With specific regard to genetic data processing, Legislative decree no. 101/2018 introduced art. 2-septies of the Code of Privacy, which provides specific guarantees for the processing of genetic data, biometric data and data related to health conditions. It implements Article 9, paragraph 4 of the GDPR by confirming that these data can be processed when one of the conditions provided by paragraph 2 of Article 9 GDPR are fulfilled and measures introduced by the national DPA are satisfied. The latter measures shall introduce specific safeguards related also to the way of communicating to the interested person of diagnosis and health-related data. Guarantee measures shall identify security measures, including those techniques of encryption and pseudonomisation, minimisation measures, specifications modality for the selective access to the data and to communicate the information to interested parties, as well as any other measures necessary to guarantee the rights of the data subjects.

In the context of genetic data treatment, guarantee measures can identify, in the event of a particular and high level of risk, consent as a further measure to protect the rights of the data subject, pursuant to Article 9, paragraph 4 of the GDPR, or other specific precautions. In any case, genetic and health-related data cannot be diffused.

In the context of information and consent to genetic data processing, Authorisation no. 8/2016 (processing of genetic data), as amended in accordance with the GDPR on 13 December 2018), provides that information given to interested persons must particularly highlight:

• (a) results achievable, related also to unexpected information which can be derived from data processing; and

• (b) the right to limit the scope of communication of genetic data and transfer of biological samples, and the possible use for of the latter further purposes.

The same Authorisation also set out the cases in which consent for genetic data processing is mandatory, among which the processing for research purposes not provided for by the law is listed. Accordingly, genetic data and biological samples processing is allowed only when aimed at the protection of interested individuals, third parties or public health in medical, biomedical and epidemiological fields. Also, clinic experimentation or scientific research aiming at developing genetic analysis techniques is allowed. Specific requirements for individuals who are not able to give their consent are provided by the Authorisation (§ 4.11.2).

The research project must clarify adopted measures for guaranteeing that the conferring of biological samples is voluntary. Special attention must be given to the communication of measures adopted to allow for the identification of interested persons only for the time necessary for collecting and processing of data/samples (in accordance with Article 25 GDPR); and the procedures through which interested persons, upon request, can access the information contained in the research project.

In the event that the data subject withdraws his/her consent to the processing of data for research purposes, the biological sample is destroyed provided it has been taken for such purposes, when the sample cannot longer be referred to an identified or identifiable person.

The biological samples taken and the genetic data collected for health protection purposes can be stored and used for purposes of scientific or statistical research, without prejudice to the need to acquire the informed consent of the persons concerned, except in cases of statistical surveys or scientific research required by law or limited to the pursuit of scientific and statistical purposes directly connected with those for which the informed consent of the interested parties was originally acquired. This is set out in Authorisation no. 8/2016, § 4.11.3.

When, due to particular reasons, it is not possible to inform the interested parties in spite of having made every reasonable effort to do so, the conservation and further use of biological samples and genetic data collected for the realisation of research projects, other than the original ones, are allowed if similar research cannot be carried out by processing data that refers to persons from whom informed consent may or has been acquired and:

• (a) when the research programme involves the use of biological samples and genetic data that originally did not allow identification of the interested parties, or that, following treatment, did not allow identification of the same interested parties and it does not appear that the latter have previously provided contrary indications;

• (b) or when the research programme that was the object of a justified and favourable opinion of the competent ethical committee at a territorial level is subject to prior consultation with the national DPA pursuant to Article 36 of the GDPR.

4 Law in Context: Individual Rights and Public Interest

The above discussion indicates that the Italian legislature has opted for an integrated system of substantial and procedural guarantees. On the one hand, it recalls the conditions set forth by Article 9, paragraph 2 of the GDPR while, on the other, it delegates to the national DPA the establishment of further conditions and guarantee measures in an ad hoc authorisation. Furthermore, the Authorisations issued by the DPA have a general value and they have to be integrated by ethics committees’ evaluations and approvals of single research projects. By doing so, the Italian legislature, coherently with the approach implemented at the EU level, strengthens the standards provided at the statutory law level by introducing ad hoc provisions for genetic data treatment. At the same time, it reaffirms the hybrid approach of the Italian legal system to biobanks and specifically genetic data and biological samples treatment because it expressly delegates to the competent administrative authority the function of further developing the regulatory framework.

Especially when compared with other relevant national legal systems (such as those of the UK and Spain), the lack of an ad hoc legislative Act on biobanking for research is stark and inevitably provokes a certain level of uncertainty in all involved subjects (researchers, participants and data subjects).

In the light of the central role played by the national DPA in setting the regulatory framework in this context, it is worth referring to its 2017 Annual Report²⁴ in order to understand possible areas of special relevance in the interplay between scientific research needs and the rights protection of individuals. In 2017, the DPA authorised, in the context of an international multi-centre research project requiring the treatment of data relating to the health of patients suffering from acute respiratory distress, the processing of data in the absence of prior information and consent of the patients when they were temporarily unable to provide it and this capacity was not expected to be reacquired before the end of the follow-up period. The authorisation was limited to the data and operations strictly necessary and relevant for the conduct of the study. In particular, taking into account the state of unconsciousness, the DPA considered that the aims pursued could not be achieved through the processing of personal data on health, referring only to persons able to understand the indications given in the information sheet and to validly consent.²⁵ This further clarifies that if the health conditions of the interested party will improve during the survey and the interested party is able to understand the content of the information and to give valid consent to the processing of the data, the consent of the latter will be collected after the beginning of the survey, subject to appropriate information.

5 GDPR Impact and Future Possibilities for Biobanking

In countries like Italy where the need for specific regulation is more urgent, the entry into force of the GDPR might contribute to filling the gap in the legislation with regard to biobanking for medical scientific research purposes. The GDPR, in fact, beyond producing direct binding effects, requires the Italian legislature to intervene in order to provide a comprehensive and general legal framework concerning research biobanking. So far, the main impact of the GDPR on the Italian legal regulation of research biobank has been in the aforementioned amendment of the Data Protection Code of 2003. As already said, Italy decided to take advantage of the clause provided by Article 9, paragraph 4 of the GDPR, according to which ‘Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data’. Beyond the substantial modifications and the limitations introduced, as described in the previous paragraph, what is worth mentioning is the procedure followed to build the whole framework of regulation. The legislator confirmed the old mechanism of delegating to the national DPA the duty to identify the conditions under which the treatment of specific kinds of data can be considered legitimate. In the past years, the DPA accomplished its task by means of adopting general authorisations for different kinds of processing. Taking advantage of its previous activity, in order to implement the GDPR the DPA selected the provisions contained in the old general authorisations which can be considered to be compatible with the GDPR and opened a public consultation to acquire observations and proposals around them. It should be stressed that public consultations are an instrument to which the Italian law is quite unfamiliar. It might be the case that the importance given by the GDPR to decentralisation strategies and institutionalised ethics (such as standards, codes of conduct and ethical thresholds) and the suggested risk-based approach, motivated the DPA to at least consider the voices of relevant stakeholders (e.g. associations or representatives from the field of scientific research). The public consultation offered the biobanking community the chance to present its viewpoints on the practical implications and problems with the asystematic, existing regulatory framework. How many of these observations will be considered is yet to be seen.

6 Conclusion

The Italian regulatory framework for biobank research is composite, complex and strongly focused on the protection of individual rights, in some cases creating obstacles to the development of research. The main feature of this regulatory model is its hybrid nature, where standards set forth by the DPA play an essential role in defining the concrete balance between the protection of participants’ fundamental rights and freedom of research. The Italian legislature took advantage of the ‘incomplete harmonisation’ offered by the GDPR (see in particular Article 9, paragraph 4) and entrusted the DPA with the task of identifying the conditions for processing genetic and health data, in the hope of setting higher standards of protection. A key issue, which is common to other national systems, is the special regimen dedicated to genetic data. In this case the requirement of informed consent—characterised in terms of specificity—is still deemed fundamental. Where, exceptionally, informed consent for scientific research is not specifically required (see Part II), the protection of individual rights is rebalanced by requiring specific measures of protection, such as pseudonymisation and—in case of further use of samples and data – an ad hoc authorisation by the competent authority and a favourable opinion by the competent ethical committee.