Research Biobanking, Personal Data Protection and Implementation of the GDPR in France

Abstract

Since 1978 and the initial French data protection law (Loi n°78-17 du 6 Janvier 1978), consecutive modifications regarding the protection of personal health data, especially in 2004, 2016 and 2018, set up a strict legal regime for processing sensitive personal data, including for research purposes. In recent years, French law has evolved proactively and in parallel with the work of the European Union (EU) on the preparation of what became the General Data Protection Regulation (GDPR), which has been in force since May 2018. This Chapter performs a state-of-art analysis (as of 1 July 2019) of the French legal framework for research biobanks and data protection rules applying to biobanking, in particular those related to data subjects’ rights and Article 89 of the GDPR. Firstly, it provides updated information about the national landscape of active research biobanks in France (Sect. 1). Secondly, it explores how the French law embodies the developments brought by the GDPR and how it envisages individuals’ rights in the context of research biobanking (Sects. 2 and 3). Thirdly, this Chapter analyses existing and potential national exemptions to individuals’ rights, including with regard to Article 89 GDPR, and how France conceives of processing activities of ‘public interest’ (Sect. 4). Finally, the authors address ongoing debates around bioethics law in France and argue for the creation of a specific Act focused on biobanking as a means of integrating, clarifying and developing not only data protection rules but also other activities related to samples, human or not, in a unique, operational and compact act (Sect. 5).

1 Introduction

France is known for having one of the stricter legal regimes worldwide regarding personal data protection. Since 1978, France has regularly updated personal data protection rules to maintain a high level of protection for individuals’ rights and freedoms—something that can be considered a necessity in a democratic State.

Since 2006, this regulatory dynamism has intensified, notably in consideration of the debates which led to the European Commission proposal to adopt a European Union (EU) General Data Protection Regulation (GDPR) in 2012 and its formal adoption in 2016. Between 2016 and 2018, the French government and parliamentary bodies, in collaboration with the National Data Protection Authority (CNIL), scrutinised existing personal data protection law and adopted several acts modifying the Law on informatics and freedoms¹ (Loi Informatique et Libertés n°78-17 (LIL)), in particular regarding health data processing. These regulatory advances have inevitably impacted scientific research practices at large, including, to a certain extent, research biobanking. Indeed, biobanks which process, store and control the sharing of bioresources for research uses are stewards of the collections of human biological samples and their associated data.²

In this Chapter, we intend first to describe the updated regime applied to biobanking activities under French law and related procedures. Second, we concentrate on the relevant provisions of the LIL introduced in 2018, and unmodified since the last revision of 2019, that affect personal data processing for health research and cover biobanking. We consider in particular the implementation of Article 89 of the GDPR which enables national exemptions to several data subjects’ rights in research contexts.

2 Biobank Infrastructure and Regulatory Environment

2.1 What Is the French Biobanks Landscape?

For 20 years, the government, through its associated ministries (research and health), supported and structured the French landscape of Biological Resource Centres (BRCs). Inserm (Institut National de la Santé et de la Recherche Médicale) played a leading role as national operator in association with various national stakeholders. These actions led to the establishment of a French BRC network. This continues to be at the forefront of European countries as, since 2008, France has been the only country with a national standard for quality management in biobanking [NFS 96-900].³ In 2011, another step was taken with the creation of a national infrastructure to support quality assurance and certification processes in biobanks, support technological innovations, provide expertise on ethical and regulatory aspects and participate in international working groups. This French BIOBANQUES Infrastructure has been decidedly oriented towards Europe with its active participation in the establishment of the European infrastructure BBMRI-ERIC.⁴

In 2001, 58 tumor biobanks attached to health care institutions were set up to improve the organisation of care and accelerate cancer research. Now, the French network of BRCs identified in health and research institutions consists of 96 biological or microbiological resource centres distributed throughout the country, which are organised into 15 thematic or regional networks. The Paris area represents a ‘hot spot’ of biobanks concentration (44%), which is in line with the historical distribution of large institutions and hospital groups. The remaining 56% is spread over the 13 administrative regions.⁵

The distinctiveness of the French network is that it implemented, early on, a quality management system (based on NFS 96-900) leading to the certification of almost 70% of the network (see footnote 5). The NFS defines standards for the qualification of the personal, material and dedicated biobanking processes. BIOBANQUES supports the preparation of BRCs certification process with qualified personal. The typology of the French BRC landscape varies a great deal in terms of size, expertise and therapeutic area, which gives it a richness and complexity.

A large part of BRCs in the French network is multi-thematic. The therapeutic areas of the collections and associated data housed in these structures are, by order of representativeness, according to the ICD-10 nomenclature,⁶ oncology, central nervous system diseases, heart and vessel diseases, and infectious, parasitic and HIV diseases. Moreover, almost 40% are involved in the collection and preservation of biosamples and data from large national cohorts (population-based or disease-specific), the majority of which include clinical collections.

Generally, data protection law applies whatever the biobank’s specificities. Challenges regarding both the sustainability of the biobanks and the clarity of the attached regulatory regime have been identified in the literature⁷ and will need further political actions.

2.2 How Is Biobank Research Regulated in France?

French law does not use the term ‘biobank’ but refers, as a similar notion, to ‘any organisms’ which ‘ensure the preservation and preparation for scientific purposes of tissues and cells from the human body, of organs, blood and its components and derived products’ whose ‘activities include the constitution and use of human biological samples collections’.⁸ ‘Human biological sample collection’ means ‘the pooling, for scientific purposes, of biological samples procured from a group of identified and selected persons according to the clinical or biological characteristics of one or several members of the group, as well as the derived products of these samples’.⁹

France has no unique, comprehensive biobank law. Successive laws, decrees and regulatory acts from government and authorities have directly or indirectly impacted research biobanking and BRCs. These have progressively constituted the current legal framework. In a nutshell, this framework is constituted by bioethics laws;¹⁰ biomedical research laws;¹¹ and the data protection law that fixes data subjects’ rights and special conditions for processing personal data for research purposes.¹² These major acts cross-reference themselves and interact on a number of topics. They are completed by applicable ethical, technical and scientific guidelines intended to ensure high quality and security of research.¹³ This framework is mainly codified in the Public Health Code (PHC) and the Civil Code (CC), but the French biobanking legal regime remains complex and fragmented. Also, some of the provisions presented below could evolve based on ongoing debates on revising the last bioethics law.

Biobanking for research purposes is often included within broader health research projects but can also be envisaged on its own, for example, as a parallel activity to healthcare in order to serve future undefined research. These different contexts involve different legal considerations. Today, the applicable rules for biobanking activity are identified on a case-by-case basis, depending on the nature of the activity,¹⁴ on the purpose of the research project,¹⁵ on the individuals concerned,¹⁶ on the nature of the samples,¹⁷ and on the nature of the data collected and used (personal, anonymised or anonymous data).

The legal procedures regarding personal data processing for research (ruled by LIL) and those applying to biobanking and the setting up of a biobank (ruled by the PHC, in close connection with biomedical research laws) rely on two specific frameworks. Both must ultimately be respected. Here we concentrate on the procedures for setting up a research biobank. The next section will present the procedures regarding personal data processing in research biobanking.

Two procedures exist for setting up a biobank depending on the context in which the collection of human samples is implemented and on the use envisaged for the collection, regardless of whether or not the collections are anonymised or anonymous.

• First procedure: the collection is constituted within the frame of a Research Involving Human Person (RIHP) project.

In 2016, the implementation of the Law n°2012-300¹⁸ and its related Decree,¹⁹ Ordinance²⁰ and ‘Arrêtés’^21,22 on RIHP affected the rules regarding biomedical research and biobanking, essentially through new research classification and associated procedures towards competent authorities according to the type of research and updated informed consent requirements regarding individual’s participation to the research activities (consent to research participation required under PHC should not be confounded with consent as to personal data processing as referred to in the LIL).

The PHC defines a RIHP as research organised and carried out on human persons to develop biological or medical knowledge.²³ Three types of RIHP are defined according to their risks for research participants,²⁴ from the more risky or invasive research (RIHP1) to the less risky or less-invasive ones (RIHP3). Activities related to the procurement, collection, preservation and use of biological samples and attached data can occur in the three types if justified and detailed within the research protocol.²⁵

Every RIHP project needs to be registered²⁶ prior to the submission to the competent authorities. Drug clinical trials covered by the EU Clinical Trial Regulation²⁷ will need a EudraCT number. RIHP1 ones (e.g. interventional research on medical devices) will need to obtain an ID-RCB number with registration at the National Agency for the Safety of Medicines and Health Products (ANSM). The protocol must be reviewed and approved by a competent Research Ethics Committee (Comité de Protection des Personnes—CPP). The CPP should scrutinise²⁸ the project in particular regarding the respect for research participants’ rights, informed consent procedures, forms, the necessity and proportionality of the planned activities regarding the research purposes, including data protection measures, and in particular data minimisation. The CPP is designated randomly.²⁹ A CPP decision can be appealed once through the same randomised process. ANSM authorisation is required only for RIHP1.³⁰ In RIHP2, the ANSM is only notified of the project details and CPP opinion. ANSM is not involved in RIHP3. Any substantial modifications³¹ of the declared elements must be submitted to the CPP for approval and, if required, to the ANSM for authorisation.

The CPP has 45 days to approve or reject the project proposal. Silence means acceptance. Where ANSM authorisation is required, delays can vary according to the products used; if there is silence past the delay, this means refusal.

The storage of a biological collection after a project comes to an end is allowed when concerned individuals have been properly informed and are able to exercise their right to oppose. Sufficiently clear indications must have been provided about the storage duration, conditions, the scientific purposes for which samples and data will be made available and where to find further information. Only in this case do the initial ethics approval and authorisations obtained for the research project suffice to continue storage in a research biobank after a project ends. However, where individuals were not able to provide a valid informed consent for long term storage, the promoter shall consult a CPP for proper approval and follow the second procedure.

• Second procedure: the collection is not constituted within a RIHP project and/or the storage is prolonged after the end of a RIHP to cede rights on the materials for research uses, including without proper informed consent.

This procedure covers projects to create new bio-collections or biobanking sites outside any particular RIHP project (i.e. systematic collection of residual surgical samples for future research or reuse of existing samples without any additional act on human persons or a purely technological project). This procedure also concerns biobank activities where long-term storage for cession³² to third parties is planned and, subject to a new CPP approval, where RIHP participants have not been properly informed in the initial consenting process about materials storage or cession after the project ends.

In these cases, the organism in charge of the collection is either subject to a declaration³³ to the Ministry of Research where collections will be used for their own research program needs, or to an authorisation, for those wishing to transfer samples to third parties for research uses,³⁴ in application of a Decree of 2017³⁵ (CODECOH procedures),³⁶ and where individuals’ information is lacking. The Ministry, and the Regional Agency of Health (ARS) where hospitals are located, have 2 months to approve a declaration, with silence meaning approval, and 3 months regarding authorisations, with silence meaning rejection. Declarations have no validity deadline. Authorisations are valid for 5 years and must be renewed after submission of an activity report.³⁷ Any substantial modifications to the elements³⁸ presented in the application dossier must be submitted to the Ministry and, where relevant, to the ARS.³⁹ A new CPP approval could be needed.

Whatever the procedure, biobanks wishing to export/import human biological samples⁴⁰ for research uses need specific authorisation from the Ministry of Research. The Ministry of Research will check that the principles of free donation, informed consent rules and transport standards for labelling⁴¹ and packaging dangerous goods have been respected. This authorisation is delivered within a 3 months delay maximum.

Promoters of research using ethically sensitive biological elements, such as human embryos, gametes, or organs coming from deceased persons, need specific authorisation from the Biomedicine Agency (Agence de la Biomédecine).

Biobanks are accountable and must be able to answer to requests from competent authorities at any time, notably on the nature and characteristics of the stored samples, on the research projects using the samples, on consent or non-opposition from source individuals and on the fate of the samples. In all cases, specific rules and procedures fixed by the LIL regarding personal data collection, storage and other processing for health research purposes must be respected.

3 Safeguards and Individual Data Subjects’ Rights in Research Biobanks

3.1 How Research Biobanks Are Integrated Within the Data Protection Framework

The LIL is not focused on biobanks, or even mentions them, but it does directly apply to them and to the various operators implied in biobanking activities that fall under the scope of the LIL Title II, Chapter III.⁴²

From a data protection law perspective, those responsible for biobanks are either the data controller, join-controller, processor or third party, depending on the processing context. Indeed, biobanks essentially function as platforms for controlling access and sharing biosamples and associated personal data for external research uses, although they can also develop their proper internal research programmes. In both cases, activities performed with personal data, including pseudonymised data, are qualified as data processing that pursues one or multiple, present or future, research purposes. Like the GDPR, the research activities covered are scientific, historical research, statistics and archiving in the public interest,⁴³ and includes technological research (e.g. on medical devices) and innovation.

The LIL, following its amendment in 2018, did not fundamentally change the existing framework but incorporated some of the GDPR provisions, notably those updating the right to information, and provisions regarding Data Protection Officers⁴⁴ (DPO), Data Protection Impact Assessment⁴⁵ (DPIA), data transfers⁴⁶ and CNIL remits. The LIL directly refers to the GDPR in several articles. New rules were inserted into Chapter III on accessing the National Health Data System (SNDS) databases for research purposes.

Definitions of ‘personal data’ and ‘processing’⁴⁷ are identical to the GDPR ones. Sensitive personal data⁴⁸ are a special category of personal data whose processing is forbidden in principle, with limited exemptions including processing that is necessary for scientific research.⁴⁹ Sensitive data include data concerning health, genetics or biometrics, as defined in the GDPR. The CNIL developed a flexible approach to the notion of health data which could be so qualified due to their nature, as a result of cross-processing or by destination.⁵⁰ This allows operationalisation of the qualification. The principles⁵¹ of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, integrity and confidentiality, accountability and storage limitation are identical to the GDPR.

The LIL preserves important provisions for biobanking. First, regarding the purpose limitation principle, it is with the presumption of compatibility⁵² for repurposing personal data processing for scientific or historical research and statistics provided that the rules and procedures⁵³ are satisfied. Second, the specific exception to storage limitation for personal data to be stored after the achievement of the initial processing purpose solely for archiving purposes in the public interest, scientific, historical research or statistical purposes, in accordance with Article 89(1) GDPR.⁵⁴ In both cases, data shall be at least pseudonymised and will not serve individual decision-making.

Biobanks, as samples and data repositories, have a prominent custodian role over the legal and ethical compliance monitoring in both the deposit, the management of, and the access to, the bioresources.^55,56 Confidential and secure data management is essential, notably through the definition of access rights and procedures considering the data nature or sensitivity (anonymised/anonymous data; pseudonymised data; directly identifiable data) and through efficient mechanisms to check the adequacy of the applicant’s processing purposes.⁵⁷ Biobanks’ duty to ensure database security applies to facilities and ICT systems used to store, process and make available the data, including measures for external data users.⁵⁸ French quality norm NFS-96-900 on BRCs and the ISO norms, in particular ISO 20387:2018 on Biotechnology and Biobanking, together with potential new labels⁵⁹ on personal data protection, allow a certain alignment of management practices. Also, biobanks can apply to the Ministerial ASIP for specific certification of health databases hosting.⁶⁰

Since 2006, the CNIL has followed the GDPR approach based on operators’ accountability and modified the declaration/authorisation system to create simplified procedures intended to ensure data subjects’ protection while favouring research, innovation and competitiveness. The CNIL adopted referentials (Méthodologies de Référence, MR) specifying data protection rules in research contexts. Processing within a MR scope can be implemented after a commitment of compliance with the CNIL. We will concentrate on MR001,⁶¹ MR003⁶² and MR004⁶³ which are particularly relevant for biobanks. The use of a particular MR depends on the qualification of the research activity. In any cases, samples and data collection must be justified. The MRs articulate the LIL and the PHC. Processing falling outside the MRs’ scope need CNIL authorisation.⁶⁴ Biobanks receiving samples and data will be checkpoints.

For each selected MR, Table 1 summarises the data protection rules impacting depositors to biobanks and biobanks’ users.

Table 1 Scope and basic rules of CNIL MR001, MR003, MR004 for personal sensitive data processing in health research

3.2 Overview of Data Subjects’ Rights in Research Biobanking

Generally, in France, data subjects participating in research biobanks have similar rights to participants in classical biomedical research projects. The French law functions by analogy.

The LIL approach of research is based on opt-out (non-opposition). Opt-in consent can be required under other laws (e.g. for participating in RIHP1 and 2; MR001). Consent to sensitive personal data processing with several purposes is accepted where these are clearly, intelligibly and explicitly presented to the individuals who can opt for or refuse each one.⁶⁵ Genetic data processing is only authorised for medical or scientific purposes and based on opt-in, written, free and informed consent as required by Article 75 LIL. Nevertheless, Article L.1131-1-1 PHC explicitly allows opt-out consent where the genetic analysis is based on the reuse of already collected samples. A renewal of an individual’s consent will only be necessary in case of the procurement of new samples for genetic analyses. The scope of this PHC article can be questioned as it does not explicitly cover the reuse of genetic databases without attached samples. We favour a broad interpretation with the same opt-out process for the reuse of genetic data.

Table 2 provides an overview of the 3 MRs data protection principles and individual rights to be respected by depositors and access applicants to biobank bioresources. Biobanks verify the adequacy of deposit/access requests regarding applicable ethico-legal frameworks and ensure a continuum regarding stored materials. This table reveals that the leeway provided under Article 89(1) GDPR is not used in the MRs for particularly derogating to data subjects’ rights in research.

Table 2 Data subjects’ rights and data protection measures in the CNIL MR001, MR003, MR004 for personal sensitive data processing in health research

Once personal data enter a biobank, data subjects must continuously be able to exercise their rights. Privacy policies should be easily available to the public. Most of the French biobanks certified NFS-96-900 meet specific requirements that are in line with transparency such as in maintaining external communication regarding availability of the collections, terms of access and quality measures.

4 The National Exceptions to Individual Rights and the Role of Public Interest

4.1 Exceptions Regarding Data Subjects’ Rights for Personal Data Processing in Research

Biobanking necessitates special measures to be able to process personal data over the long-term for future, quite broadly defined, uses. The GDPR has made available several means for Member States to derogate from individual rights for the benefit of scientific developments under certain conditions. The GDPR’s flexibility is preserved in French law.

Regarding in particular the right to access, the LIL includes a special derogation ‘where the personal data are stored in a form that manifestly excludes any risk as regard to privacy and data protection’. This exemption will last only for the duration necessary to reach the statistical or research processing purposes.⁶⁶ Nevertheless, it is difficult to determine which situations are being targeted. Does that open a notion of ‘relative anonymity’ or ‘de facto anonymity’⁶⁷ based on each processing context, purpose, and technical and organisational measures in place to protect identity and the means reasonably likely to be used for (re)identifying the data subject?

Like the GDPR, the LIL explicitly provides exceptions regarding the right to information prior to the processing when respect for this right proves impossible or involves disproportionate efforts compared to the risks of the processing. These derogations are only planned in the context of indirect data collection and in the context of further uses of already collected data, either for storage, for historical, statistical or scientific purposes, or for further processing for statistical purposes.⁶⁸ So, these exceptions could be invoked either before including the indirectly collected data in the biobank or after, at the time of accessing the bioresources, for the reuse of existing biobanks’ samples or databases in research, including for genetic research. The data subject can also decide not to be informed where it would lead to reveal a diagnosis or prognosis.⁶⁹ Such exceptional circumstances necessitate justification and could trigger, for the research promoter, the CNIL authorisation procedure, the MRs requiring data subjects to be informed, and REC approval for reuses in RIPH.

Article 110 LIL allows derogations to the right to oppose to a processing where this latter answers to a legal obligation imposed to the controller or processor or where it is explicitly planned by the act authorising the processing.

Recently, lawyers criticised⁷⁰ the way the GDPR forces communication of the research promoter’s DPO contact details within information notices provided to data subjects in clinical trials, claiming that DPO involvement could breach medical secret of which the sole investigator is the guarantor. Furthermore, they claim that the Clinical Trial Regulation is the special law that makes the investigator the only contact of the participants for exercising their rights. Therefore, in their opinion, DPO contact should not be provided. To date, the CNIL has not gone against GDPR.

The LIL refers to the GDPR provisions regarding the implementation of other rights, in particular regarding the right to limit processing, the right to data portability, the right to oppose and the data breach notification process.

Research exemptions to individual rights are not entirely fixed in France. Ordinance n°2018-1125 mentions the future adoption of a Decree determining the conditions and guarantees under which exemptions to data subjects’ rights planned by Article 89.2 GDPR regarding its Articles 15 (access), 16 (erasure), 18 (restriction) and 21 (right to object) could apply.⁷¹ At the same time, exceptions to certain of these rights remain possible on a case-by-case basis. As the GDPR provides, such derogations could be accepted where the processing is necessary for scientific research purposes, it is lawful, where data minimisation is strictly respected, in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes and such derogations are necessary for the fulfilment of those purposes.⁷²

4.2 The Public Interest Purpose of Processing in French Law

Since 2016, the notion of ‘public interest’ has been central for processing personal data in health research. Any processing in this field must contribute to the public interest,⁷³ including for using simplified procedures (above-mentioned MRs). The public interest purpose is an actionable means to derogate from some general principles of personal data processing. Regarding the initial prohibition of processing sensitive data, Article 6(II) and (III) LIL allows controllers to process personal health data where the research processing pursues the public interest in respect of Title II Chapter III, including public health. The public interest purpose of the research processing also explicitly allows justified exceptions to the right to erasure⁷⁴ and base adaptations of the right to information, to oppose and to data access for minors participating in certain types of research (further detailed below, Sect. 5.1).⁷⁵ Outside archiving, the public interest purpose is not mentioned to exempt from the storage limitation principle in a research context. Data controllers involved in archiving in the public interest can derogate⁷⁶ from the rights established under Articles 15, 16 and 18 to 21 of the GDPR.

But this blurry notion is problematic, in particular where competent authorities (CNIL and INDS) can refuse data processing requests based on this criterion. In 2016, under the auspices of the INDS, a legal interpretation⁷⁷ of the notion enabled the identification of useful specifications for avoiding misunderstandings. This expertise provides that ‘public interest’ is a synonym of ‘general interest’ and ‘collective benefit’. Therefore, any uses essentially motivated by private purposes or aiming at re-identifying patients, or targeting prescription behaviours of health professionals for commercial purposes (e.g. in order to promote health products) are excluded from the public interest. The notion can be further understood by considering details provided within Article L.1461-1 (III) PHC dedicated to the SNDS, access to which is only granted to applicants pursuing the public interest. Without explicitly mentioning it, this Article states that SNDS makes available health data in order to contribute to the information on health and health service provision; on medico-social care and their quality; to the definition, implementation and assessment of public health and social protection policies; to the knowledge of health, social security and medico-social expenditures; to the information of professionals, structures and health or medico-social establishments on their activity; to health monitoring and safety; to research, studies, evaluation and innovation in the fields of health and medico-social taking in charge. Furthermore, Article 66(1) of the LIL explicitly identifies personal data processing implemented for ensuring a high level of quality and security of healthcare, drugs and medical devices as a public interest purpose. The CNIL can always consult the INDS to evaluate a public interest purpose.

5 GDPR Impact and Future Possibilities for Biobanking

5.1 French Specificities

French law integrates the GDPR and further develops individual rights on several points of interest for researchers.

First, the LIL states that personal data stored as research results are only accessible and modifiable by persons authorised by the data controller, in the respect of deontology. Personal data as research results must be anonymised before communication to thirds, except where the third’s interest in the communication overweigh data subject’s ones. In this regard the CNIL can approve anonymisation mechanisms.⁷⁸ Then, anonymised data are no longer subject to the LIL.

Second, while the GDPR excludes its application to deceased persons, the LIL ensures privacy protection after a data subject’s death with a new right to write and record advanced directives on personal data management. The directives will be implemented by a trustee identified by the data subject before his death or by a person designated by law. Here, the French legislator conceives of and protects the privacy of individuals as a continuum that death does not break. It is thus possible that a data subject can ask for restricted processing or erasure or, interestingly, to donate personal data from various sources to research organisations, which includes a biobank. These instructions shall be legally valid.

Data subjects’ rights adaptations have been introduced to ease the implementation of RIHP2, T3 and other studies or assessments in the field of health that pursue a public interest purpose and involve minors. By derogation, Article 59 LIL allows prior information on the processing to be provided to only one of the holders of the parental authority if it is impossible to inform the other or if he/she cannot be consulted within a timeframe compatible with the specific methodological requirements of the research with regard to its purposes. This does not restrict the exercise, later on, by each holder of the parental authority, of the data subject’s rights they have by law. Article 70 also enables new rights that increase the minor’s autonomy in such research. The minor (aged 15 or more) may oppose the holders of parental authority receiving prior information about research participation where this leads to revealing information about an action of prevention, a screening, a diagnosis, a treatment or an intervention for which the minor expressly opposed the consultation of the holders of parental authority,⁷⁹ or when family ties are broken and the minor personally benefits from appropriate insurance. The minor may also oppose data access exercised by the holders of parental authority to personal data collected during the project. The minor exercises his/her rights alone or accompanied by a major of his/her choice.

5.2 Perspectives Regarding Research and Biobanking

While a decree about national derogations from certain data subjects’ rights under Article 89 GDPR is expected, France launched in 2016 its national plan for genomic-medicine⁸⁰ with the aim of completing every year 200,000 human genome sequences. This will necessitate efforts in terms of samples and data storage and processing capacities but also a clear and appropriate legal and ethical framework. These new activities, plus the current revision of the bioethics law, highlight the new challenges for research biobanking.

A first set of challenges relates to the development of new techniques in genomics and the future capability to store and use bigger sets of genomic data in the form of Whole Genome/Exome sequencing. The CCNE⁸¹ and the State Council⁸² have taken a position on this matter, both favouring the practice of ‘enlarged informed consent’ or ‘consent by delegation’ based on the monitoring functions of competent and independent trusted third parties⁸³ for genetic research, notably for the purpose of reuse of data. Of course, both acknowledge the need to ensure respect for the fundamental rights of individuals involved in such research and that there will be some difficulty to enforce those rights during the duration of the research. As such, they proposed to rely on new mechanisms involving either research ethics committees or an independent trusted third party in conjunction with supplying a high level of information of participants. However, the Council rejected solutions such as broad unspecified consent and dynamic consent because of their legal or technical implications (see footnote 10).

A second set of issues relates to research on human embryos, notably the creation, in research, of transgenic, chimeric embryos; the use of induced pluripotent stem cells and their ethical impact on the use of ‘natural’ human embryos; and the need to recognise by law the 14-day deadline limiting embryo cultures in research. A final challenge is the upcoming debate from a collective perspective of the implications of the production and use of large datasets through artificial intelligence or genetic testing/sequencing to be routinely provided in the health care system and/or commercially. This should take in their negative effects on solidarity, equality, the risk of genetic reductionism, stigmatisation and discrimination.

6 Conclusions

Currently, the French regulatory environment for research biobanking remains complex and fragmented due to the fragmented nature of the legislation to comply with. Data protection law is a common feature of any type of health research and biobank processing of personal data, whether the latter are attached to, or generated from, a biological sample, with a risk-based approach for identifying requirements to be met by researchers and biobankers. The GDPR has been fully implemented, with the potential for further developments offered by its Article 89. We acknowledge the efforts made by the CNIL to provide operators with explanatory and practical toolkits that ease both procedures and GDPR-compliance. CNIL action is pragmatic and proactive, which are good qualities that can be used by DPO networks for the purpose of boosting the understanding and adoption of a data protection culture, and will lead to innovations in data protection.

Nevertheless, we think that important deficiencies remain in biobanking regulation. The very specific role of biobanks is not fully addressed or recognised and some contexts of biobanking need further regulatory clarification. Thus, we call for the elaboration of a French Biobank Management Act to compile and develop further the rules applicable to research biobanking that would consider existing and new issues encountered by operators and the views of citizens.