Biobank Oversight and Sanctions Under the General Data Protection Regulation

Abstract

This contribution offers an insight into the function and problems of the oversight and sanctions mechanisms outlined in the General Data Protection Regulation as they relate to the biobanking context. These mechanisms might be considered as meta-mechanisms—mechanisms relating to, but not consisting of, substantive legal principles—functioning in tandem to ensure biobank compliance with data protection principles. Each of the mechanisms outlines, on paper at least, comprehensive and impressive compliance architecture—both expanding on their capacity in relation to Directive 95/46. Accordingly, each mechanism looks likely to have a significant and lasting impact on biobanks and biobanking. Despite this comprehensiveness, however, the mechanisms are not immune from critique. Problems appear regarding the standard of protection provided for research subject rights, regarding the disproportionate impact on legitimate interests tied up with the biobanking process—particularly genomic research interests—and regarding their practical implementability in biobanking.

1 Introduction

The oversight and sanction mechanisms are two of the most significant mechanisms in the General Data Protection Regulation (GDPR).¹ Evidence for this might be argued to be found in the extreme build up in data protection compliance activities prior, and subsequent, to the GDPR coming into force in early 2016 and applying from early 2018—including in the biobanking context. Some might argue this build-up of activity is due to the substantive novelty of the GDPR.² Such arguments, however, are swiftly dismissed with reference to the substantive similarity of the GDPR to its forerunner—Directive 95/46. A much more likely explanation is the increase in data controller compliance activities as a consequence of the fear of oversight potentially leading to novel, and crippling, sanctions.³

The astute reader might wonder why these two separate mechanisms fall within one contribution. The answer is relatively straightforward: they go together like salt and pepper. The oversight mechanism functions as the mechanism permitting the generation of information about compliance with the GDPR as well as information about violations of the GDPR. The sanctions mechanism then functions as the dissuasive threat pushing data processing actors towards compliance, which becomes reality—usually—on the back of the oversight mechanism’s violation-information generation capacity. The two systems function in tandem in the service of compliance.

The oversight and sanctions mechanisms do not directly define the boundaries of the public interest in biobanking under the GDPR, how the concept relates to other rights and interests or to the conditions under which processing in its service is permissible. Nevertheless, they are indirectly determinative of the concept in two ways. First: as meta-systems ensuring compliance with substantive principles of the GDPR, they are key to maintaining the boundaries, and conditions associated with action in, the public interest in biobanking under the GDPR. Second: the emphasis placed on oversight and sanctions is indicative of the importance the legislator attaches to the need to police and control the boundaries and conditions of the public interest under the GDPR generally.

With the above in mind, this contribution is structured as follows. To start, the chapter provides a descriptive analysis of the function of the oversight and sanctions mechanisms in relation to biobanking under the GDPR (Sects. 2 and 3, respectively). Subsequently, and building on the descriptive analysis, the chapter engages in a critical analysis of the problems raised by the mechanisms. This critical analysis identifies, and considers the severity of, problems from three perspectives: mechanisms’ negative impacts on research subject rights; mechanisms’ disproportionate impacts on research interests; and mechanisms’ practical implementability in the biobanking context (Sect. 4).

2 Biobank Oversight Under the GDPR

2.1 Introduction

The GDPR foresees an extensive, and complex, oversight mechanism relevant to biobanking. This oversight mechanism might reasonably be considered as consisting of four forms—or stages—of oversight: ex ante assessment; prior notification and approval; ongoing oversight; and finally, general oversight. The oversight system under the GDPR consists of several oversight bodies. These include those specifically elaborated by the GDPR as well as national bodies such as research ethics committees (REC) and other sui generis bodies—for example data access committees. Accordingly, this section will proceed by considering how each of the four forms of oversight foreseen in the GDPR function, before finally considering how the key oversight actors relate to each other.

2.2 Ex Ante Assessment Under the GDPR

Ex ante assessment requires a biobank, prior to engaging in processing, to conduct a Data Protection Impact Assessment (DPIA).⁴

A DPIA is not a general obligation in the GDPR. It will usually, however, be an obligation for biobanks. Article 35(3)(b) clarifies a DPIA will always be required whenever processing includes: ‘processing on a large scale of special categories of data’. All personal data processed in biobanking will, as clarified by the Article 29 Working Party, qualify as sensitive personal data by virtue of its planned integration into data driven genomic research.⁵ In turn, it seems reasonable that the scale of most biobank projects—even relatively small biobank projects—will already qualify as large scale processing of such personal data.

The base rationale behind a DPIA is the surfacing of information concerning the risks to data subjects’ rights and thus to provide an information-base from which to mitigate these risks before processing begins.⁶ Where the DPIA obligation is applicable, each aspect of biobank processing falling under the scope of the GDPR must be subject to a DPIA. It is nevertheless possible, however, for one DPIA, to cover ‘a set of similar processing operations that present similar high risks’.⁷ It is logical to conclude that the GDPR permits multiple biobanking operations—even potentially by multiple different biobanks or external researchers—to be subsumed under one single DPIA.

Whilst the GDPR is scant on the procedural and substantive specifics of a DPIA, certain framework conditions are outlined.⁸ In particular, the biobank conducting the DPIA must describe processing operations, describe the interests on which the processing is based—where relevant—provide an assessment of the necessity and proportionality of planned processing, offer an assessment of the scale of risks to data subjects and offer an elaboration of steps taken to minimise identified risks. In certain cases—although when exactly remains unclear—a biobank must also seek ‘the views of data subjects’.⁹ Finally, if any significant change to the proposed processing occurs, the biobanking must go back and review the continued relevance of the original DPIA.¹⁰

2.3 Prior Notification and Approval Under the GDPR

Prior notification and approval follows, chronologically and legally, from ex ante assessment.¹¹ The prior notification and approval process will tend to involve two types of body under the GDPR. One type of body is specifically elaborated by the GDPR: the Data Protection Authority (DPA).¹² The other type of body will be elaborated by EU Member States following from their obligations to ensure effective safeguards in scientific research under the GDPR.¹³ These national bodies will often—although not always, or necessarily—be Research Ethics Committees (RECs).

DPA prior notification and approval is not always obligatory. In fact, it only becomes relevant in two situations. First: Article 36(1) clarifies that advance approval must only be sought whenever a DPIA process: ‘indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk’. Significantly, the eventual decision as to whether the prerequisites for notification and approval are fulfilled thus lies, as De Hert and Papakonstantinou observe, with the biobank—although, as will be seen later, in Sect. 2.4, the rationale of this decision is subject to ex post checking and verification for compliance with the GDPR.¹⁴ Second: where EU Member States have explicitly clarified that biobanks must consult with the DPA prior to engaging in processing.¹⁵

When the DPIA has shown a high residual risk or when prior consultation with the DPA is explicitly foreseen in EU Member State law, the biobank must engage in the DPA prior approval process. This process involves the provision to the DPA of all relevant information concerning the planned processing activities. This information will include, in particular, information as to how data protection responsibilities—for example the protection of data subject rights—are distributed between relevant actors, information concerning the ‘purposes and means’ of processing, information concerning safeguards, DPIA documentation as well as any information specifically requested by the DPA.¹⁶

Subsequent to DPA checks of information provided, the DPA will then issue the biobank with a decision on the proposed processing. This decision should be available within eight weeks from the start of the process.¹⁷ The decision may take three forms: first, if processing is unproblematic, the DPA will allow it, subject to the conditions of the DPIA, to go ahead; second, if there are specific problematic aspects of processing identified, the DPA will allow it to go ahead only subject to certain conditions;¹⁸ and finally, if processing is irretrievably problematic, the DPA will forbid it in its entirety.¹⁹

National bodies’ prior notification and approval will also not always be necessary. This will depend on whether advance oversight by national bodies constitutes a prerequisite under Member State law. It is not necessarily the case that all Member States require such notification or approval for all, or indeed any, biobanking activity under the GDPR—there is no such comprehensive obligation in the German system, for example.²⁰ It will subsequently depend on whether national bodies’ oversight is required for a specific type of processing. In the UK, for example, certain biobank activity may be exempted from specific REC oversight under a principle of generic oversight: ‘NHS RECs can give generic ethical approval for a research tissue bank’s arrangements for collection, storage and release of tissue’.²¹

Where national bodies’ prior notification and oversight is necessary, the process and consequences of oversight will depend on the conditions of the relevant body’s constitution and the powers bestowed on that body by national law. For example, whilst some REC prior notification and approval mechanisms will require REC approval before biobanking activity can go ahead, this is not universally the case. This is not the case, for example, in relation to the advance oversight procedures of the REC of the Estonian Biobank. According to Article 29(1) of the Estonian Human Genes Research Act: ‘[the advance] assessment of the Ethics Committee is not binding [in terms of whether processing proceeds]’.²²

2.4 Ongoing Oversight Under the GDPR

Ongoing oversight—oversight which takes place during processing activity—in the GDPR is carried out by three different types of bodies. Two of these types of bodies are specifically elaborated by the GDPR: the DPA; and the Data Protection Officer (DPO).²³ The final type of body will be—as above—elaborated by EU Member States following from their obligations to ensure effective safeguards in scientific research under the GDPR.²⁴ As above, these bodies will often—although not always, or necessarily—be Research Ethics Committees.

DPAs, in principle, are under no strict requirement to engage in oversight of all, or any particular, biobanking activity. Nevertheless, the GDPR empowers them to engage in specific and detailed oversight of any biobanking activity they see fit.²⁵ Provided the processing falls within the material scope of the GDPR, there is no limitation to the type of biobank processing—or indeed any other type of data processing—which falls within the scope of this form of DPA oversight. There is, however, little material guidance on how the process of ongoing DPA oversight under the GDPR should look.

If a DPA decides to engage in oversight of biobank activity, the GDPR provides the DPA with investigative powers.²⁶ These powers include the ability to order the biobanking actor ‘to provide any information [the DPA] requires for the performance of its tasks’.²⁷ If, in the course of an investigation, problems are identified, the DPA is endowed with corrective powers. These powers are wide ranging.²⁸ They include, for example, the power to order the biobanking actor to bring processing into line with the GDPR.²⁹ The DPA also has administrative sanctioning powers—these will be discussed later, in Sect. 3.3.

DPOs have a dual function in ongoing oversight. First, the DPO has an advisory role in relation to the biobanking actor. This role requires the DPO to ‘inform and advise the…[biobanking actor] of their obligations pursuant to…[the] Regulation and…other…data protection provisions’.³⁰ Second, the DPO must engage in activities normally associated with external oversight bodies and monitor a biobanking actor’s compliance with the GDPR. In this regard, the DPO must: ‘monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the [biobanking actor]’.³¹

The biobanking actor is obliged to provide the DPO with all relevant support in the conduct of their oversight activities. This obligation encompasses the obligation to provide the DPO with all necessary financial and administrative support and with informational resources and access privileges.³² The DPO has no explicit power to remedy any problems they identify. Significantly, the extent to which the DPO is obliged to initiate coordination and collaboration with external authorities—in particular DPAs—in the case of regulatory breach remains unclear.³³

National bodies will have varied capacities in relation to ongoing oversight. As above, this variation will result from bodies’ differing constitution and powers under their respective Member States’ laws. As above, it is not always the case that Member States will have chosen to require national bodies’ ongoing oversight of biobank activity. Even in cases in which they have, it will not always be the case that the relevant national bodies will have the power to conduct ongoing oversight. For example, the Estonian Human Genes Research Act does not task the Estonian Biobank’s REC with any form of ongoing oversight.³⁴

The process and consequences of national body ongoing oversight will also depend on the conditions of constitution and powers of the national body in the Member State law in question. Most significantly, these conditions and powers will define whether the national body has pro-active oversight capacities comparable to DPAs—or whether they may only react to changes in processing—when they must be consulted in the case of changes in a processing operation and the consequences of their decisions. For example, whilst the UK Human Tissue Act—in Part 2 and Schedule 2—endows the Human Tissue Authority with pro-active oversight capacity, Norwegian law only empowers RECs to be consulted subsequent to changes in biobank processing operations.³⁵

2.5 General Oversight Under the GDPR

As opposed to the ongoing oversight process, the general oversight process concerns biobanking activity generally rather than specific biobanking activity.³⁶ The GDPR foresees participation of two types of oversight body: the DPA; and the European Data Protection Board (EDPB).³⁷

DPAs are under no obligation to engage in general oversight. They, however, have the option to engage in general oversight and have the power to ‘monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies’.³⁸ DPAs thus have the power to engage in oversight of biobanking generally, or of specific types of processing activity or technological development which partially overlap with biobanking. As far as DPA interpretations are legal, DPAs may enforce them—see Sect. 3.3, below.

The EDPB also has discretion to engage in general oversight. The key difference between DPA and EDPB oversight is that EDPB oversight operates at EU level. Article 70(1)(e) permits the Board to: ‘[examine], on its own initiative, on request of [its] members, or…the Commission, any question covering the application of [the] Regulation’. The result will be guidelines or recommendations.³⁹ These guidelines are technically non-binding. However, they may be difficult for biobanking actors to ignore. As De Hert and Papakonstantinou observe, ‘this is a: strong…Board…capable of deciding…and enforcing…opinions’.⁴⁰

2.6 The Interplay of Actors in the GDPR Biobank Oversight Ecosystem

As discussed in the previous sections, oversight under the GDPR consists of a mix of both oversight bodies constituted by the GDPR—most importantly DPAs—as well as national oversight bodies served with discharging EU Member States obligations under the GDPR.⁴¹ These national bodies show considerable variation across Europe in terms of form, function and legal constitution. The most important actors are RECs—common across Europe—although these may be joined by sui generis legally and non-legally constituted actors—for example data access committees—in relation to specific biobanking activities in specific Member States.⁴² Given the lack of homogeneity of national oversight actors across the EU, it is hard to monolithically assert the relationship between actors in the biobank oversight ecosystem under the GDPR.⁴³ Nevertheless, certain observations might be made.

In the first instance, DPAs will usually enjoy higher legal status than other oversight bodies. This results from their express creation as executive authorities in EU law.⁴⁴ As EU law takes precedence over national law, this means DPAs sit above other nationally constituted—by law or otherwise—biobank supervisory authorities in the legal hierarchy.⁴⁵ For example, the UK DPA occupies a higher legal status than the UK Human Tissue Authority.⁴⁶ The exception to this legal superiority concerns RECs in biobanks linked to clinical trials. Here, the EU Clinical Trials Regulation—for example under Article 4—elevates RECs to the status of EU level oversight bodies.⁴⁷

This hierarchical relationship is normatively significant regarding oversight decisions. Where the hierarchical relationship is in place, if a decision by a DPA concerning problematic aspects of biobank processing contradicts that of another body, the DPA’s decision will technically take precedence. Generally, however, it is not the case that a DPA’s confirmation that processing is acceptable will overrule another body’s decision that processing is problematic. Here, a cumulative logic will apply. For example, if a German DPA finds a biobanking actor’s proposed processing acceptable, yet an REC—under Article 15(1) of the Musterberufsordnung für Ärzte—disagrees, processing could not go ahead.⁴⁸

There will be overlap in the oversight tasks performed by DPAs and those performed by other national bodies. This overlap stems, in the first instance, from the broad functionality already taken on by certain biobank oversight bodies. RECs, for example, have traditionally—and will continue to under the GDPR—considered data privacy issues.⁴⁹ In turn, in many Member States, the overlap will be exacerbated by the lack of formal clarification of the distribution of oversight tasks among relevant oversight bodies. This duplication of roles may, from a research perspective, be seen as somewhat frustrating. It is not, however, solely a negative—see Sect. 4.3, below, for a discussion of advantages.

How task duplication and division between DPAs and other oversight bodies will precisely function will be context dependent. Nevertheless, it seems likely DPAs will tend toward restraint in scope and means of oversight. This has been documented—at least in the UK context—by Gibbons under Directive 95/46.⁵⁰ There seems little reason to think this should change under the GDPR. A number of reasons for this might be proposed. Two seem highly likely: the inaccessible nature—to the layperson at least—of genomic research and limited DPA staff expertise; and the political nature of DPAs and their aversion from interfering in normatively legitimate and publicly supported research—more in Sect. 4.3, below.

One aspect of the oversight relationship between DPAs and other oversight bodies—particularly RECs—under the GDPR is particularly interesting. Anecdotally, under Directive 95/46, many RECs had taken to dealing with data privacy issues by requiring DPA authorizations from biobanks and researchers. Under the GDPR, there is no longer any requirement to gain prior DPA authorisation. Accordingly, this approach will no longer automatically function, and a new approach will need to be sought. In certain cases where no DPA oversight is required, an informal relationship between DPAs, biobanks and genomic researchers, and RECs may develop. In other cases, RECs will simply need to internalise the advance data privacy oversight process themselves.

3 Biobank Sanctions Under the GDPR

3.1 Introduction

In the case that a biobanking actor infringes the substantive principles outlined in the GDPR, two different types of sanctions are envisaged: liability and compensation sanctions; and administrative sanctions. The sanctions mechanism under the GDPR also fits into a broader biobanking sanctions ecosystem. Accordingly, this section will proceed by considering each of the two forms of sanction foreseen in the GDPR, before finally considering how these relate to the broader biobank sanctions ecosystem.

3.2 Liability and Compensation Sanctions

In order for liability and compensation sanctions⁵¹ to become relevant, a complaint must be lodged. This may happen via the research subject approaching a national court.⁵² Significantly, the research subject may choose the location of the court.⁵³ They may lodge a complaint in their country of residence, or, if the biobanking is located elsewhere, in that country. This may also happen via a research subject mandating a non-profit to approach the national courts on their behalf.⁵⁴ However, only non-profits which have been ‘properly constituted in accordance with the law of a Member State…[may] lodge the complaint’.⁵⁵

A biobanking actor found liable for causing either material or non-material damage resulting from a violation of the principles of the GDPR will then be liable to pay the research subject compensation.⁵⁶ In clarification, the GDPR explicitly includes, in Recital 75, a set of examples of non-material damage. With relevance for the biobanking context, compensation is available for cases in which: ‘data subjects might be…prevented from exercising control over…personal data…[or] where [sensitive] personal data are [illegitimately] processed’.

The recognition of the possibility to claim compensation for non-material harm is highly significant in the biobanking context. Laurie et al. had observed that the lack of clarity as to whether this was possible under Directive 95/46 had led, in certain Member States—in the UK, at least—to: ‘damage [simply being] equated with financial loss’.⁵⁷ Accordingly, before the GDPR, it would have been very difficult for a research subject to obtain compensation for harms concerning, for example, the illegitimate processing of sensitive personal data—precisely the kinds of harms most likely to occur in the biobanking context.

In the case that compensation is found to be payable, the GDPR foresees the possibility for fault to be spread across multiple biobank actors. In this case, the GDPR gives the research subject the power to chase each actor at fault for the complete damage.⁵⁸ Fortunately, the GDPR also permits any actor held completely liable to recoup any disproportionate losses by chasing other responsible actors for ‘compensation corresponding to their part of responsibility for the damage’.⁵⁹

3.3 Administrative Sanctions

In order for administrative sanctions⁶⁰ to become relevant, a DPA investigation must be started in one of three ways. First, the DPA itself may begin an investigation—under its ongoing oversight powers, discussed in more detail above, in Sect. 2.4.⁶¹ Second, a research subject may begin an investigation by lodging a complaint with a DPA.⁶² Finally, a research subject may also mandate a non-profit to lodge a complaint with the DPA.⁶³ In the final two cases, the DPA is obliged to investigate the complaint.⁶⁴

In the case that a DPA’s investigation finds a violation of the principles of the GDPR, they are endowed with a wide range of administrative sanctioning powers. Certain of these are described as corrective powers—these have been discussed above, in Sect. 2.4. Perhaps most significantly, these include the ability to ‘impose a temporary or definitive limitation including a ban on processing’.⁶⁵ Beyond these powers, however, DPAs also have the power to impose administrative fines. The scale of these fines is colossal. The power is, as Wybitul puts it: ‘drastic’.⁶⁶ This power is, arguably, the primary driver of all reaction to the GDPR.

There are two levels of fine relevant for biobanking actors. First level: Article 83(4) outlines fines of ‘10,000,000 EUR, or…up to 2% of the total…annual turnover’ relevant for violations of certain substantive provisions—for example data controller obligations or certification obligations.⁶⁷ Second level: Article 83(5) outlines fines of ‘20,000,000 EUR, or…up to 4% of the total…annual turnover’ relevant for violations of other substantive provisions—for example core data protection principles, sensitive data processing prohibitions and data subject rights.⁶⁸

Fines need not, however, always be imposed at maximum levels. The GDPR provides DPAs with certain leeway in light of the specifics of the case. The GDPR provides, what Schwartz describes as ‘a multi-factor test for calculation of administrative fines’. This test—subsequently refined and clarified by EDPB guidance—requires DPAs to consider factors such as the gravity and intentionality of the infringement.⁶⁹ In light of such considerations the DPA is permitted to—in relation to minor infringements—waive the fine altogether or impose the fine at discretionary level.⁷⁰

3.4 The GDPR’s Sanctions Mechanism in the Biobank Sanctions Ecosystem

There are many sanctioning regimes available for violations of data privacy principles relevant for biobanking actors identifiable across EU Member States. For example, evident in the German context, but in few others, are civil sanctions under Articles 253 or 823 of the Bürgerliches Gesetzbuch for misappropriation of biological samples.⁷¹ Owing to the variety of sanctions and sanctioning regimes operational across Europe, it is not possible to monolithically assert exactly how the GDPR’s sanction mechanisms will fit into the biobank sanctions ecosystem. Nevertheless, general observations might be made.

In the first instance, despite DPA discretion and the variety of sanctioning regimes, sanctions under the GDPR are intended to have a harmonizing effect across the EU. This results from the GDPR’s nature as an instrument of EU law directly binding in all EU Member States as well as the limited direct capacity for derogation from its sanctions regime. Accordingly, no extensive deviation between Member States is intended. Such deviation would lead to Member States in which conditions for data processing were favourable compared to other Member States—bringing the risk of ‘forum shopping’. Whilst the dangers of forum shopping seem rather small in relation to biobanks, the harmonization rationale remains relevant.

Indeed, the need for harmonization in fines has been recently explicitly enunciated by the Article 29 Working Party. In their opinion on administrative fines, they conclude: ‘[Infringements] should lead to the imposition of ‘equivalent sanctions’.⁷² They explicitly base this conclusion on the recognition that: ‘equivalent sanctions in all Member States as well as effective cooperation between supervisory authorities of different Member States is seen as a way ‘to prevent divergences hampering the free movement of personal data within the internal market’, in line with [one of the core aims of] of the Regulation.’⁷³

Regardless of the base harmonization rationale, there will still be instances in which the sanctions for violations of the GDPR’s principles in biobanking will differ across EU Member States. Two cases are noteworthy. First, certain public biobanks, in certain Member States may not be subject to administrative fines at all. The GDPR clarifies Member States may limit or exclude fines as they relate to public bodies.⁷⁴ Second, supplementary sanctions—beyond those in the GDPR—are still permissible in certain cases. The GDPR clarifies that Member States may define sanctions for violations of the GDPR not already covered by administrative fines.⁷⁵ This includes, as Gola observes, the possibility to outline criminal sanctions for biobanking actors.⁷⁶

Despite the above clarifications, it remains unclear just how far Member States can take the possibility to impose supplementary sanctions in outlining sanctions for infringements not covered by administrative fines—in terms of the type of violation which may be addressed as well as the form and degree of sanctions. For example, the relevant Article simply states that Member State sanctions must be: ‘effective, proportionate and dissuasive’.⁷⁷ There is, however, no common standard regarding this concept. Such vagaries leave considerable room for manoeuvre which will doubtless be exploited by Member States.

Looking across the oversight and sanctions mechanisms, one cannot help but admire their comprehensiveness—at least on paper. Indeed, this comprehensiveness becomes starkly evident when one compares them to many of the alternative oversight and sanctions mechanisms outlined for biobanking—both on international and European level.⁷⁸ Despite this comprehensiveness, however, there are problems identifiable with these mechanisms. The most important of these will be discussed in the following section.

4 Problems with Biobank Oversight and Sanction Mechanisms Under the GDPR

4.1 Introduction

A framework for the critical analysis of the oversight and sanctions mechanisms might consider them from three perspectives: whether they provide adequate protection for data subject rights; whether they disproportionately impact other interests—particularly research interests—tied up with the biobanking process; and whether they are practically implementable in the biobanking context. A critical glance at the mechanisms from these perspectives reveals a number of issues. Three seem particularly worthy of discussion.⁷⁹

4.2 The Lack of Clarity in the DPIA Obligation (Problem 1)

There is much text in the GDPR outlining the DPIA obligation. This is, unfortunately insufficient to remove uncertainty in the biobanking context. As Wright observes generally, the provisions in the GDPR remain ‘rather sketchy’.⁸⁰ This is a problem of practical implementation.

In the first instance, there remains a lack of clarity about the focus of a DPIA. In particular, it remains unclear whether a DPIA represents another exercise in compliance with the GDPR or whether it represents an effort to go beyond the boundaries of the GDPR’s concrete substantive principles to identify and mitigate all potential harms to research subjects.⁸¹ The text of the GDPR seems to suggest the latter, requiring that a DPIA consider and mitigate risks to all ‘rights and freedoms’.⁸² The practical consequences of this broader approach for the conduct and outcome of, as well as the legal obligations flowing from, a DPIA, however, remain unclear.⁸³

In turn, there is a lack of clarity around the method and modalities of a DPIA.⁸⁴ Here, four significant issues persist. First, the range of biobanking operations one DPIA may address is unclear. The GDPR explains that multiple similar operations can fall under one DPIA but is silent as to how different operations might be.⁸⁵ Second, the precise method to be used to conduct a DPIA is unclear. The GDPR provides some instructions, but these are far from an operationalisable methodology.⁸⁶ Third, the effect of a change in processing is unclear. The GDPR requires a review of the DPIA but is silent as to what the consequences of incompatibility should be.⁸⁷ Finally, the question of the resources to be invested to conduct an efficacious DPIA remain completely unaddressed.⁸⁸

Finally, there is a lack of clarity as to how the DPIA relates to documentation required by other national bodies’ approval processes. Compare, for example, the information and process of a DPIA in the GDPR with the information and process of submission of an application for REC approval under Articles 5–7 of the Clinical Trials Regulation.⁸⁹ The overlap is significant—both processes require the production of an outline of the foreseen processing activity as well as a consideration of the foreseen benefits and risks to research subjects. The blunt answer that both processes are legally required is technically correct but substantially unsatisfactory—at the very least, this may require an inefficient use of resources.

Despite the apparently myriad problems, there is reason to think that the lack of clarity in the DPIA obligation will not have a significant impact on in biobanking. Two points are significant. First, a DPIA itself is best considered as an information surfacing process.⁹⁰ The substantive impact of an improperly conducted DPIA thus seems likely to be minimal—a DPIA itself will neither ensure or prevent compliance with the GDPR. Second, the DPIA obligation is novel for all actors—biobanking actors and enforcement actors. It thus seems likely that the lack of clarity in the process—including as to how it relates to other assessment processes—will crystalize over time. Until then, it seems unlikely that DPAs or other national oversight bodies will not be too zealous in enforcement.

Equally, the GDPR does facilitate solutions to the lack of clarity in the DPIA obligation both from within and from without. In terms of internal solutions, the GDPR clarifies the EDPB can act to clarify the DPIA obligation.⁹¹ Indeed, the power has already been used in the adoption, by the Article 29 Working Party—the EDPB’s forerunner—of DPIA guidelines.⁹² In terms of external solutions, both Articles 9(4) and Article 89(1) permit EU Member States to enact supplementary conditions clarifying—including in terms of substance, process and relationships to other comparable processes—the DPIA obligation in biobanking.⁹³

4.3 The Lack of Obligation to Seek Prior Approval (Problem 2)

As discussed in Sect. 2.3, prior approval by an oversight body is not an obligation in the GDPR. In comparison with international norms this represents an insufficient standard of research subject protection. As will be discussed below, this is a problem for the standard of protection offered to research subject rights.

The obligation to seek prior approval for all genomic research activity may be seen as a minimum standard of research subject protection to be provided by all efficacious biobank law. This is arguable by virtue of the fact the obligation constitutes a norm evident across all biobank relevant international instruments.⁹⁴ The World Medical Association Declaration of Taipei states, for example, in Article 19: ‘the ethics committee must approve use of data and biological material.’

The GDPR does not explicitly foresee an obligation to gain prior approval from a DPA before engaging in biobank processing. It is true that the GDPR includes provisions on prior approval by DPAs of biobanking processing. These provisions only become relevant, however ‘[when] a data protection impact assessment … indicates that processing would result in a high risk in the absence of measures taken by the controller’.⁹⁵ Recall here the observation of De Hert et al., that the decision as to whether the Article is triggered is eventually with the biobanking actor.⁹⁶ It is also true that the GDPR foresees the possibility for Member States to derogate from the GDPR and require prior consultation with a DPA for specific types of processing.⁹⁷ It remains to be seen, however, how many Member States will implement this requirement.

Nor does the GDPR foresee the obligation to gain prior approval from a national body before engaging in biobank processing. The GDPR does foresee the establishment, at national level, of safeguards for scientific research which may translate into the obligation, in certain Member States, for biobanks to obtain prior approval for processing operations.⁹⁸ This may prove a panacea for the issue in future. It does not, however, constitute a panacea now. It is not the case that national body advance approval procedures are comprehensively present in all EU Member States. Even where such advance approval procedures are in place, it is not necessarily the case that they have the power to prevent biobank processing from going ahead. Recall the example of the non-binding nature of the Estonian Biobank’s REC decisions.⁹⁹

Despite the apparent significance of the issue, the substantial consequences of the lack of the obligation in the GDPR look likely to be, practically, of diminished significance. Two factors are significant. First: the GDPR will, as discussed above, require prior consultation in certain cases—for example, in cases in which it is uncertain whether risks have been adequately addressed in the DPIA. Second: whilst supporting national oversight bodies are, from a legal perspective, not a panacea in providing a perfect advance approval landscape, their prevalence and efficacy should not be underestimated. For example, whilst certain RECs may not have the power to issue binding decisions on whether biobank processing may proceed, it would also, practically, be highly unusual for their decisions to be ignored.

Equally, the GDPR does facilitate solutions to the issue both via internal and external approaches. In terms of internal approaches: there is no doubt the EDPB could issue guidance highlighting the need to seek prior approval before engaging in biobank processing.¹⁰⁰ In terms of external approaches: Articles 9(4), Article 36(5) and Article 89(1) grant power to EU Member States to elaborate supplemental rules concerning the processing of sensitive personal data in research in relation to the obligation for biobanking actors to seek prior approval from DPAs, other national oversight bodies, or both.

4.4 The Size of Administrative Fines (Problem 3)

The huge size of potential administrative fines outlined in the GDPR is justified based on the need to give data protection law teeth in the face multinational internet companies. This is an image of perpetrator which does not match the majority of public research biobanks at all.¹⁰¹ As a consequence, for such biobanks, fines are disproportionate. This is a problem concerning the disproportionate impact on interests tied up with the biobanking process.

The reasoning behind the scale of fines—up to 20,000,000 EUR or up to 4% of turnover—makes sense when placed in context. In the legislative process, the scale of fines was discussed as necessary as a deterrent to multinational internet companies’ violating the GDPR.¹⁰² Further proof the legislator had this model of target perpetrator in mind when drafting the fines is found in the recognition by certain legal scholars, for example Faust et al. and Bergt, that fines share scale and form with those in EU monopolies law—law concerned with the regulation of cartels and market dominance.¹⁰³

However, the typical public biobanking actor does not compare to such a perpetrator. How then, should such fines be proportionate? Public biobanking actors do not compare in size, financial clout or purpose with large internet companies—or indeed any organisation the target of monopolies law. In this regard, it is enlightening to consider some of the—although admittedly limited—empirical work on the financial constitution of biobanks in the EU. Here, Zika et al. clarify that only 3% of biobanks which answered their large-scale survey were even privately owned.¹⁰⁴ An absurd position: the tiny biobanks of the EuroBioBank rare disease network face the same sanctions as Google.¹⁰⁵

Despite the potentially crippling, disproportionate nature of fines, there are factors which look likely to, practically, significantly diminish the impact of the problem on biobanking—although the possibility of huge fines will still hang, like the sword of Damocles, above biobanking actors’ heads. As discussed in Sect. 3.3, DPAs have significant discretion in setting the quantities of fines. For a number of reasons, it seems unlikely DPAs will ever set maximum—or even near maximum—fines. Quite apart from the fact these would seldom be proportionate, such an act would unlikely be in a DPA’s best interest. DPAs operate in a politicised environment. They are likely to have little appetite to interfere with biobanking activity with normative legitimacy and, as observed by Simon et al., public support.¹⁰⁶

Equally, solutions to the disproportionate scale of fines are also available through the GDPR as well as parallel law. In terms of solutions available through the GDPR: Article 70(k) is clear the EDPB should: ‘[draw] up guidelines for supervisory authorities concerning the application of…and the setting of administrative fines’. In terms of parallel law: the flexible construction of Article 9(4)—which specifically permits Member States to enact ‘limitations’ on the principles of the GDPR in relation to sensitive data—could legitimate Member State derogations restricting the scale of fines relating to biobanking.

5 Conclusion

This contribution dealt with two of the key mechanisms concerning biobanking outlined in the GDPR: the oversight mechanism; and the sanctions mechanism. Indeed, it is arguable that the provisions of the sanctions mechanism—in particular the huge potential scale of administrative fines—are one of the key factors driving the rise in concern for, and efforts toward compliance with, data protection law since the GDPR came into force in early 2016 and since its application in early 2018.

The oversight and sanctions mechanisms play no substantive role in the definition of the public interest—or the conditions pertaining to processing in service of the concept—in relation to biobanking under the GDPR. Nevertheless, they are indirectly determinative of the concept in two key ways. In the first instance, as meta-systems ensuring compliance with the substantive principles outlined in the GDPR, these mechanisms ensure respect for the boundaries of, and conditions attached to, the public interest under the GDPR. In turn, the emphasis on each mechanism acts as an indicator of the level of the legislator’s general concern with the ability to police and control the boundaries and conditions of the public interest under the GDPR.

The oversight mechanism in the GDPR applicable to biobanking is—at least on paper—extensive.¹⁰⁷ Indeed, it consists of four types of oversight. First: ex ante assessment—the need for biobanking actors to conduct a DPIA. Second: prior notification and approval—the need for certain biobanking actors to obtain approval from a DPA and, potentially, national bodies, prior to processing. Third: ongoing oversight—the need for biobanking actors to submit to investigation by a DPA, a DPO and, potentially, national bodies. Fourth: general oversight—the power for DPAs and the EDPB to issue general opinions on the biobanking sector. It remains, however, somewhat unclear how the various oversight bodies—in particular DPAs and national bodies—will engage with each other.

The sanctions mechanism in the GDPR applicable to biobanking is also—at least on paper—extensive. The mechanism consists of two key types of sanction. First: liability and compensation sanctions. In the case a biobanking actor is brought before court and found guilty of an infringement of the GDPR, this actor will be liable to pay compensation. Second: administrative sanctions. The range of administrative sanctions available is broad, but perhaps most important are the colossal potential administrative fines—up to 20,000,000 EUR or 4% of turnover. It remains to be seen how the sanctions mechanism explicitly elaborated in the GDPR will fit with supplemental Member State sanctions.

Whilst these two mechanisms display an impressive comprehensiveness in approach, several problems concerning their negative impacts on research subject rights, research interests and their practical implementability to biobanking, are also evident. Three might be highlighted as particularly significant. First: the lack of clarity in the DPIA obligation. Second: the lack of obligation to seek prior DPA approval. And third: the huge scale of potential administrative fines. Although each problem initially seems significant, however, a closer consideration reveals each is subject to practically mitigating factors as well as to resolution through the GDPR, or parallel Member State law, or both.