Legal Q&A: Informed Consent in Biobanking (IC): Legal Framework, Sample Use Across Sites, and Right to Withdraw

BBMRI.at Legal Helpdesk answers

The BBMRI.at Legal Helpdesk Service – operated by legal experts from BBMRI.at partner UNIVIE- answers questions on legal and regulatory matters around biobanking and/or using biological samples and data. This service is offered to BBMRI.at partners to support them, as biobanking and research using biological samples and data (e.g. human, animal/veterinary, microbial, etc.) may raise legal questions. Answers provided by UNIVIE to legal questions are published in the BBMRI.at Knowledge Base.

QUESTION:

Legal Q&A: What is an informed consent (IC)?

ANSWER:

The ethical and legal requirement of informed consent

For biobanks to obtain, store and use human biospecimens, an informed consent must be collected from the prospective research participant. Informed consent refers to the process of, upon provision of sufficiently detailed and accurate information, seeking permission, from the prospective participant, to collect their sample, store it for an agreed timeframe and use it for (most often) research-related purposes^[1]. (Informed) consent (Article 4(11) of the General Data Protection Regulation, hereinafter: GDPR^[2]) may also refer to the authorization, granted by the participant, to process^[3] the personal data^[4]  – and, more specifically, data concerning health^[5]  – which are intertwined with the sample provided to the biobank. Within this context, consent may serve as the legal basis for processing personal data under the GDPR^[6] and should also be preceded by the provision of certain information to the data subject (Article 7(3))^[7].

Collection of informed consent is a prerequisite for interventions in the medical and health field and, more specifically, in biomedical research settings. It also applies to obtaining, storing and using a human biological sample (such as tissue, blood or DNA) in the context of biobanking^[8]. Multiple (binding and non-binding) legal instruments, both at international and national level refer to the requirement of seeking informed consent in research involving humans. We can point out, inter alia:

• Article 5 of the Council of Europe’s Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine (Oviedo, 4.IV.1997). Austria is not a signatory-State of this Convention;
• Article 14 of the Council of Europe’s Additional Protocol to the Convention on Human Rights and Biomedicine, concerning Biomedical Research (Strasbourg, 25.I.2005). Austria is not a signatory-State of this Protocol;
• Article 3, paragraph 2 of the Charter of Fundamental Rights of the European Union;
• §§ 25~32 of the World Medical Association’s Declaration of Helsinki – Ethical Principles for Medical Research Involving Human Subjects (last amended in October 2024);
• §66 of the Austrian Gentechnikgesetz.

Seeking informed consent is, therefore, both an ethical and legal obligation^[9], designed to ascertain whether the research participant is part of any research enterprise of her/his own free will. For there to be a conscious volition from a participant, researchers must provide adequate, comprehensible information on what the research project entails and what participants’ rights are, both as sample providers and personal data subjects. Legislation applicable to obtaining consent (or assent) from children and minors in research settings has been covered by our Helpdesk in Question no. 4^[10].

The topic of broad consent^[11], as it emerges in the European Union and Austrian national legal frameworks, has been addressed in Question no. 17. Another modality of consent is a “study specific consent”, where participants donate samples (and data) to use for a single specific research study. Implementing broad consent can be beneficial to biobanks as they eliminate the need to recontact research participants to request their consent to use samples and data for any future research endeavours. Nevertheless, broad consent should not be deemed an antonym of study specific consent. Although some authors use both concepts interchangeably^[12], broad consent should be specific, i.e., study specific and broad consent relate to different levels of specificity, not to be confused with a “blanket consent”.

More information on these mattes can be found in the answer to Question no. 17.

Informed consent presumes that:

• the prospective research participant has been informed of the conditions in which his sample will be obtained, stored and the purposes for which it has been collected and will be processed. Information includes, inter alia: [13] information about the research project (title, nature and objectives of the study), researchers and institutions carrying out the research, data and sample access and transfer conditions, details of the main intentions of tissue collection and the range of uses of data as well as time frame for storage; mention of risks involved in any of the interventions required to obtain blood or tissue samples; information about measures taken to protect participants’ personal rights and to guarantee confidentiality; description of any commercial interests deriving from the research and whether the prospective participant is entitled to any such potential commercial benefits and any duties to disclose information to third parties;
• this information should be expressed in a clear, sufficiently detailed but accessible form;
• the individual giving consent is capable and competent to comprehend and sign (in those cases where consent has been sought in writing) for themselves. In those cases where this precondition is not fulfilled, consent from a parent, guardian or any other legally admissible legal representative is required;
• the consent is freely given, unambiguous and explicit (there has to be an affirmative action from the prospective participants);
• the individual is informed about the right to withdraw consent at any time and about the procedure to withdraw consent.

Similar provisions are included in the GDPR for the provision of consent for data processing activities. See Recitals 40 to 43 and Article 7 of the GDPR.

Regarding transfers of samples and data (for example, situations where a different biobank, from the one where informed consent was sought, is due to store and process samples and data), we have covered the conditions in which this may occur within the European Union and when such transfers are made to third countries in Question no. 15. The governance of these matters can also be included in the informed consent forms.

A participant in health-related (biomedical) research project should be allowed to withdraw their consent at any time. Withdrawing consent should be as easy as giving consent^[14]. The same principle of consent withdrawal applies to personal data processing in which, according to the GDPR^[15], a data subject has the right to withdraw his or her consent at any time. There are mentions to consent withdrawal in various legal documents as well:

• Article 5(§3) of the Council of Europe’s Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine: Convention on Human Rights and Biomedicine (Oviedo, 4.IV.1997). Austria is not a signatory-State of this Convention;
• Article 14 of the Council of Europe’s Additional Protocol to the Convention on Human Rights and Biomedicine, concerning Biomedical Research (Strasbourg, 25.I.2005). Austria is not a signatory-State of this Protocol.

How consent may be withdrawn should be specified in the informed consent form. Additionally, implications and specific meaning of withdrawing consent within a given Biobank / research project should be mentioned. For example, withdrawal of consent may mean that any collected samples and data are anonymised. More commonly, however, it signifies that any samples and data from the research subject will be destroyed^[16].

In practice, an informed consent form covers both the authorization for processing samples and data and typically will itself include the information required for the consent to be deemed “informed”. Some institutions, such as the World Health Organization’s International Agency for Research on Cancer (IARC) provide templates for informed consent forms which may be used in biobanking settings^[17]. Whilst consent is typically sought in writing, any form of consent which can be documented and recorded for future reference can be admissible, as the researcher should be able to provide evidence that information was provided to the participant and that he/she consented to the proposed endeavour. This rationale is also behind the wording of Articles 5(2) and 7(1) of the GDPR regarding personal data processing, the latter of which states that “[…] the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data” (emphasis added).