Legal Q&A: What are the main concerns regarding processing samples and data from deceased persons?

BBMRI.at Legal Helpdesk Service answers

The BBMRI.at Legal Helpdesk Service answers questions on legal and regulatory matters around biobanking and/or using biological samples and data. This service is offered to BBMRI.at partners to support them, as biobanking and research using biological samples and data (e.g. human, animal/veterinary, microbial, etc.) may raise legal questions.

QUESTION:

Legal Q&A: What are the main concerns regarding processing samples and data from deceased persons?

ANSWER:

1. Processing personal data of the deceased

Concerning compliance with data protection laws, Recital 27 of the European Union General Data Protection Regulation (GDPR) specifies that the GDPR does not apply to the processing of data of deceased persons. This means that no legal basis is needed, including consent, to process such data. However, in the case of health data, specifically genetic data, it is often pointed out that certain personal data of the living relatives could be inferred. Hence, it would still be recommended for the data controller to maintain appropriate security measures under the GDPR for such data, such as pseudonymization, or the exclusion of cross-matching with data of other third-parties.

Although the GDPR does not apply to data of deceased, Recital 27 GDPR stipulates that Member States may also provide their own rules regarding the processing of such data. However, the Austrian data protection law (Datenschutzgesetz, DSG) does not make use of this option and there are no specific rules on this.

From a data protection law compliance perspective, depending on the specific category of data, it is allowed to use the data of deceased persons without informed consent (IC) as they are excluded from the definition of personal data under the GDPR and the DSG also does not provide for specific rules in this regard.

2. Processing samples and tissues from the deceased

Possible limitations to using samples of deceased persons could stem not from data protection laws, but from personality rights which do not cease to apply with the moment of death. In Austria, these rights apply in copyright law but also civil law (Allgemeines bürgerliches Gesetzbuch, ABGB). §16 ABGB protects personality rights of individuals, in particular human dignity, individuality and personal development.^[1] This also encompasses protection of privacy and personal data (as also protected under Article 8 of the European Charter of Human Rights). According to §16 and §17a ABGB, personality rights do not cease with the moment of death – but a new form of protection is created – protection of the deceased person’s good memory (in German Andenken). Meissel states that the right to one’s self-development also encompasses that the reputation and characteristics of a person are safeguarded post mortem.^[2] The exact extent of personality rights post mortem may involve a balancing of interests between public interest and the interest of others and the deceased person’s rights to have their good memory protected. This includes respecting the consent, or its lack, for processing of certain categories of personal data. However, §17a ABGB specifically mentions that interventions are permitted in the interest of research, indicating that the use of samples for research purposes is, as a general rule, allowed.

Furthermore, the general guidelines by international organisations base the use of human tissue samples on consent from the deceased donor or, otherwise, through the authorisation of a third person. The Council of Europe produced the 2006 Recommendation of the Committee of Ministers to Member States regarding research on biological materials of human origin. This document states, in its article 13(1), that “Biological materials should not be removed from the body of a deceased person for research activities without appropriate consent or authorisation”. Additionally, such biological materials “[…] should not be removed or supplied for research activities if the deceased person is known to have objected to it.” (Article 13(2))^[3].

The use of a deceased person’s tissue samples for research is permissible in a broad range of countries. Although most of the countries who have adopted laws allowing for samples from deceased individuals to be collected and used for research purposes countries require an active form of consent from the donor (or authorisation of a third party representative, such a family member) to pursue such endeavours, others, such as the Netherlands – who have implemented this particular mechanism^[4] – structure the use of tissues from deceased people for certain forms of research on an ‘opt-out’ system. The opt-out system^[5] is common for organ donation for transplantation or therapeutic purposes but less widespread for organ and tissue collection for research purposes. Countries – for instance, Portugal – have an opt-out system in place for organ transplantation^[6] but the collection of tissue samples for research requires – with some exceptions – an active form of consent^[5].

The same situation applies to Austria. Organ transplantation in Austria is regulated by the “Organtransplantationsgesetz” (‘OTPG’)^[7]. This federal law specifies the conditions under which human organs may be removed and used for transplantation purposes^[8]. However, the OTPG does not apply to the use of organs for research purposes unless they are intended for transplantation into the human body^[9]. The OPTG relies on the “objection solution” (“Widerspruchslösung”) that allows the organ removal as long as the deceased or, prior to their death, their legal representative did not expressly refuse to donate organs (opt-out)^[10]. The highest evidential value provides the entry in the register of objections maintained by Gesundheit Österreich GmbH^[11].

The removal of organs for research purposes that are not intended for transplantation into the human body requires a declaration of will from the deceased prior their death (opt-in). This is possible because the right to self-determination extends beyond death^[12]. Therefore, in Austria it is possible to donate one’s body only by submitting a declaration of intent at the respective Anatomical Institute in Vienna, Graz or Innsbruck.

3. Selected Ethical Aspects and Conclusion

Personality rights discussed in section 2 are also closely tied to ethical aspects. In addition to data privacy concerns, the processing of the data of deceased persons should be viewed from an ethics perspective, including the duty of confidentiality, respecting autonomy and dignity, respecting the wishes of the deceased persons. In this context, IC becomes relevant again. It would be advisable to look into the consent forms to see whether persons have consented to the use of their samples also after death, including checking whether they specifically withheld consent for this purpose.

To conclude, although the consent requirements do largely not apply from a legal, especially, data protection, perspective, consent is an important ethical aspect which should not be overlooked.

4. Further Resources

Here are some further sources with useful information on the topic:

Legal:

Meissel in Fenyves/Kerschner/Vonkilch, ABGB³ (Klang) § 16 Rz 1.

Koch in Bydlinski/Perner/Spitzer (Hrsg), KBB – Kurzkommentar zum ABGB⁷ (2023) zu § 17a ABGB.

Other:

Global Alliance for Genomics & Health, ‘GDPR Brief: processing the data of the deceased for scientific research purposes — looking beyond the GDPR?’ https://www.ga4gh.org/news_item/ga4gh-gdpr-brief-processing-the-data-of-the-deceased-for-scientific-research-purposes-looking-beyond-the-gdpr/.

Lars Ursin and Maria Stuifbergen, ‘Ethics of Dead Participants: Policy Recommendations for Biobank Research’ (2018) 44 Journal of Medical Ethics 695.