Legal Q&A: What is the legal basis for biobanking in Austria?

BBMRI.at Legal Helpdesk answers

The BBMRI.at Legal Helpdesk Service – operated by legal experts from BBMRI.at partner UNIVIE– answers questions on legal and regulatory matters around biobanking and/or using biological samples and data. This service is offered to BBMRI.at partners to support them, as biobanking and research using biological samples and data (e.g. human, animal/veterinary, microbial, etc.) may raise legal questions. Answers provided by UNIVIE to legal questions are published in the BBMRI.at Knowledge Base.

QUESTION:

What is the legal basis for biobanking in Austria?

ANSWER:

Austrian regulations relevant for biobanks

Currently, as already indicated in previous Q&As, there is no single European Union or Austrian regulation that explicitly regulates biobanks and biobanking (i.e. a legal act that would apply solely to biobanks). Nevertheless, there is existing EU framework that addresses selected aspects relevant for biobanking, which has already been described in other Q&As published on the BBMRI.at website.^[1] The same applies to the information concerning the basis for setting up a biobank.[2] In this Q&A, we will focus on the explanation of selected, particularly relevant aspects concerning the Austrian legal landscape pertaining to biobanks and their daily activities consisting of collection and further processing of (personal) data and samples.

The Austrian legislation regulates biobanking through a combination of several legal acts which cover selected issues pertaining to it, such as data protection, bioethics, biomedical research, genetic testing and analysis.^[3]

The most relevant legal acts which constitute legal bases for activities of the biobanks in Austria and which should be reviewed and considered in the first place are:

1. Datenschutzgesetz (DSG) – EN: Austrian Data Protection Act
2. Forschungsorganisationsgesetz (FOG) – EN: Austrian Research Organisation Act
3. Gentechnikgesetz (GTG) – EN: Austrian Gene Technology Act
4. Gewebesicherheitsgesetz (GSG) – EN: Austrian Tissue Safety Act

Datenschutzgesetz (DSG) – EN: Austrian Data Protection Act

The DSG complements the GDPR by providing national-specific provisions concerning personal data processing.

This legal act is of relevance for the biobanks and their activities due to the fact that the data processed by such entities may fall under the definition of personal data, and furthermore, due to the fact that they may represent ‘data concerning health’ (see Article 4(15) GDPR) of the patients/research subjects or their ‘genetic data’ (see Article 4(16) GDPR), they may even fulfil the definition of special categories of data, and the processing of such data has to follow strict rules and have a specific legal basis.

Article 2 §7 (1) DSG details that in the context of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes which do not aim to obtain personal results, it is possible for the entities being data controllers to process all data which are publicly accessible, were legitimately investigated for other investigations or other purposes or are pseudonymised personal data for the data controller and the controller cannot determine the identity of the data subject by legally permissible means.

In other cases, where the data are processed for above-mentioned purposes and are not covered by Article 2 §7(1), personal data may only be processed (1) in accordance with specific legal provisions, or (2) with the consent of the data subjects or (3) with the approval of the data protection authority (in Austria – Datenschutzbehörde – DSB).

The specific legal provisions included in Article 2 §7(2)(1) DSG, which are relevant for biobanks, are included in the Forschungsorganisationsgesetz (FOG) described below.

Forschungsorganisationsgesetz (FOG) EN: Austrian Research Organisation Act

The FOG provides a framework for public interest research and allows for secondary use of (personal) data and samples collected for other (primary) purposes.

At the same time, FOG implements the General Data Protection Regulation by providing a legal basis for processing of personal data pursuant to Article 9(2)(j) and Article 89 GDPR, i.e. for the archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. As required by these GDPR articles, such a legal basis should be included in the EU or Member States law. It should be stressed that further processing of personal data for scientific research, if carried out according to Article 89(1) GDPR, is considered compatible under the GDPR (see Article 5(1)(b) and recital 50 GDPR).

Furthermore, the FOG is lex specialis to the DSG, as it lays down “specific legal provisions” for processing of personal data for scientific research purposes, indicated in §7(2)(1) DSG.

The legal bases defined in this legal act, which play a significant role in the operation of the biobanks are, inter alia, included in:

1. §2d(2) FOG –establishing a general basis for processing of the data for research purposes by scientific institutions. According to this provision, personal data, including special categories of data, can be processed by scientific institutions for scientific research purposes, in particular in the context of big data, personalised medicine, biomedical research, biobanks and the transmission to other scientific institutions and processors, if:
   1. instead of the name, area-specific personal identifiers or other unique identifiers are used for allocation; or
   2. the processing is carried out in pseudonymised form; or
   3. the processing is carried out without publishing the data, or publishing the data only in anonymised or pseudonymised form, or publishing the data without names, addresses or photographs; or
   4. the processing is carried out exclusively for the purpose of anonymisation or pseudonymisation and no disclosure of direct personal data to third parties is involved.

1. §2d(3) FOG – defining a “broad consent”. This provision reads that the processing of data for the purposes such as archiving in the public interest, scientific or historical research or statistical purposes is possible if the data subject voluntarily, in an informed manner and unambiguously, indicates his/her will in form of a declaration or other unambiguous confirmatory act to agree to the processing of personal data concerning him/her, whereby the indication of a purpose is made clear by the indication of one or several research areas or research project or part of a research project.

1. §2f(1) FOG – this paragraph provides the legal basis for the creation and operation of repositories, and may apply to biobanks, i.e. one of the type of data and samples repositories. The scientific institutions (defined in §2b(12) FOG) may collect, archive and systematically record research material for the archiving in public interest, scientific and historical research and statistical purposes and process personal data to ensure optimal access to these data and research material. The types of data which can be processed are further listed in the same paragraph. ‘Research material’ is defined in FOG as “physical items that may be relevant for purposes pursuant to Art. 89 (1) GDPR, such as in particular biological, genetic, geological or other samples (…)” (§2b(6) FOG) whereas ‘scientific institutions’ are “natural persons, groups of persons and legal persons pursuing purposes pursuant to Art. 89 (1) GDPR, i.e. in particular carrying out research and experimental development activities, regardless of whether this occurs for charitable purposes or not or in a university, company or non-academic setting” (§2b(12) FOG).

The relationship between both paragraphs, which has an impact on their interpretation in the context of biobanks and their activities, is further explained in Question no. 17[4] .

Gentechnikgesetz (GTG) – EN: Austrian Gene Technology Act

The GTG governs the use of genetic testing and analysis on humans in Austria, which plays a relevant role in the context of the use of the material collected and stored in the biobanks. Furthermore, the GTG outlines the conditions for the storage and use of biological material, especially if it serves in the process of extracting genetic information about a person.

As already described in the answer to Question no. 1[5], the GTG prohibits interventions to the human germ line (§ 64 GTG) and authorizes human genetic analyses for medical purposes conducted in line with the state of the art in science and technology (§ 65 GTG) as well as genetic analyses for scientific or educational purposes (§ 66 GTG).

§ 65 (1) GTG describes four types of genetic analyses formedical purposes:

Type 1: “[…] to determine an existing disease, prepare for treatment or monitor the course of treatment […]” (authors’ translation), based on information about concrete somatic changes of number, structure, sequence or chemical modification of chromosomes, genes or DNA segments;

Type 2: “[…] to detect an existing disease that is based on a germline mutation” (authors’ translation);

Type 3: “[…] to determine a predisposition to a disease, in particular a predisposition to a genetic disease that may break out in the future or to determine a carrier status for which prophylaxis or therapy is possible according to the state of the art in science and technology” (authors’ translation);

Type 4: “[…] to determine a predisposition to a disease, in particular a predisposition to a genetic disease that may break out in the future or to determine a carrier status for which no prophylaxis or therapy is possible according to the state of the art in science and technology” (authors’ translation).

According to §66 GTG, the genetic analysis for the scientific or educational purposes can be performed only on de-identified samples. Additionally, non-genetic medical data linked to genetic data from the same individual must also be de-identified, unless it has been explicitly consented by the individual to assign the data to them. The outcomes of the genetic analysis performed for above-mentioned purposes may be published if it is ensured that the sample donor cannot be identified. The provisions of § 2d (1) and (3)-(8), § 2f (1) No. 6 and (3), (4), (6) and (7) as well as § 2i (1), (2), § 2j and § 2k of the Research Organisation Act (FOG) remain unaffected by this regulation – they must continue to be complied with in this context.

According to §69(1) and (2) GTG, genetic analyses within Types 2, 3 and 4 (see above) – including those carried out as part of a prenatal examination – may only be performed after the subject has provided written confirmation that they have been informed in advance by a specialist trained in human genetics/medical genetics or a specialist competent in the field of indication about the “nature, scope and significance” of the analysis and have freely consented to the analysis based on this knowledge. Furthermore, the person carrying out the genetic analysis and processing personal data obtained in the process must abide by the confidentiality requirements defined in §71 GTG.

Gewebesicherheitsgesetz (GSG) – EN: Austrian Tissue Safety Act

The GSG plays a significant, although indirect, role in the regulation of biobanks in Austria. Its main objective is to ensure safe and secure handling of human tissues and cells for human use (§1 GSG); Nevertheless, selected provisions may be relevant to biobanking activities, especially when biobanks store tissues and cells that might be used in clinical applications, and hence fall under the definition of a ‘tissue bank’, which reads “any establishment in which activities related to the processing, storage or distribution of human cells and tissues for human application are carried out” (authors’ translation) (§2(15) GSG).

In such cases, such a biobank should adhere to the rules applicable to tissue banks and defined in the GSG, such as, among others, rules concerning the authorisation/permit to operate as a tissue bank (§8, §22-§25a, §28, §29 GSG), responsible person (§9 GSG), quality assurance (§10 GSG), relationships between tissue banks and collection facilities, third-country suppliers and other third parties (§11 GSG), processing, storage and distribution of cells and tissues (§13-15 GSG), labeling (§15a GSG), documentation (§16 GSG), reporting of serious incidents and serious adverse reactions (§17 GSG), duty of confidentiality (§18 GSG).

Furthermore, such a biobank which is recognised as a tissue bank under the GSG, has to adhere to the requirements defined in:

1. Ordinance of the Federal Minister of Health, Family and Youth on Tissue Vigilance Notifications (Tissue Vigilance Ordinance) (DE: Verordnung der Bundesministerin für Gesundheit, Familie und Jugend betreffend Gewebevigilanzmeldungen (Gewebevigilanzverordnung – GVVO)[6],
2. Ordinance of the Federal Minister of Health, Family and Youth laying down more detailed regulations for the operation of tissue banks (Tissue Bank Ordinance) (DE: Verordnung der Bundesministerin für Gesundheit, Familie und Jugend, mit der nähere Regelungen für den Betrieb von Gewebebanken getroffen werden (Gewebebankenverordnung – GBVO)[7];
3. Ordinance of the Federal Minister of Health, Family and Youth establishing standards for the procurement of human cells and tissues intended for use in humans (Tissue Procurement Organisation Ordinance) (DE: Verordnung der Bundesministerin für Gesundheit, Familie und Jugend zur Festlegung von Standards für die Gewinnung von zur Verwendung beim Menschen bestimmter menschlicher Zellen und Geweben (Gewebeentnahmeeinrichtungsverordnung – GEEVO)[8].