The issue of human genetic data protection in relation to activity of biobanks for research under Polish Law
1. Conception and significance of biobanks
„Biobank” seems to be a greatly imprecise term, because the scope of this designation includes the whole spectrum of institutions differentiated in many respects, those being mainly goals to achieve, types of stored samples, organizational independence, as well as financial system. 1Precursors of the biobanking concept were the Scandinavian countries, where already in the 1960s samples from patients were systematically collected and they have been entered into registers of diseases, including oncological diseases and twin registers.
Despite the biobanks popularization, international law failed to create a uniform definition, however in unbinding documents such as recommendations and guidelines, similarity of the essence of definitions is observed. A group of experts set up by the European Commission has compiled 25 Recommendations on the ethical, legal and social implications of genetic testing, in which The EC Expert Group “has considered biobank collections to mean the biological samples themselves, plus the related databases, allowing a certain level of accessibility, availability and exchange for scientific studies.”2While the Organization for Economic Co-operation and Development (OECD) primarily distinguished human biobanks and genetic research databases, defining them together as “structured resources that can be used for the purpose of genetic research and which include: (a) human biological materials and/or information generated from the analysis of the same; and (b) extensive associated information”. 3
Currently, biobanks around the world are experiencing dynamic development. They encompass institutions created for clinical purposes (collection of cells, tissues and organs for transplantation, genetic diagnostics), including blood banks (blood and its products for transfusion, cord blood banks, enabling the obtaining of blood stem cells), for forensic and judicial purposes (police DNA databases) and for scientific research. 4As a result of the progress that still takes place in biomedicine, research biobanks obtained special significance. A turning point was the completion of major goals in human DNA sequencing project (The Human Genome Project). The announcement confirming that 99% of the human genome became sequenced with the accuracy of 99,99% was published on 14 April 2003. 5 With the development of genetic engineering, molecular biology and bioinformatics there appeared new, more accessible and feasible prospects of treatment (e.g. gene therapy – therapeutic aspect) and capabilities to search for basis of different diseases (research aspect). The category of research and scientific biobanks is associated with primarily population-based biobanks, “which store genetic material [or tissue] samples of a representative segment of the country population”. 6 While “gene banks or genetic databases are repositories that analyze DNA exclusively in the pursuit of the genetic determinants of diseases, whether or not specimens were derived from the public at large”.7 The potential of genetic material is related to its unusual durability, stability, informational capacity and also easiness of collecting and sampling. Population biobanks were already created in Estonia, Spain and the UK, as a large scale projects. 8 The existence of such establishments prevents many restrictions on scientific research. First of all, they eliminate the problem of obtaining many research samples, what is particularly significant in polygenic diseases. 9 Scientists are able to use the data collected not only from their patients, but they have a review on large collection of random genetic samples10 “donated by thousands of individuals from the general population who might or might not have a specific disease”11 and through wide cross-section of ethnic groups and environmental specificity, as they may be linked with medical and genealogical history or lifestyle.12 Very high hopes are bound with the existence of biobanks for research purposes. It is expected that the study based on data from biobank will ensure “improving diagnosis of people in terms of their susceptibility to certain diseases, may contribute to customize therapeutic methods to individual genetic characteristics of patient (personalized medicine), will accelerate the discovery and launching of innovative drugs, as well as it will be of great use to identify unknown biomarkers associated with risk of disease” or molecular targets for therapy. Furthermore, the economic aspect and links with the commercial sector are also notable, and will increase its importance.13 Economic aspect is understood as reducing the cost of research, and in the long term – a cost-effective feature of health care financed from public funds, as a result of individualized, concurrently effective treatment and pharmacogenomics improvement.
I'll take the liberty to point out that among these benefits and expectations relating to the existence of biobanks, public menace and treats to the donors of biological material stored in biobanks should be noticed. In this paper I would like to stress the problem of donors’ genetic data protection. It ought to be considered that genetic information is a source of comprehensive information on the person and the persons related to him and it enables almost error-free identification. Due to the specific nature of genetic data, it is indispensable to regulate the activity of research biobanks, so that the data is protected in a way that ensures complete protection of rights and interests of donors. It should be emphasized, that there is also a need to increase public awareness of biobanking of human biological material for scientific purposes which will reduce public anxiety associated with biobanking and will certainly help to improve sourcing database for research. The aim of this study is to determine whether the extent of legal regulations applying to institutions, formed to bank human biological material or donors’ genetic data appears to be sufficient and to ascertain its importance in terms of genetic data of a particular person. It will be necessary to determine what is the legal status of genetic data granted by the Polish legislator, what are the legal remedies to protect them and whether the current legal status is consistent with international standards.
2. The necessity of genetic data protection
Studies conducted with using genetic data collected in biobanks bring the need to balance the conflict between the future advantages for society (public welfare) and the personal rights of donors, because most often the benefits of conducted research do not have a direct and immediate effect on the donor.14The Universal Declaration on the Human Genome and Human Rights clearly establishes the principle of the primacy of the individual over the science, because according to art. 10 “no research or research applications concerning the human genome, in particular in the fields of biology, genetics and medicine, should prevail over respect for the human rights, fundamental freedoms and human dignity of individuals or, where applicable, of groups of people”. “Human genetic data have a special status on account of their sensitive nature” because “they can be predictive of genetic predispositions concerning individuals” and their families, “including offspring, extending over generations” and “the power of predictability can be stronger than assessed at the time of deriving the data”.15 European regulations, along with bioethical documents, devote a lot of attention to concepts of the human genome and genetic data, representing the same trend. At the core of interest and concern interrelated with the issue of genetics, appears fear of its abuse. 16
In the acts of international the concept of human genome is inseparable from human dignity, and what is more significant, the principles of genetic research and human rights guaranteed in connection to genetic material processing are derived from the conception of dignity. It is pointed out that the fundamental rights relating to actions on genetic data are the right to autonomy and the right to privacy of man, from which the following are derived: the principle of independent and informed consent to data processing, the right to be informed about the results of genetic tests, as well as the right not to know. Although, it is raised, that the principle of crucial importance for the protection of genetic material donors is the prohibition of discrimination based on genetic data. According to D.Krekora-Zając “from a practical point of view, the most important thing is to protect against discrimination in insurance, work or other fields of social life“17, among other things: adoption and preventing the possibility to “influence of genetic data on the private lives of people, especially those who are known in public”. 18 For these reasons, the confidentiality of genetic data affecting a person subject to the identification and stored or processed for research purposes should be protected and guaranteed by law. 19
3. Biobanks in Poland
It is impossible to state the exact number of biobanking units functioning in our country. Despite the fact that biobanks for clinical purposes have a long tradition in Poland, biobanks for scientific-research purposes are still treated as relatively new and poorly understood subjects. National Center for Tissue and Cell Banking, established by the Act of 1 July 2005 on The Cell, Tissue and Organ Recovery, Storage and Transplantation (hereinafter: The Transplantation Act), keeps a register and provides a list of tissue and cell banks, which have received the permission from the Minister of Health to operate. 20However, this register includes only biobanks that operate in clinical aim, mainly transplantation purposes. There is no adequate record of biobanks cooperating with research entities. So far a population biobank on a national scale had not been created, although there is a tendency to form population-based biobanks at the regional scope. One of the first instututions of this kind is the biobank formed in 2012 in Wrocław under the project “BioMed – Biotechnologies and advanced medical technologies” by Wrocław Research Centre EIT+. There primarily blood samples from donors who are residents of Lower Silesia are gathered. Those samples are used to isolate DNA, RNA, plasma, serum or mononucleotic cells and then stored in order to create a basis for future studies of diseases among the inhabitants of this region (mainly autoimmune and cardiovascular diseases). 21 Wrocław's biobank cooperates with the Regional Blood Center to provide efficacious process of donors recruitment.22 Medical University of Gdańsk runs a biobank under which a worldwide unique collection had been created, that includes several thousand of blood samples from individuals at high risk of lung cancer. 23 Blood samples from oncological patients are also collected in a population-based biobank in Kielce by Świętokrzyskie Oncology Centre. As a target, it is planned to gather material from 500 thousand oncological patients, and then to store it for about 30-40 years, for ongoing monitoring of the disease. Specialized testing for detection of cancer at an early stadium will be carried out on the basis of collected samples.24 Aside from banks that collect human biological material from which nucleic acids can be isolated, biobanks that store the extracted DNA as a target emerge, especially European DNA Bank in Wrocław (hereinafter: EBDNA)25 or DNA Bank in Łódź.26 The above survey does not enumerate all types of research and scientific biobanks existing in Poland and is aimed solely to demonstrate what kind of institutions operate in the country. The biobanking units have a raison d'etre primarily through mutual cooperation, and therefore part of biobanks have associated into a consortium. The variety of types of biobanking institutions, and consequently the dispersion of legal regulation causes that some of them to work as units affiliated with health care facilities, medical universities and research institutions.27
4. Legal situation of biobanking institutions
The need for legal regulation of biobanks is a direct result of necessity to comply with the international standards, which is significantly important for cooperation with foreign institutions and for contributing to the creation of a European network of biobanks. One of such projects is Biobanking and Biomolecular Resources Research Infrastructure (hereinafter: BBMRI). 28Geneticists associated in the Polish Society of Human Genetics and represented in the Committee of Human Genetics and Molecular Pathology of Polish Academy of Sciences took the initiative to create a Group for Molecular Genetic Research and Biobanking which eventually was set up by Order of Minister of Science and Higher Education No. 52/2011 dated June 13, 2011.29 The assignment of the Group was to compile and submit proposals on selection of criteria of networking national laboratories of reference molecular genetic testing to the minister responsible for science, to harmonize molecular genetic testing with OECD guidelines of 2007 and to introduce regulations based on OECD guidelines of 2009 for quality assurance in molecular genetic testing, in the area of human material biobanking, creating genetic data database for scientific purposes, forming national genome biobank and the possibility to access BBMRI.30 However, the most crucial goal of the Group was to “develop recommendations to improve public confidence in the control of molecular genetic testing”.31 First meeting of the Group took place on the 30 of September, 2011, at the principal office of Higher Education Department32 and already in the report of 2012 a draft of framework to the act on genetic testing on health purposes was created (so-called The Genetic Act). 33 The draft received a positive opinion and forwarded to the then Minister Bartosz Arłukowicz in 2013, and next it was discussed by the next commission.34 On the 25th of June 2014, the Commissioner for Human Rights Irena Lipowicz in a written statement to the then incumbent Prime Minister Donald Tusk stressed the urgent need to regulate genetic testing, due to the protection of individual rights, stating that current regulations are insufficient and “only point change of legal regulations” is not enough. 35 Despite prevailing opinion and common awareness about the existing legal loophole and the recognition of the perilous state, the Polish Parliament has still not passed The Genetic Act. Nevertheless, the lack of The Genetic Act in Poland does not indicate that there are no institutions using human genetic data. The fact that there is no legal act dedicated to issues of data processing by biobanks for research purposes, as well as the lack of court rulings on this subject, rises a question if genetic data are currently protected in Poland and on what legal basis eventually.
The legal situation of biobanking entities is regulated by the Transplantation Act and de lege lata it remains the only regulation of the foregoing scope.36Art. 2 of the Transplantation Act defines the tissue and cell banks as “organizational units engaged in the collection, processing, sterilization, storage and distribution of tissues and cells. Units of this kind can also sample or test tissues and cells”. Art. 1 section 1 states that “The Act defines the rules of: collection, storage and transplantation of cells, including hematopoietic cells of bone marrow, peripherial blood and umbilical cord blood; tissues and organs derived from a living donor or a cadaver and testing, processing, storage and distribution of human cells and tissues”. However, according to art. 1 section 2 “provisions of the Act shall not apply to: collection, transplantation of germ cells, embryonic or fetal tissues and reproductive organs or parts thereof” as well as “collection, storage and distribution of blood for its transfusions, separating its components or processing into drugs”. As noted by J.Pawlikowski “If one takes into account only the above exclusion, it may seem that the provisions of the Act could be applied to biobanks that collect human biological material for research purposes”.37 Nonetheless, the purpose of creating tissue and cell banks defined by art. 25 is the “collection, processing, sterilization, storage and distribution of tissues and cells for transplantation”. This regulation indisputably determines, that the Act does not apply to entities, whose activities are related to tissues or cells intended for purposes other than transplantation. Therefore biobanks collecting biological material for the purposes of scientific research cannot be subjected to the legal regime of the Transplantation Act, due to the lack of transplantation purpose, even though they carry out the operations mentioned in the Act.38
Literature on this subject classifies research on genetic material from biobanks as a research experiment regulated by art. 21 et seq. Of The Act of 5 December 1996 on The Professions of Doctor and Dentist39(hereinafter: PDDA). Research experiment is a particular type of medical experiment conducted on humans and is primarily aimed at broadening medical knowledge, gaining knowledge about the processes and phenomena occurring in the human body based on empirical research. The benefit for an individual is only of indirect nature, that refers to a possible progress in medicine, improvements in the treatment process and physicians’ skills or competences. 40 The first premise of research experiment is to conduct research with participation of human beings as research subjects, and the second premise is to carry them out by doctors or dentists. Certainly studies conducted on genetic material samples, that are physically disconnected from a human body, do not exemplify human subject research. Therefore, the authors considering the subject, hypothesized that PDDA regulations do not apply “neither to the tests carried out on existing biological material stored in tissue banks or tests performed by other professionals, i.e. geneticists, biologists and biochemists”. 41 From the standpoint of scientific research institutions the provision of art. 28 PDDA is important. It allows the use (for scientific purposes) of information obtained as a result of medical experiment, without the consent of the person subjected to this experiment, if her anonymity will be guaranteed.
5. The legal status of genetic data
Determining how to protect genetic data requires consideration of various aspects of their collection and storage, determined by the specificity of genetic information, consisting of permanent and inseparable connection between genetic data and their carrier, which is a sample of biological material. 42The preservation of genetic data should be implemented at all stages of biobanking from sampling onwards. The foregoing discussion implies that in Polish law there is no act directly dedicated to issues related to human genetics, and the multitude of situations in which genetic material can be accessed or used causes that the dispersion of provisions of law protecting genetic data and related personality rights into many acts of law is observed.
For the purpose of further study, the legal character and legal status of genetic data should be ascertained. The first international ethical document created stricte in order to “ensure the respect of human dignity and protection of human rights and fundamental freedoms in the collection, processing, use and storage of human genetic data” is International Declaration of UNESCO on Human Genetic Data of 16 October 2003.43Art. 2(i) of the Declaration stipulates, that human genetic data are “information about heritable characteristics of individuals obtained by analysis of nucleic acids or by other scientific analysis”. From the above definition, it may be concluded, that according to the Declaration somatic mutations do not exemplify genetic data.44 As emphasized above, in Poland there is no so-called Genetic Act and - what's more – human genetic data are perceived to be personal data.
Polish Act on the Protection of Personal Data of August 27, 1997 (hereinafter: PDPA) in art. 27 section 1 states that “the processing of data concerning health, genetic code, addictions (…) shall be prohibited”. 45The doctrine argues that personal data are not characterized by their uniformity. In the foregoing provision the legislator has created the category of sensitive data (i.e. delicate data), which have a particular specificity and are contraposed to the ordinary data (i.e. common data). 46 The safeguards for sensitive personal data under the aforementioned act are stricter than those for ordinary personal data and that regime of enhanced protection determines their extraordinary character. Sensitive data are generally banned from the processing, except exceptional cases, enumerated in art. 27 section 2, when the prohibition may be evaded. Premises for sensitive personal data processing, appointed by art. 27 section 2 are distinguished from the general material conditions allowing personal data processing specified by art. 23 section 1 and could be regarded as lex specialis in relation to them.47 There has been an inconclusive debate in the doctrine about whether the distinguishing between two categories of personal data is necessary. Furthermore, the requirement to process personal sensitive data lawfully and under extraordinary conditions, states a transparent principle, reasonable due to the fact that sensitive data directly affect the privacy sphere and even the intimacy of a person and can lead to higher risks for the rights of the individual in many ways, at the least by his discrimination, unlike other types of data.48
The legislator has used the phrase “genetic code” not quite aptly. The genetic code is universal for all human species and degenerate, which means that in every human being protein biosynthesis under the direction of nucleic acids is carried out according to the same rules – each three-nucleotide codon in a nucleic acid sequence specifies a single amino acid, respectively assigned to it in accordance to genetic code rules.49Literal interpretation of the aforementioned provision could lead to absurd, because it would mean that the legislature conferred protection for the biological method of reading the genetic information (no legal definition of the genetic code induces applying the definition adopted in the science of genetics). Neither the explanatory note on the parliamentary draft of the Act, or the explanatory memorandum accompanying the government bill was able to demonstrate the appropriateness of the proposed wording and therefore, it falls to be considered as legislative omission and to request the changes in the terminology of art. 27. The regulation as it stands does not protect genetic data in any way, and contrariwise creates significant limitations to the use of commonly acknowledged code.50 In accordance with effective rules of legal texts exegesis “if the norm interpreted pursuant to linguistic rules for the interpretation of legal texts clearly does not correspond to accepted legal system and values, and there is a glaring inconsistency between the assumption of rationality of the legislator, it can be assumed that the legislator have not expressed and achieved what he had wanted”.51 The literal interpretation of the standards need to be dispensed with, and as per teological interpretation it must be considered that specific legislation grants protection of genetic data indeed.
Placing the data concerning genetic code in the catalogue of sensitive data lies at the heart of the discussion on consequences that it brings about. Thus, firstly, The Inspector General for Personal Data Protection (hereinafter: GIODO) argues that such legislation goes beyond the standards required by Directive 95/46/WE52and is a source of opposition of European Union representatives. 53
Secondly, separation of genetic data from health data has a pivotal implications for the legal system, because as noted by A.Krajewska, through this legislative procedure “legislator determined, that the rules of medical data protection contained in other laws will not apply to them, what can lead to actual restrictions of genetic data protection, instead of increasing it”.54On the contrary, D.Krekora-Zając maintains that the unfortunate placement and use of the term may not cause such dangerous and risky consequences and it is intended only to highlight the exceptional nature of these data.55 The literature shows no consensus, and there exists also the opposite view, that medical data can, within a certain range, include genetic data. On the basis of evidence currently available, it seems fair to suggest that preceding opinion is the most accurate. On the grounds that there is no statutory definition of medical data, the Recommendation R97(5) of the Committee of Ministers of the Council of Europe on the Protection of Medical Data is helpful in the interpretation of the concept. According to the Recommendation the “medical data” expression “refers to all personal data concerning the health of an individual. It refers also to data which have a clear and close link with health as well as to genetic data”. 56 Moreover, the concept of “genetic data includes data related to past, future and present health condition of the data subject”. 57 The Act of 28 April 2011, on the Information System in Health Care in the scope of definition of “individual medical data” contains personal data concerning health.58 In this manner, it became unambiguously settled that the term “medical data” is broader than the conception of data relating to health.59 Undoubtedly, genetic data are contained in this conceptual scope, but only those that relate to health. Beside it there are genetic data with regard to other human features than health, for example appearance – eye color. Another argument confirming the preceding theses is the differentiation of data on addictions in art. 27 section 1 PDPA. These data can be classified sometimes as health data, especially when they concern any disease process.60 Placement of “genetic data” in Art. 27 PDPA denotes that such data constitute personal data in the meaning of the Art. 6. “Within the meaning of the Act personal data shall mean any information relating to an identified or identifiable natural person”, which “is the one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity”. While there is no doubt that genetic information meets the above conditions, the doubts may arise as to determining whether the genetic information certainly always allows to uniquely identify an individual and in which situations. Read and analyzed genetic data, associated with other data identifying the person, of course accomplish the requirements to acknowledge them as personal data. A sample of human biological material, even not correlated with personally identifiable information, contains a unique and individual genetic profile, which itself makes it possible to identify a person or her relatives. Article 6 section 3 PDPA poses a problem, because according to it „a piece of information shall not be regarded as identifying where the identification requires an unreasonable amount of time, cost and manpower.” DNA-based human identification and genes or even genome sequencing are apparently multistep procedures, which often require work of team of experts and only they are able to correctly understand the meaning of received data and to draw conclusions from the results. The question thus arises whether the yet not analyzed DNA sample should be also assured legal protection as that afforded to personal data. The specificity, complexity of the genetic code and the number of genes in the human genome guarantees that the information contained in it cannot be easily read by an average person. Understandably, the research should be provided with sufficient knowledge and resources, as reagents, apparatuses and devices, which means precisely „an unreasonable amount of time, cost and manpower”. However, it seems that today, in the era of commercialization and widely available genetic tests, this problem has lost its topicality and is obsolete nowadays. With attention to preceding argument and the fact that „the genetic material is through the information permanently related to the person form whom it comes”, the inclusion of genetic material in the scope of PDPA is well-founded. There is also a dissimilar opinion, according to which recognition of the human samples of biological material as personal data is not justified. In conformity with the position of A. Krajewska, because of the complexities of the process of genetic information analysis, "it is difficult to imagine how the mere possession of [biological] material may have an impact on the field of the right to privacy, or informational autonomy. The right to informational self-determination is activated only upon reading the genetic information; for the purposes of The Act personal data may be considered as a sequence of letters, that are already drawn up in the wake of the analysis".61
6. Protection of the genetic data under the applicable national law
The right to protection of genetic data was directly granted by Art. 1 PDPA, which states that „any person has a right to have his/her personal data protected". Within this definition both types of data are contained: obtained for biobanking purposes and gained somehow on any other occasion. Recognition of genetic data as personal data means, that thereby they indisputably belong to the category of personal interests protected not only under of PDPA, but also on the basis of civil law.62A peculiar intangible value is protected, and the right to protection of genetic data should be regarded as non-pecuniary right, closely related to the person. From this right, the legislator derives and confers the ability to permit or object to the processing of data, as well as further claims, that stave off the danger of fraud when collecting and processing such type of data.63 The Act determines the rules of conduct for the processing of genetic data and the rights of individuals whose data may be processed in biobanks as collections of these data.64 It regulates at the same time the processing of genetic data not related to health and genetic data within the meaning of the medical data.65
As stated above, the genetic data as sensitive data are covered by a general prohibition of their processing, which, however may be lifted once the relevant conditions set out in the Act are met. Pursuant to the act, the processing of data „shall mean any operation which is performed upon personal data, such as collection, recording, storage, organization, alteration, disclosure and erasure, and in particular those performed in the computer systems”, thus it can be concluded, that genetic data has been granted a broad scope of protection at every stage of biobanking, starting with the creation of the database, comprehending all activities that occur during their storage, including their development, as far as sharing with other scientific institutions. Biobank, as a private entity is the data controller in the meaning of the Act, that is an organizational unit, who decides on the purposes and means of the processing of personal data. Under Art. 3, it should be noted, that the provisions of the Act concern biobanks operating as public and private entities alike, if they are involved in the processing of personal data as a part of their business or professional activity or the implementation of statutory objectives.
Processing of the data that reveal genetic code „shall not constitute a breach of the Act where the data subject has given his/her written consent, unless the processing consists in erasure of personal data”. Firstly, the requirement to obtain the consent appears already on the stage of obtaining samples and data. The character of the consent depends on the method of collecting a biological sample, because sampling of genetic material does not always take place in the form of a medical procedure. Not always taking samples of material will be carried out by a person belonging to the medical staff, because it may take a different form, e.g. taking a saliva sample by any person. According to that, the consent may take the form of consent to infringe bodily inviolability or consent to infringe personal rights.66As argued earlier, in relation to collecting of genetic material provisions of civil law must apply, while in relation to genetic information – the provisions on the protection of personal data.67 The consent must be given in writing to be effective. In accordance with Art. 78§1 of the Civil Code to maintain written form it is enough to submit a personal signature on the document, so it is sufficient to put a signature on the printed form and it is not necessary to draw up the entirely statement personally.68 In addition, Art. 7 section 5 PDPA states that the data subject's consent is a declaration of will and it cannot be alleged or presumed on the basis of the declaration of will of other content and that the consent may be revoked at any moment. Stating that consent to processing of genetic data is a declaration of will paves the way for the application of the provisions of the Civil Code, primarily regarding the interpretation of the declaration of will, defects of the declaration of will and the time of making a statement , as well as its revoking, insofar as it is not regulated by the Act on Personal Data Protection.69 Although the PDPA does not introduce the concept of "informed consent", but the OECD guidelines of 2009 state that the sampling stage should be preceded by obtaining the prior, free and informed consent from the donor, based on a exhaustive and clear information on the purposes and principles of biobanking".70 The informed consent process in human biobanks and genetic research databases (HBGRDs) for the scientific purposes is a widely discussed ethical issue. The problem is contingened upon the specificity of functioning of biobanks that store genetic information for future sharing with scientists and that subsequent use of human genetic data makes it impossible to obtain adequate consent as in the event of a medical experiment or medical procedure. The features of these biobanks and research on biological materials, as well as data provided by them constitute their distinction from other types of research. This is primarily a small risk to the health of donors and practically no direct impact on it. Often when obtaining genetic material, the donor knows the purpose of these studies (e.g. the study of a particular gene), but it happens that the target is not clearly defined, and the material will be a part of genetic database of population, made available to researchers who report willingness to conduct research with their use. In addition, the methodology of research work determines "multi-stage, multilateral, repeated use of the same samples." On the basis of the above, the question arises whether it is possible to obtain informed consent for research, which will be conducted at an unspecified time in the future and simultaneously their purpose, place, the researchers or methods are not known.71 In the OECD's guidelines of 2009 the concept of entirely conscious, so-called informed consent was adopted. The biobanking institution should provide potential participants with sufficient information on: the purpose and basis for the creation of a biobank, specified policies and procedures for the protection of samples and data, the duration of storage, the exceptional conditions under which researchers may be provided with access to human biological materials or data or whether and under what circumstances the operators may be obliged legally to provide their human biological materials and data to third parties for non-research purposes, policy of re-contacting with the donor and many other.72 Some authors have suggested the concept of a blanket consent "for research that can be taken in future, under condition to clearly inform donors about the situation which arose, so that he can agree with full awareness to the extent of use of samples”. The most liberal data protection is predicted by concept of expanded consent, including permission to use the samples in the future without restrictions. The approval of the informed consent of the donor concept guarantees the right to decide each time about using one's own genetic data and certainly provides their complete protection, however, it can be a substantial hindrance for researchers who must contact with the donor frequently and obtain renewed consent to the use data. 73 On the basis of PDPA an expanded concept of consent should be undoubtedly rejected, since art. 32 PDPA determines that "the data subject has a right to control the processing of his personal data contained in the filing systems", and this kind of acceptance obstructs control over data. Moreover, the subject is granted with the right to obtain extensive information on whether such system exists and to establish the controller’s identity, obtain information as to the purpose, scope, and the means of processing of the data contained in the system and since when his personal data are being processed. Art. 23 section 2 PDPA stipulates, that consent may also be applied to future data processing, on the condition that the purpose of the processing remains unchanged. An analogous provision does not exist for sensitive data.74 As a consequence “consent must be clear, unambiguous and refer to the specific actions of the controller; may not be very general, abstract, but all aspects must be clear for signing at the moment of expression".75 As a rule, the authorization is granted to the controller, but there are no obstacles for the controller to authorize another subject to carry out the processing of personal data pursuant to a contract concluded in writing76 , in other words consent may be transferred, e.g. in the case of the sale of the company.77 Thus, the administrator of genetic data could become another biobanking institution than the one for which the donor has consented, although in such circumstances he should be informed about the situation and at any time has the right to cancel the consent. 78
Private biobanks encourage to bank the DNA of the deceased, emphasizing that this decision should be taken before burial, because then the chance to perform DNA analysis of the deceased person is lost (as The European Bank for DNA).79There are doubts as to the legality and ethicality of such dealings, especially if the person had not agreed to that, or expressed objection when alive. The Transplantation Act in art. 4 allows procurement of cells, tissues and organs from cadavers for scientific purposes. The protection of these data, within the framework of the protection of personal interests will take place only on the basis of infringement of living family members personal rights, because "in this case we will not have to cope with violation of personal rights of a deceased person, as the rights on personal interests" die "with the person entitled".80 M. Nestorowicz claims that to collect tissues from a deceased person for purposes other than transplantation, previous expressed consent of the person, communicated while living is necessary.81 The current legal situation in this regard not exactly corresponds with the recommendations of the Commission, which proceed from the assumption that the use of samples of genetic material may be legal if the law of one or more relatives will be overcome, even if the deceased did not agree while living. Moreover, Member States should promote and allow the use of samples of the deceased for the purpose of research, education, especially for the development of genetic tests, after prior anonymous coding of samples.82
To remove the genetic data the consent of the concerned person is not required. According to the PDPA, data erasure shall be understood broadly, because it comprises not only of the destruction of personal data, but also of "such modification which would prevent determining the identity of the data subject". However, usually the administrator does not have full freedom in this extent and the rule laid down in the Act may be modified by the content of the legal relationship existing between the controller and the donor of genetic material, which permits the processing of data. 83Processing of personal data is not prohibited or restricted if the data is anonymous.84 Many biobanking institutions decides about encoding or anonymization of samples and data, although this is not a uniform practice. Such behaviour provides confidentiality, data privacy and guarantees respect for the rights of donors. Encryption is performed so that "processed, stored and rendered available to researchers samples were devoid of personally identifiable information of the donor, and in the case of encoding the process of sample depersonalization is easy to reverse, and at anonymization it is assumed to be irreversible"85 , because samples are “fully anonymous from the start and all identifying links to the donor are destroyed”86 . Samples may be double-coded, what means that “anonymous project identification numbers are assigned to participants and associated specimens. The code linking the anonymous number to personally identifying information is placed in a secure location and is accessible by only a few authorized individuals”.87 The study conducted by J.Pawlikowski, based on empirical research among Polish biobanks representatives, reported that single-coding system is the most frequent, while EU standards recommend at least double-coding of samples, e.g. in Spain samples are subjected to triple coding88 (at the time of sampling, in the computer system, and then at the time of order realization for concrete scientists or institutions)89 . Not many biobanking entities in Poland fulfills this requirement, however it should be noted that the research was also focused on biobanks for clinical purposes, and these usually provide a lower level of data protection.90 It should be emphasized that the total depersonalization of data precludes re-contacting with the donor, e.g. in order to inform him about the disease, further clinical observation, repeated medical checkup or change of the stored data, and what is worse there remains any chance to recover a sample or withdraw it from the database, even at the request of the donor.91
Biobanking entity, which administers a collection of genetic data can legally make them available to the scientific and research institutions. That permission follows directly from art. 27 section 2 point 9 of the PDPA, according to which processing of data about genetic code is acceptable if it is necessary to conduct scientific researches. Any results of scientific researches may not be published in a way which allows identifying data subjects. In practice, this means that only a member of the research team may have knowledge to identify individuals whose data were used for research. At the same time, this regulation calls into question the legality of some of the research, as a prerequisite to such authorization is the "indispensability" of genetic data to conduct research, which means only that without these data no such research would be feasible at all.92The problem arises when the work on a given issue could be carried out on alternative research facilities.
Social concerns about the biobanking largely relate to sharing of genetic data with insurance companies and employers. The issue of the use of genetic data in the insurance business is regulated directly in The Act on Insurance Activity of 22 May 2003. 93In accordance with art. 21 section 1 of the Act insurance company may not demand that the insured or a person on behalf of whom an insurance contract is to be concluded undergoes genetic examinations in order to assess the insurance risk and determine the right to a benefit and the amount of that benefit. What is more important from the point of view of the subject matter, in art. 22 section 1 the Act prohibits the insurers from being transferred results of genetic test, carried out previously for other purposes, like health care services provided by medical entities to the insured or the person on behalf of whom an insurance contract is to be concluded. Thus, the above provisions clearly show clearly that the persons insured or entering into an insurance contract are fully protected from discrimination based on genetic characteristics.94
The issue of processing of personal data by employers in recent times was deliberated by the Council of Europe. On 1 April 2015, Recommendation CM/Rec(2015)5 of the Committee of Ministers to member States on the processing of personal data in the context of employment was adopted.95It sets out guidelines that should be implemented to the legal systems of all member states. According to Recommendation „genetic data cannot be processed, for instance, to determine the professional suitability of an employee or a job applicant, even with the consent of the data subject”. However, „the processing of genetic data may only be permitted in exceptional circumstances, for example to avoid any serious prejudice to the health of the data subject or third parties, and only if it is provided for by domestic law and subject to appropriate safeguards”. However, even if national law allows the processing of genetic data by the employer, they can be obtained only from an employee, therefore it is inadmissible to acquire data from third parties.96 At the moment, these rules have not yet been implemented into the Polish legal system, only hope remains that it will be made in due course. The issue of processing of genetic data by the employer is not regulated directly by The Labour Code (hereinafter: LC). 97 The provision of Art. 221 of the LC contains a catalogue of personal data, which may be required by the employer from the person applying for a job. This catalogue is closed and it includes basic personal information, such as, inter alia name or education. However, art. 221 § 2 point 1 of the LC causes partial opening of the catalogue, since the employer is entitled to require form the employee to provide other personal information, if this is necessary due to the use of the special powers provided for in the labor law by an employee. In the unregulated scope, provisions on the protection of personal data apply. According to art. 27 section 2 point 6 PDPA processing of data about genetic code is permissible, if it is necessary for the purposes of carrying out the obligations of the controller with regard to employment of his/her employees and other persons, and the scope of processing is provided by law. From the point of view of this study, it is essential to establish whether the existing law allows biobanks to transfer genetic data of a person who applies for employment or is an employee to the employer, and beyond the scope of considerations should remain the capacity to use genetic data by the employer for hiring, because it is the subject of a different discussion. Both, from the Recommendations of the Council of Europe, as well as from the Labour Code, it follows that the possible use of genetic data by the employer, if acceptable at all, would be permissible only if they have been obtained directly from the person concerned thereby. This means that it is not legal to obtain such data from a third party, that is biobanking or research institution.
The provision of Article. 27 section 2 point. 5 PDPA, which allows the processing of sensitive data, if it is necessary to pursue a legal claim, raises large doubts. Therefore, the reliance on the prohibition of sensitive personal data processing cannot be an obstacle to a correct decision made by the court. Data processing is allowed to both a judicial authority and the applicant party to the proceedings and his lawyer. 98A situation in which a personal genetic data can be used against the party in court proceedings is easily imaginable.
7. Civil protection measures
It has repeatedly been emphasized that genetic data as a category of personal rights, are entitled to every possible means of protection measures under civil law, because according to art. 23 of the Civil Code "the personal interests of a human being (...) are protected by civil law, independently of protection under other regulations". Acceptable framework for the use of genetic data, is defined by the applicable law and the consent given by the donor of genetic material that are both exonerating circumstances, repealing the illegality of infringement.99For entities performing the possessed genetic data, in art. 26 section 1 PDPA an obligation is imposed for "special diligence in order to protect the interests of the data subject". First of all interests relating to the respect of privacy, intimacy, and even the right to shape their own image towards other people and institutions, and secondly both tangible and intangible interests of should be taken into account. The doctrine raises, that this special diligence is higher than normal or average, and even than the due diligence of art. 355 of the Civil Code. 100 Civil law claims arise when the rights and freedoms of the donor will be violated by the unlawful use of data, contrary to the interests of the donor, e.g. their publicity and access of unauthorized persons or unlawful use. Civil law provisions apply without prejudice to rights provided for in other laws, therefore they do not exclude the cumulative application of the provisions of criminal regulations under PDPA, 101 which primarily provide sanctions for providing the genetic data to unauthorized persons, even unintentionally – due to improper security.
The Civil Code establishes three types of protection of personal interests afforded to the aggrieved party, and also the corresponding three kinds of legal responsibility of the infringer. Following remedies are envisaged: pecuniary (art. 24§2 of the Civil Code), non-pecuniary (art. 24§1 of the Civil Code) and mixed (art. 24§1 read in conjunction with art. 448 of the Civil Code). Means of non-pecuniary protection, based on the fact that the person whose personal interests are threatened by unlawful action, may request the omission, and if a personal right has been violated, he may demand that the person who committed the infringement, perform all the actions necessary to remove its effects, in particular that the person make a declaration of the appropriate form and substance. This responsibility is not based on the principle of guilt, so just the mere fact of infringement or threat of infringement of personal interest need to be established . It should be remembered that the agreement of the authorized person, as a principle, excludes the unlawfulness of infringement of personal interest102, therefore, the activities of biobanking entities made in scope of the consent given by the donor for collection, storage and sharing of genetic data, are not illegal as long as the agreement is not contrary to law or the rules of social coexistence.103 For example, a donor may demand the cessation of its genetic data transmission to undesirable persons, using them for research, which is not covered by the consent, or administering them by research institutions that came into their possession in an unauthorized manner. The court may order biobanking institution to cease violations, including by removing organizational irregularities in biobank, and may also prescribe to remove the effects of the infringement, in particular by submitting statements to the media, correction or apology. 104
If, as a result of infringement of a personal interest financial damage is caused, the aggrieved party may demand that the damage be remedied in accordance with general principles. 105Liability for damages of biobank in this case will be based on the principle of guilt of art. 415 of the Civil Code and it is the full responsibility, which basically means, that remedy of damage covers the losses which the aggrieved party had suffered (responsibility for actually suffered pecuniary damage – damnum emergens), and the benefits which it could have obtained had it not suffered the damage (lost profits – lucrum cessans). Such a situation takes place, for example, if revealed genetic data will cause the loss of employment or job prospects by the person concerned. Biobanking institutions are responsible for negligence and failure to maintain diligence required on the activities of biobank, for example, if the biobank improperly secured data, due to making them anonymous incorrectly, or throwing files containing data of donors in the trash without their prior destruction, in the hope that no one will read those. 106
Mixed type protection consists in the fact that the court may award the person whose interests have been infringed with an appropriate amount as monetary recompense for the harm suffered or may, at his demand, award an appropriate amount of money to be paid for a social cause chosen by him, irrespective of other means necessary to remove the effects of the infringement. Compensation specified herein can constitute a form of financial ailment to biobanking institutions for committed infringement, but its purpose is not to punish the institution, but to compensate for damage suffered by the donor or his family, in other words for the negative psychic experiences and sufferings, which may be caused by social discrimination and the destruction of family relationships due to the revealed genetic data.107
In light of the above discussion the activity of institutions that bank genetic material for scientific purposes must be assessed as insufficiently regulated by the Polish law. Polish legal situation concerning this specialized sector does not correspond with the requirements set out by international law in substantial extent .
In Poland there is no act of law, that would comprehensively regulate the operations of biobanks for scientific research. They cannot be embraced by The Transplantation Act because they do not function for transplantation purpose, nor the The Act on Professions of Doctor and Dentist, as their activities do not fulfill the conditions of the research experiment within the meaning of the Act, and the Pharmaceutical Law, 108because it does not constitute a clinical trial. In fact, the legislature deals only with a topic of research involving humans, and studies on human biological material are not regulated in general. Experiment with the use of human genetic material is a type of observational study, so-called non-interventional, defined as the study of biological material previously gathered or other medical data. A special feature of this research is the lack of interference of researcher in the analyzed variables, and in fact there is no risk of incurring bodily injury or health disorder on the part of the donor.109 The only risk exists towards the violation of the rights of the donor to its genetic information. Thus the storage of human genetic material and sharing with research establishments is an issue of key importance for the safety of donors of genetic data, because there are no regulations specifying organizational requirements, including manner of handling genetic material in these biobanks. Especially that research on human biological material is mostly not run by doctors, but scientists of different specializations, there is no requirement of evaluation by independent ethics committees, although the law of course does not prohibit asking the committee to issue an opinion on the project as an observational study.110
Current rules relating to the genetic data are fragmentary and scattered throughout the whole legal system.111These issues are primarily regulated by the PDPA, granting them the status of sensitive data. It seems that biobanks collecting genetic data, as administrators of these data, should operate in accordance with the principles expressed in the PDPA. Biobanking institutions currently operate primarily on the basis of their internal statutes and regulations not to mention the provisions rationing rules for the conduct of laboratories. Anonymous empirical research conducted by a team of J.Pawlikowski show the heterogeneity of their practices.112 In the absence of appropriate regulations, it is postulated to organize the activities of biobanking institutions based on the guidelines of European law, which can provide significant help for those responsible for the creation and management on biobanks, for instance Recommendations of the European Commission on the ethical, legal and social implications of genetic testing, or the OECD Guidelines in the field of human material biobanking and creating databases for the purposes of genetic research. Biobanks should operate in respect of personal interests of donors. Any unlawful violation can become the basis for civil liability. In this respect, banks' organizational irregularities can be sanctioned if they represent a threat to the personal interests. Irregularities in the organization are understood in particular as invalid data security, sharing them with third parties, failure to observe the proper organization of work or no appropriate professional training among employees.113
There has not been established any official institution, which would gather information about biobanks research, or would oversee biobanks and coordinate functions in relation to them. The National Center for Tissue and Cell Banking does not deal with their activities, because it was established under The Transplantation Act, and its role is limited to the supervision of clinical biobanks. In turn, the National Blood Center, supervises and coordinates the blood banks and blood donation stations. 114The supervision of genetic data processing in biobanks under the current legal status is exercised by Inspector General for Personal Data Protection who , in particular, controls the compliance of data processing with the provisions of the PDPA and can also issue administrative decisions and deal with complaints in matters of implementing the provisions of the Act (art. 12 PDPA) .
The results of anonymous surveys conducted among respondents, who were the representatives, directors or managers of biobanks, suggest that "in many institutions involved in the storage of biological material some standards for informed consent and data protection are not met”. For example, only 54% of respondents said that their organization allows earlier individual conversation with a person competent about storing biological material and associated data, and what is worse, „a large percentage of surveyed entities (29%) did not seek to obtain consent for research which can be carried out on the collected material in the future ".115Differences also appear in the issues of privacy of donors, because “of the researched institutions, 13% encode the samples twice, 64% encode sample once and in five cases (23%) it was admitted that the samples were not coded at all”. 116
Genetic data are adequately protected by the Polish Law before making them available to insurance companies, by prohibiting requests by the insurance for genetic testing of the insured or a person contracting insurance and a prohibition of insurers to share the results of genetic tests carried out previously for other purposes. Unfortunately, the labour law regulations do not introduce such a prohibition outright and the protection of genetic data does not appear as clearly as in insurance law. Therefore, it should be hoped that the legislature will adjust Polish law to a recent Council of Europe recommendations relating to employee data processed for the purposes of employment soon. In conclusion, it is necessary to launch a major debate on the future regulation of the situation of biobanking entities for scientific purposes and of the so-called Genetic Act. In Poland, it is impossible to find any judicial decisions or doctrine’s considerations on this issue, which is why the Team for Molecular Genetic Research and Biobanking, with the task to develop the above issues, should firstly take inspiration from the OECD guidelines, and also it seems helpful and reasonable to analyze complex regulation of this field in other European countries, e.g. the United Kingdom, Estonia or Spain.117It is also necessary to conduct an ongoing dialogue with the subjects involved in biobanking and the society, combined with the carrying out of educational campaigns, because knowledge of public about biobanking research is still small, and to increase public confidence in these institutions and trust in biobanking, it is necessary to visualize real benefits and risks of biobanking of genetic material, and the specific nature and limitations of scientific research itself and even dissemination of the idea of scientific knowledge as global public goods (belonging to humanity). The trust and support of the public is a key element in the potential success of any biobank.118 Future regulations should attempt to determine the balance between sufficient scope of genetic data protection and the admissibility of conducting research so as to too restrictive regulations did not cease the progress of science.119 The findings support the prediction that the problematic area of functioning of biobanks is a concern for themselves. “Biobanking in itself has difficulties fitting into current legal regimes of autonomy and privacy”120 and even in countries, in which it is properly regulated, it faces several failures to protect privacy and other personal rights, as it remains a matter broadly discussed due to its bio-ethical disputes.