Genetic testing of biological materials reveals unique information about the physiology and health of a natural person. DNA determines to a large degree what a person will be like. The GDPR says that consent must be obtained from people who will be subjected to genetic research and/or genetic testing for health reasons.
In addition, obtaining informed (i.e., “medical”) consent for intervention (including research) in the health field is mandatory. The question is whether people must give both kinds of consent for additional processing of biological materials – i.e., further research for the purpose of promoting medical science, potentially leading to the improvement of mankind’s wellbeing.
Under the GDPR, the right to the protection of personal data is not absolute; it must be considered in relation to its function in society and be balanced against other fundamental rights. In this context, the GDPR allows genetic researchers to process personal data obtained for the purpose of genetic testing (for health or commercial purposes) or for specific genetic research for scientific purposes.
Further processing of personal data for scientific research is compatible with previous purposes. As purpose limitation and lawfulness are two separate and cumulative requirements, Article 5 of the GDPR and the Serbian Data Protection Act require genetics institutions to refer to either legal authorization or tasks carried out in the public interest. Genetic institutions seeking to process health and genetic personal data can refer to the substantial public interest in ensuring high standards of quality and safety of health care or necessity to process personal data for scientific purposes (under Article 9 (2) (i) and (j) of the GDPR and Article 17 (2) (9 and 10) of the Serbian Data Protection Act).
In such cases, under the minimization principle, genetic institutions must apply additional safeguards to protect personal data (for example by pseudonymizing or anonymizing personal data), and must obtain consent to do so. Under Articles 17 (2) (b) and 3 (d) and Article 30 (2) (2) and (5) (4) of the Serbian Data Protection Act, the right of those whose personal data is being used to withdraw this consent may be limited.
In addition, the Oviedo Convention says that for each additional form of genetic research or analysis of biological material, people must give “medical” consent.
The most important element of genetic research is the ethical component, meaning that participants in genetic studies must give “medical” consent and the research must be overseen by independent ethical committees. In addition, the Oviedo Convention allows people who granted “medical” consent for genetic testing/research purposes to withdraw it at any time. Therefore, the question is whether further analysis of biological samples without informed (i.e. “medical” consent”) is possible.
The only way to avoid having to obtain “medical” consent is to make biological material unlinked and anonymized, meaning that the material, either alone or in combination with associated data, does not allow, with reasonable effort, the identification of the persons concerned. In most cases unlinked anonymization is not sufficient for research in biobanks, which contain biological material and associated personal data that may include or be linked to genealogical, medical, and lifestyle data and which may be regularly updated.
The conclusion is that researchers must obtain “medical” consent for each new genetic research project involving previously obtained biological samples, unless the samples can be anonymized.
By Ivan Milosevic, Partner, JPM Jankovic Popovic Mitic