5.1. Basic Principle: Biological Material Should Be Destroyed After Use
If, in a specific health science research project, personally identifiable biological material is extracted or stored for a certain period before or after analysis of the material, it constitutes the establishment of a research biobank.
Conversely, if blood samples are taken for immediate analysis and then destroyed afterward, there is typically not considered to be actual storage, and thus it does not constitute the establishment of a research biobank.
Whether a research biobank is established is a concrete assessment. If storage extends beyond a few days (5-7 days) for later analysis, it will usually be considered a research biobank according to practice.
A research biobank is linked to the specific project and ends at the latest upon the completion of the project (i.e., as soon as all analyses related to the specific research project are completed).
Biological material solely extracted for future research outside the research project does not constitute a research biobank in the sense of the committee law. See section 5.3 on the extraction of extra material for future research.
5.1.1 Consent Requirements for Storage in the Project
If biological material is extracted from the test subject in a research project for storage in a research biobank, the researcher – in addition to consent to participate in the research project – must request the test subject's consent for the biological material to be extracted for storage in a research biobank (committee law § 6).
Such consent cannot include consent for any later use of the biological material in another research project (consent for future research). Such broad consent is not legally valid under the Committee Law, as the consent is not related to and based on information about a specific research project. See more in section 5.3.
5.1.2 Surplus Material Desired for Future Research
The committee can approve the storage and use of biological material in connection with a specific research project.
If a researcher wishes to save any surplus biological material from the experiment for future research after the project's completion, it must be stated in the participant information for the research project that the donated biological material is stored after the project's completion for possible future research. The committee should also be informed about this in the protocol.
In addition, permission from The Danish Data Protection Agency is required to establish a biobank (Personal Data Act § 50, para. 1) or permission under § 10, para. 3, if it involves transferring to a new data controller.
The following can be stated in the participant information:
"According to the Personal Data Act, surplus biological material from the project should be destroyed at the end of the project. However, we will seek permission from The Danish Data Protection Agency to establish a new biobank with the surplus material for future research. Any new research project will be reported to the scientific ethics committee. With permission for new research, a new consent from you/the test subject for the research should generally be obtained. However, the committee can allow new research without obtaining consent if there is no risk or burden to the test subject in the new research."
5.2. Research Biobank – If Personally Identifiable Material is Stored in the Project
If, in a specific health science research project, personally identifiable biological material is extracted or stored for a certain period before or after analysis of the material, it constitutes the establishment of a research biobank.
Conversely, if blood samples are taken for immediate analysis and then destroyed afterward, there is typically not considered to be actual storage, and thus it does not constitute the establishment of a research biobank.
Whether a research biobank is established is a concrete assessment. If storage extends beyond a few days (5-7 days) for later analysis, it will usually be considered a research biobank according to practice.
A research biobank is linked to the specific project and ends at the latest upon the completion of the project (i.e., as soon as all analyses related to the specific research project are completed).
Biological material solely extracted for future research outside the research project does not constitute a research biobank in the sense of the committee law. See section 5.3 on the extraction of extra material for future research.
5.2.1 Consent Requirements for Storage in the Project
If biological material is extracted from the test subject in a research project for storage in a research biobank, the researcher – in addition to consent to participate in the research project – must request the test subject's consent for the biological material to be extracted for storage in a research biobank (committee law § 6).
Such consent cannot include consent for any later use of the biological material in another research project (consent for future research). Such broad consent is not legally valid under the Committee Law, as the consent is not related to and based on information about a specific research project. See more in section 5.3.
5.2.2 Surplus Material Desired for Future Research
The committee can approve the storage and use of biological material in connection with a specific research project.
If a researcher wishes to save any surplus biological material from the experiment for future research after the project's completion, it must be stated in the participant information for the research project that the donated biological material is stored after the project's completion for possible future research. The committee should also be informed about this in the protocol.
In addition, permission from The Danish Data Protection Agency is required to establish a biobank (Personal Data Act § 50, para. 1) or permission under § 10, para. 3, if it involves transferring to a new data controller.
The following can be stated in the participant information:
"According to the Personal Data Act, surplus biological material from the project should be destroyed at the end of the project. However, we will seek permission from The Danish Data Protection Agency to establish a new biobank with the surplus material for future research. Any new research project will be reported to the scientific ethics committee. With permission for new research, a new consent from you/the test subject for the research should generally be obtained. However, the committee can allow new research without obtaining consent if there is no risk or burden to the test subject in the new research."
5.3. Extraction of Extra Material for Future Research
In some cases, a researcher may wish to extract extra biological material in connection with the specific research project, not to be used in the specific experiment, but only to be stored for future research.
Extraction and storage of biological material for use in future research are not considered within the committee system's competence, and consent declarations and information about the extraction and storage cannot be assessed or approved by the committee system according to current practice.
This is based on the fact that the committee system, under current legal status, only has the competence to approve concrete research projects.
The Personal Data Act, however, applies to the treatment of the extra material. Biobanks with a future research purpose must be reported to The Danish Data Protection Agency, and there are, among other things, requirements for sharing from a research biobank to other research projects, see The Danish Data Protection Agency's website. See also section 4.
It can be stated in the protocol that biological material is collected in connection with the experiment for a biobank for future unspecified research, but any separate information and consent material cannot be approved by the committee system. However, storage of biological material in a biobank for future research must always be reported to The Danish Data Protection Agency. See also section 6.3.1 on the subsequent possibility of researching this material (with exemption from the consent requirement).
5.4. Requirements When Sending Biological Material Abroad
5.4.1 General Requirements
In projects that involve the export of biological material and personal data, it is a condition that the project is conducted in accordance with the Personal Data Act (cf. committee law § 20, para. 1, no. 4 and no. 6).
Danish Personal Data Act applies if the data controller is established in Denmark. In some cases, data controllers established in third countries must appoint a representative established in Denmark – in these cases, the Personal Data Act also applies (Personal Data Act § 4, para. 4). See The Danish Data Protection Agency's guide on the geographical scope of the Personal Data Act
The committees will normally assume that it is the Danish trial responsible (in regional research – the region) or sponsor, who is the data controller (the one who decides the purpose and the means of processing the data), and that the data controller is established in Denmark. In these cases, the Personal Data Act will apply.
It is the trial responsible (in regional research – the region as data controllers) and/or sponsor who is responsible for ensuring that the information in the project material about the legal position regarding the protection of personal data is correct. If there is doubt about whether the Personal Data Act should be followed in the experiment, The Danish Data Protection Agency should be contacted. Reference is also made to The Danish Data Protection Agency's guide on the geographical scope of the Personal Data Act.
It must be stated in the protocol and in the participant information if biological material is transferred abroad, and that the rules of the Personal Data Act are followed, or if the Personal Data Act does not apply (e.g., if the data controller is established in another EU country), which country's legislation applies for the protection of personal data in the biological material. See the researcher's guide.
5.4.2 Sending to EU Countries
The Personal Data legislation in Denmark implements the European Parliament and Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
If the material is sent to another EU country, it should be stated in the protocol and in the participant information, and it should be informed if the other country's legislation on the protection of personal data applies.
5.4.3 Sending to Third Countries (Outside the EU)
A third country is a state that is not part of the European Community or the EEA cooperation. That is, countries outside the EU, which are not EEA countries, for example, the USA, but also the Faroe Islands and Greenland.
The transfer of personal data and biological material to a third country requires a specific legal basis under the Personal Data Act (§ 27). See more in The Danish Data Protection Agency's guide on transfers to third countries.
It is a condition for the approval of a research project that projects, in which biological material and information are performed to third countries, are carried out in accordance with the Personal Data Act. This follows from the committee law § 20, para. 1, no. 6).
It must therefore be stated in the protocol and participant information if biological material is sent to these countries, as well as it is assumed that the dispatch is carried out in accordance with the Personal Data Act, including § 27 of the Personal Data Act (cf. committee law § 20, para. 1, no. 6). See Information for Researchers.
It is the data controller who is responsible for ensuring that the transfer of biological material or information is carried out in accordance with the Personal Data Act.
5.4.4 What Applies if Sending Only Occurs for Analysis/Data Processing?
If the biological material is sent abroad solely for the purpose of having the material analyzed (service agreement), the Danish Personal Data Act will still apply.
In this situation, there is not a "disclosure" of information under the Personal Data Act, but a transfer of information to a data processor for carrying out the task on behalf of the data controller.
According to the Personal Data Act, a (data processor) agreement must be established, stating that the data processor only acts according to instructions from the data controller. If a public authority transfers information to a data processor, the security ordinance must be fulfilled.
Analyses abroad of the biological material should be described in the protocol and participant information, and it should be clearly stated what happens with any surplus material after the analysis abroad, including whether it is destroyed or returned to the trial responsible.
If there is also a dispatch to a third country, the above section 5.4.3 also applies.
5.5. When the Biological Material is to be Transferred to a New Data Controller
Special rules apply to the processing and transfer of personal data (including biological material) for research use.
Information processed for scientific or statistical purposes, according to the Personal Data Act § 10, para. 1 and 2, may, after para. 3, only be transferred to a third party – meaning a new data controller – after prior permission from The Danish Data Protection Agency and only for the purpose of conducting other statistical or scientific studies. The Danish Data Protection Agency may set specific conditions for the transfer. The Danish Data Protection Agency may also, in connection with a report of processing of personal data in a research project, take a general stance on future transfer.
Therefore, if a research biobank or material from it is desired to be transferred to a new data controller, permission from The Danish Data Protection Agency is required (Personal Data Act § 10, para. 3).