The data that can be extracted from human body material (HBM), such as genetic information, is considered personal data when it can identify a person, whether or not in combination with other data. In such cases, the processing is subject to the GDPR and strict rules apply, in particular because genetic data falls under the special categories of personal data. HBM in itself is not personal data.

Human body material

HBM is defined by the law of 19 December 2008 (Human Body Material Act) as any biological body material, including human tissues and cells, gametes, embryos, fetuses, as well as the substances extracted from them, regardless of their degree of processing, with the exception of substances of non-human origin (art. 2, 1° HBM Act). 

Residual human body material: the part of the body material removed for the purpose of diagnosis or treatment of the donor which, after a sufficient and relevant part has been retained for the establishment, refinement or completion of the diagnosis or treatment of the donor on the basis of new scientific data, is unnecessary in relation to these purposes and should therefore be allowed to be destroyed (art. 2, 33° HBM Act).  

Artificial body material is body material that is produced or grown outside the human body: e.g. cell lines, organoids, ...
Extracted body material is material that is extracted from human body material, but no longer contains cells: e.g. proteins, organelles, ...

Biobanks

A biobank is defined by the Human Body Material Act as the structure that, for the purpose of scientific research with the exception of research with medical application to humans, obtains, where appropriate, processes, stores and makes available human body material, as well as, where applicable, the associated data relating to the human body material and the donor.

More information about biobanks is available on the Ghent University intranet: Human body material and biobanks and on this website of UZ Gent.

Personal data

 
Personal data is any information relating to an identified or identifiable natural person living. 

We also speak of personal data when a person is not directly named but is indirectly identifiable. Indirect identification involves data that appears anonymous in itself, but in combination with other data can lead to the recognition of an individual. This applies, for example, to health and genetic data. 

• Article 4(15) & Recital 35 GDPR state that health data are personal data related to the historical, current or future physical or mental health of a natural person, including data on health services provided that provide information about his or her state of health. This includes information resulting from the testing or examination of a body part or substance, including genetic data and biological samples.
• Article 4(13) & Recital 34 GDPR state that genetic data are personal data that are related to the inherited or acquired genetic characteristics of a natural person and provide unique information about that person's physiology or health. That data may result from an analysis of a biological sample from that person, such as a chromosome analysis, an analysis of DNA or RNA, or from an analysis of other elements that make it possible to obtain similar information. 

Personal data such as health and genetic data fall under the so-called special categories of personal data. These are personal data that are so sensitive that they may only be processed in very specific cases. 

When is information from human body material personal data?

We need to make a link between HBM and personal data. When information from human body material can lead to the identification of a person, both directly and indirectly, this is personal data. HBM as such is therefore not considered personal data, but the information that comes from it is. 

• Genetic data of a person.
• If the information from the HBM (including the information related to it) can be linked to an individual.
• The HBM that is pseudonymised or coded does not in itself constitute personal data. However, the associated code—which itself does not contain any direct identification data—is considered personal data because it makes it possible to trace the donor or patient and to link additional clinical data.

[!] Exception: When only information is obtained from DNA or other genetic material that cannot be traced back to an individual—for example, because only non-identifiable somatic tumor mutations are used, this information is not considered personal data and falls outside the scope of the GDPR.

When personal data is processed, the GDPR applies. For human body material and the use of a biobank, this means that a legal basis is also required for the processing.

If the personal data are processed in the light of the objectives and activities of the biobank approved by the Ethics Committee, this processing is part of the legal basis of a legal obligation, which rests on the (acquiring and further preserving) institution to guarantee, among other things, the traceability, quality and safety of the material. For example, when the objectives and activities of the biobank state that genetic data will be generated by means of DNA sequencing that will then be stored in a biobank register. 

If the processing does not fit within the objectives and activities of the biobank, e.g. When personal data is obtained by DNA sequencing within a study, the legal basis for this processing may be the public interest. 

Each human body material bank, intermediate structure for human body material, production facility or biobank acts as a controller within the meaning of Article 4, 7 GDPR, for the processing operations carried out by or on behalf of the institution, as referred to in the first paragraph. 

When is information from human body material not personal data?

When the information from the HBM is completely anonymized, and in no way traceable to an individual, this information is not personal data. This means that all identifying information has been permanently removed and there is no longer any possibility, not even through other data sources or additional information that you may not control, to find out who HBM came from. In this context, identifying information is broader than just a name or a unique identification number, it also includes other information from the patient file. 

HBM can be anonymized in 2 ways:

• In the case of residual HBM/HBM from deceased patients, it is the administrator of the biobank who makes the decision to proceed with the anonymization of the HBM, no explicit consent is required from the donor. 
• If the HBM is taken from a living donor specifically for a biobank or study (research project), explicit permission is required from the donor to proceed with anonymization.

HBM is anonymous when no feedback is possible nor is it possible to collect additional clinical data from the sample.

[!] As soon as information is extracted from the HBM that can be traced back to a person or that creates a unique profile that can identify the person in combination with other information (e.g. rare tumors), the information developed does become personal data.

[!] The processing necessary to anonymize the HBM (for example, the removal of codes or identifying information) does fall under the GDPR. Only after the anonymization has been fully completed does the material fall outside the scope of the GDPR. Is there any additional information available in your own database, the biobank, the hospital's file, etc. then the information from the HBM is pseudonymised but not anonymized and falls under the GDPR.

[!] If the scope of the investigation is very limited, there is a chance that HBM can still be traced back to a specific person. For example, if only ten blood samples are examined and only one person has blood type O+, it is easy to find out who that sample came from.

[!] HBM of a deceased person falls outside the scope of the GDPR. 

Obligations for researchers

Researchers who use HBM in the context of medical scientific research should take the following obligations into account:

• Any potential removal of HBM must be done in an approved hospital except for HBM that is exclusively intended for acquisition by a notified biobank. This removal can take place outside a hospital but is always done under the responsibility of a doctor. The removal must always be carried out for a precise and relevant purpose in terms of scientific research. The removed HBM that is intended for scientific research (except for HBM used in drug studies that falls within the scope of a protocol study) must always be registered in a notified biobank.
• The storage and provision of HBM for scientific research is always done by a biobank registered with FAMHP.
• Any use of HBM from a biobank must be subject to a positive opinion by a fully accredited ethics committee.
• An informed consent form (ICF) must be completed for the collection, storage and use of HBM. For residual HBM, consent is deemed to have been given insofar as the donor has not disclosed his refusal before any action has commenced. In that case, no explicit consent of the donor is required. The donor must be sufficiently informed about this presumption of consent. The following sources of information can be used for this purpose: the website of the biobank (part of UZ Gent website), information brochure biobank UZ Gent "Biobank: use of HBM for scientific research." (available via the biobank), recording brochure UZ Gent, UZ Gent website "You participate in scientific research".
• In the case of secondary use (any use of HBM other than that for which the donor has given his consent) in the context of the removal of HBM, the donor must still be informed, and the donor must give his consent. 
• Each time HBM is transferred, an agreement must be drawn up between the biobank U(Z)Ghent (Team TechTransfer Office) and the institution that obtains HBM. This agreement should (a) define the intended scientific research, (b) include agreements on traceability responsibilities, and (c) describe safeguards for the protection of personal data. You can contact TechTransfer's legal support service (gismo@ugent.be), biobank@uzgent.be and hiruz.contracten@uzgent.be. 
• Imported samples from abroad must first be registered in a biobank before they can be used for scientific research.

Transfer of body material

If you want to send or receive HBM as a researcher, the following rules apply:

• Physical samples → Use a Material Transfer Agreement (MTA).
• Personal data derived from samples e.g. the sequencing data obtained from HBM → Use a Data Transfer Agreement (DTA) specifically drawn up for HBM.

You can contact TechTransfer's legal support service (gismo@ugent.be), biobank@uzgent.be and hiruz.contracten@uzgent.be. 

Contact

For questions related to the processing of human body material within biobanks, you can email biobank@uzgent.be.

More tips

• Intranet: Human body material and biobanks
• Website biobank UZ Gent (Biobank | UZ Gent)
• Intranet UZ Gent: Corneel > UZ-Wijzer > Leren > Kennis en Onderzoek > Biobank