# Research Biobanking, Personal Data Protection and Implementation of the GDPR in France

Gauthier Chassang, Michael Hisbergues, Emmanuelle Rial-Sebbag

► To cite this version:

Gauthier Chassang, Michael Hisbergues, Emmanuelle Rial-Sebbag. Research Biobanking, Personal Data Protection and Implementation of the GDPR in France. GDPR and Biobanking. Individual Rights, Public Interest and Research Regulation across Europe, 43, Springer International Publishing, pp.257-276, 2021, Law, Governance and Technology Series, 10.1007/978-3-030-49388-2_14. hal-04338808

HAL Id: hal-04338808

https://ut3-toulouseinp.hal.science/hal-04338808v1

Submitted on 12 Dec 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

Gauthier Chassang, Michael Hisbergues, and Emmanuelle Rial-Sebbag

**Abstract** Since 1978 and the initial French data protection law (Loi n°78-17 du 6 Janvier 1978), consecutive modifications regarding the protection of personal health data, especially in 2004, 2016 and 2018, set up a strict legal regime for processing sensitive personal data, including for research purposes. In recent years, French law has evolved proactively and in parallel with the work of the European Union (EU) on the preparation of what became the General Data Protection Regulation (GDPR), which has been in force since May 2018. This Chapter performs a state-of-art analysis (as of 1 July 2019) of the French legal framework for research biobanks and data protection rules applying to biobanking, in particular those related to data subjects' rights and Article 89 of the GDPR. Firstly, it provides updated information about the national landscape of active research biobanks in France (Sect. 1). Secondly, it explores how the French law embodies the developments brought by the GDPR and how it envisages individuals' rights in the context of research biobanking (Sects. 2 and 3). Thirdly, this Chapter analyses existing and potential national exemptions to individuals' rights, including with regard to Article 89 GDPR, and how France conceives of processing activities of 'public interest' (Sect. 4). Finally, the authors address ongoing debates around bioethics law in France and argue for the creation

G. Chassang (✉)

LEASP, Inserm, Université Paul Sabatier Toulouse 3, Toulouse, France

Infrastructure Nationale Biobanques, Institute for Public Health, Clinical Research
Department, Paris, France

Plateforme “Ethique et Biosciences”, Genotoul Societal, Toulouse, France

M. Hisbergues

Infrastructure Nationale Biobanques, Institute for Public Health, Clinical Research
Department, Paris, France

e-mail: michael.hisbergues@inserm.fr

E. Rial-Sebbag

Infrastructure Nationale Biobanques, Institute for Public Health, Clinical Research
Department, Paris, France

Plateforme “Ethique et Biosciences”, Genotoul Societal, Toulouse, France

e-mail: emmanuelle.rial@univ-tlse3.fr
of a specific Act focused on biobanking as a means of integrating, clarifying and
developing not only data protection rules but also other activities related to samples,
human or not, in a unique, operational and compact act (Sect. 5).

# 1 Introduction

France is known for having one of the stricter legal regimes worldwide regarding
personal data protection. Since 1978, France has regularly updated personal data
protection rules to maintain a high level of protection for individuals' rights and
freedoms—something that can be considered a necessity in a democratic State.

Since 2006, this regulatory dynamism has intensified, notably in consideration of
the debates which led to the European Commission proposal to adopt a European
Union (EU) General Data Protection Regulation (GDPR) in 2012 and its formal
adoption in 2016. Between 2016 and 2018, the French government and parliamen-
tary bodies, in collaboration with the National Data Protection Authority (CNIL),
scrutinised existing personal data protection law and adopted several acts modifying
the Law on informatics and freedoms<fnref n="1" /> (Loi Informatique et Libertés n°78-17 (LIL)),
in particular regarding health data processing. These regulatory advances have inev-
itably impacted scientific research practices at large, including, to a certain extent,
research biobanking. Indeed, biobanks which process, store and control the sharing
of bioresources for research uses are stewards of the collections of human biological
samples and their associated data.<fnref n="2" />

In this Chapter, we intend first to describe the updated regime applied to biobanking
activities under French law and related procedures. Second, we concentrate on the rel-
evant provisions of the LIL introduced in 2018, and unmodified since the last revision
of 2019, that affect personal data processing for health research and cover biobanking.
We consider in particular the implementation of Article 89 of the GDPR which enables
national exemptions to several data subjects' rights in research contexts.

# 2 Biobank Infrastructure and Regulatory Environment

## 2.1 What Is the French Biobanks Landscape?

For 20 years, the government, through its associated ministries (research and
health), supported and structured the French landscape of Biological Resource
Centres (BRCs). Inserm (Institut National de la Santé et de la Recherche Médicale)
played a leading role as national operator in association with various national

<footnote n="1">¹Loi n°78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (LIL), 2019 version. https://www.cnil.fr/fr/loi-78-17-du-6-janvier-1978-modifiee.</footnote>

<footnote n="2">²E.g. clinical and biological personal data qualifying the sample.</footnote>
stakeholders. These actions led to the establishment of a French BRC network. This
continues to be at the forefront of European countries as, since 2008, France has
been the only country with a national standard for quality management in biobank-
ing [NFS 96-900].<fnref n="3" /> In 2011, another step was taken with the creation of a national
infrastructure to support quality assurance and certification processes in biobanks,
support technological innovations, provide expertise on ethical and regulatory
aspects and participate in international working groups. This French BIOBANQUES
Infrastructure has been decidedly oriented towards Europe with its active participa-
tion in the establishment of the European infrastructure BBMRI-ERIC.<fnref n="4" />

In 2001, 58 tumor biobanks attached to health care institutions were set up to
improve the organisation of care and accelerate cancer research. Now, the French
network of BRCs identified in health and research institutions consists of 96 bio-
logical or microbiological resource centres distributed throughout the country,
which are organised into 15 thematic or regional networks. The Paris area repre-
sents a ‘hot spot’ of biobanks concentration (44%), which is in line with the histori-
cal distribution of large institutions and hospital groups. The remaining 56% is
spread over the 13 administrative regions.<fnref n="5" />

The distinctiveness of the French network is that it implemented, early on, a
quality management system (based on NFS 96-900) leading to the certification of
almost 70% of the network (see footnote 5). The NFS defines standards for the
qualification of the personal, material and dedicated biobanking processes.
BIOBANQUES supports the preparation of BRCs certification process with quali-
fied personal. The typology of the French BRC landscape varies a great deal in
terms of size, expertise and therapeutic area, which gives it a richness and complexity.

A large part of BRCs in the French network is multi-thematic. The therapeutic
areas of the collections and associated data housed in these structures are, by order
of representativeness, according to the ICD-10 nomenclature,<fnref n="6" /> oncology, central
nervous system diseases, heart and vessel diseases, and infectious, parasitic and
HIV diseases. Moreover, almost 40% are involved in the collection and preservation
of biosamples and data from large national cohorts (population-based or disease-
specific), the majority of which include clinical collections.

Generally, data protection law applies whatever the biobank’s specificities.
Challenges regarding both the sustainability of the biobanks and the clarity of the
attached regulatory regime have been identified in the literature<fnref n="7" /> and will need fur-
ther political actions.

<footnote n="3">³AFNOR. NFS 96-900 for Biological Resource Centers. https://certification.afnor.org/qualite/certification-des-centres-de-ressources-biologiques-nf-s96-900.</footnote>

<footnote n="4">⁴Biobank and BioMolecular Research Infrastructure - European Research Infrastructure Consortium.</footnote>

<footnote n="5">⁵Hisbergues M (2019). Analysis of the French BIOBANQUES Network Characteristics. Unpublished.</footnote>

<footnote n="6">⁶World Health Organisation, International Statistical Classification of Diseases and Related Health Problems, 10th Revision. https://www.who.int/classifications/icd/en/.</footnote>

<footnote n="7">⁷Clément et al. (2019).</footnote>
## 2.2 How Is Biobank Research Regulated in France?

French law does not use the term ‘biobank’ but refers, as a similar notion, to ‘any organisms’ which ‘ensure the preservation and preparation for scientific purposes of tissues and cells from the human body, of organs, blood and its components and derived products’ whose ‘activities include the constitution and use of human biological samples collections’.<fnref n="8" /> ‘Human biological sample collection’ means ‘the pooling, for scientific purposes, of biological samples procured from a group of identified and selected persons according to the clinical or biological characteristics of one or several members of the group, as well as the derived products of these samples’.<fnref n="9" />

France has no unique, comprehensive biobank law. Successive laws, decrees and regulatory acts from government and authorities have directly or indirectly impacted research biobanking and BRCs. These have progressively constituted the current legal framework. In a nutshell, this framework is constituted by bioethics laws;<fnref n="10" /> biomedical research laws;<fnref n="11" /> and the data protection law that fixes data subjects’ rights and special conditions for processing personal data for research purposes.<fnref n="12" /> These major acts cross-reference themselves and interact on a number of topics. They are completed by applicable ethical, technical and scientific guidelines intended to ensure high quality and security of research.<fnref n="13" /> This framework is mainly codified in the Public Health Code (PHC) and the Civil Code (CC), but the French biobanking legal regime remains complex and fragmented. Also, some of the provisions presented below could evolve based on ongoing debates on revising the last bioethics law.

<footnote n="8">⁸Article L.1243-3 and 4 PHC. Unofficial translation.</footnote>

<footnote n="9">⁹Ibid. footnote 8.</footnote>

<footnote n="10">¹⁰Protecting human dignity, human body integrity, non-availability, non-patrimoniality and rules regarding the procurement, collection, storage and use of human samples for research purposes. Adopted in 1994, 2004, 2011. Re-examined at the latest every 7 years after publication of the last bioethics law, presently under revision. For a summarised history of French bioethics laws, see CCNE (2018). Etats Généraux. Rapport de synthèse. Opinions du Comité Citoyen. Fig. 1.</footnote>

<footnote n="11">¹¹Regulating research involving human person, fixing research participants’ rights, rules and procedures to set up, submit, pilot and implement interventional or non-interventional research projects since 1988. Currently: Loi n°2012-300 du 5 mars 2012, JORF 6 mars 2012.</footnote>

<footnote n="12">¹²Loi n°78-17 ibid. footnote 1, as modified by Loi n°2004-801 du 6 août 2004, JORF 7 août 2004, implementing the European Data Protection Directive 95/46; Loi n°2016-41 du 26 janvier 2016 de modernisation de notre système de santé, JORF 27 janvier 2016. Loi n°2016-1321 du 7 octobre 2016 pour une République numérique, JORF 8 octobre 2016. And lastly, for implementing the GDPR, by Loi n°2018-493 du 20 juin 2018 relative à la protection des données personnelles. JORF 21 juin 2018. Décret n°2018-687 du 1er août 2018, JORF 3 août 2018, texte n°12. Ordonnance n°2018-1125 du 12 décembre 2018, JORF 13 décembre 2018, texte n°5. Décret n° 2019-536 du 29 mai 2019, JORF n°0125 du 30 mai 2019, texte n° 16.</footnote>

<footnote n="13">¹³E.g. Good clinical practices in clinical trials on medicinal products for human use. Décision du 24 novembre 2006 fixant les règles de bonnes pratiques cliniques pour les recherches biomédicales portant sur des médicaments à usage humain, JORF 30 novembre 2006, texte n°64.</footnote>
Biobanking for research purposes is often included within broader health research projects but can also be envisaged on its own, for example, as a parallel activity to healthcare in order to serve future undefined research. These different contexts involve different legal considerations. Today, the applicable rules for biobanking activity are identified on a case-by-case basis, depending on the nature of the activity,<fnref n="14" /> on the purpose of the research project,<fnref n="15" /> on the individuals concerned,<fnref n="16" /> on the nature of the samples,<fnref n="17" /> and on the nature of the data collected and used (personal, anonymised or anonymous data).

The legal procedures regarding personal data processing for research (ruled by LIL) and those applying to biobanking and the setting up of a biobank (ruled by the PHC, in close connection with biomedical research laws) rely on two specific frameworks. Both must ultimately be respected. Here we concentrate on the procedures for setting up a research biobank. The next section will present the procedures regarding personal data processing in research biobanking.

Two procedures exist for setting up a biobank depending on the context in which the collection of human samples is implemented and on the use envisaged for the collection, regardless of whether or not the collections are anonymised or anonymous.

* First procedure: the collection is constituted within the frame of a Research Involving Human Person (RIHP) project.

In 2016, the implementation of the Law n°2012-300¹⁸ and its related Decree,<fnref n="19" /> Ordinance<fnref n="20" /> and ‘Arrêtés’<fnref n="21" />,<fnref n="22" /> on RIHP affected the rules regarding biomedical research and biobanking, essentially through new research classification and

<footnote n="14">¹⁴ Samples procurement, non-invasive collection or reuse of existing biosamples and data.</footnote>

<footnote n="15">¹⁵ Involving human persons or not according to the French law criteria.</footnote>

<footnote n="16">¹⁶ Patients, healthy participants, minors, adults, vulnerable people and deceased persons.</footnote>

<footnote n="17">¹⁷ Organs: Articles L.1232-1 to L.1232-3, third paragraph of Article L.1235-1 and Article L.1235-2 PHC.</footnote>

<footnote>– Blood: Articles L.1221-4, L.1221-8-1 and second paragraph of Article L.1221-12 PHC.</footnote>

<footnote>– Tissues, cells, liquids and other body products such as stool: Articles L.1241-5, L.1243-3, L.1243-4, L.1245-2, L.1245-5 and L.1245-5-1 PHC.</footnote>

<footnote>– Embryos, fetuses and derived cells: Articles L.2151-2 and L.2151-5 to L. 2151-7 PHC.</footnote>

<footnote>– Micro-organisms of human origin, such as viruses, parasites: for these samples, specific biosecurity and biosafety rules could apply to their storage, handling and use, for proper protection of staff and society. See Société Française de Microbiologie (2014).</footnote>

<footnote n="18">¹⁸ Loi n°2012-300 du 5 mars 2012 relative aux recherches impliquant la personne humaine, JORF 6 mars 2012. Consolidated version.</footnote>

<footnote n="19">¹⁹ Décret n°2016-1537 du 16 novembre 2016, JORF 17 novembre 2016, texte n°27.</footnote>

<footnote n="20">²⁰ Ordonnance n°2016-800 du 16 juin 2016, JORF 17 juin 2016, texte n°19.</footnote>

<footnote n="21">²¹ Arrêté du 12 avril 2018 fixant la liste des recherches mentionnées au 2° de l'article L. 1121-1 du code de la santé publique, JORF 17 avril 2018, texte n°10.</footnote>

<footnote n="22">²² Arrêté du 12 avril 2018 fixant la liste des recherches mentionnées au 3° de l'article L. 1121-1 du code de la santé publique, JORF 17 avril 2018, texte n°11.</footnote>
associated procedures towards competent authorities according to the type of research and updated informed consent requirements regarding individual's participation to the research activities (consent to research participation required under PHC should not be confounded with consent as to personal data processing as referred to in the LIL).

The PHC defines a RIHP as research organised and carried out on human persons to develop biological or medical knowledge.<fnref n="23" /> Three types of RIHP are defined according to their risks for research participants,<fnref n="24" /> from the more risky or invasive research (RIHP1) to the less risky or less-invasive ones (RIHP3). Activities related to the procurement, collection, preservation and use of biological samples and attached data can occur in the three types if justified and detailed within the research protocol.<fnref n="25" />

Every RIHP project needs to be registered<fnref n="26" /> prior to the submission to the competent authorities. Drug clinical trials covered by the EU Clinical Trial Regulation<fnref n="27" /> will need a EudraCT number. RIHP1 ones (e.g. interventional research on medical devices) will need to obtain an ID-RCB number with registration at the National Agency for the Safety of Medicines and Health Products (ANSM). The protocol must be reviewed and approved by a competent Research Ethics Committee (Comité de Protection des Personnes—CPP). The CPP should scrutinise<fnref n="28" /> the project in particular regarding the respect for research participants’ rights, informed consent procedures, forms, the necessity and proportionality of the planned activities regarding the research purposes, including data protection measures, and in particular data minimisation. The CPP is designated randomly.<fnref n="29" /> A CPP decision can be appealed

- RIHP1: interventional research involving an intervention upon the person that is not justified by his or her usual care. It aims to deal with risky research such as clinical trials on experimental drugs or other health products (e.g. cell therapies' products; products in the field of human feeding).

- RIHP2: interventional research involving only minimal risks and constraints whose list is fixed by the Minister of Health, after consulting with the Director General of the National Agency for the Safety of Medicines and Health Products (ANSM). It includes research that uses health products used in their usual way and research including minimal invasive acts (blood procurement by drawing, medical imagery, etc.). See footnote 21 for a list of activities qualifying as RIHP2.

- RIHP3: non-interventional research involving no risk nor constraints and in which all acts are performed, and products are used in the usual manner. It includes for example observational research on treatment observance, on healthcare practices, the use of surveys and the collection of small quantities of supplementary samples during routine acts in healthcare or through non-invasive acts. See footnote 22 for a list of activities qualifying as RIHP3.

<footnote n="23">²³ Article L.1121-1 PHC.</footnote>

<footnote n="24">²⁴</footnote>

<footnote n="25">²⁵ Clear information on the nature of the interventions, attached risks, samples and data nature, sources, flows, storage and expected uses shall be, among others, presented and argued.</footnote>

<footnote n="26">²⁶ https://ansm.sante.fr/Services/Obtenir-un-numero-d-enregistrement-pour-une-RIPH.</footnote>

<footnote n="27">²⁷ Regulation (EU) n°536/2014 on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC. OJEU L.158/1. 27 May 2014.</footnote>

<footnote n="28">²⁸ Article L.1123-7 PHC fixing the non-limitative list of assessment criteria used by CPP.</footnote>

<footnote n="29">²⁹ Article L. 1123-14 PHC.</footnote>
once through the same randomised process. ANSM authorisation is required only for RIHP1.<fnref n="30" /> In RIHP2, the ANSM is only notified of the project details and CPP opinion. ANSM is not involved in RIHP3. Any substantial modifications<fnref n="31" /> of the declared elements must be submitted to the CPP for approval and, if required, to the ANSM for authorisation.

The CPP has 45 days to approve or reject the project proposal. Silence means acceptance. Where ANSM authorisation is required, delays can vary according to the products used; if there is silence past the delay, this means refusal.

The storage of a biological collection after a project comes to an end is allowed when concerned individuals have been properly informed and are able to exercise their right to oppose. Sufficiently clear indications must have been provided about the storage duration, conditions, the scientific purposes for which samples and data will be made available and where to find further information. Only in this case do the initial ethics approval and authorisations obtained for the research project suffice to continue storage in a research biobank after a project ends. However, where individuals were not able to provide a valid informed consent for long term storage, the promoter shall consult a CPP for proper approval and follow the second procedure.

* Second procedure: the collection is not constituted within a RIHP project and/or the storage is prolonged after the end of a RIHP to cede rights on the materials for research uses, including without proper informed consent.

This procedure covers projects to create new bio-collections or biobanking sites outside any particular RIHP project (i.e. systematic collection of residual surgical samples for future research or reuse of existing samples without any additional act on human persons or a purely technological project). This procedure also concerns biobank activities where long-term storage for cession<fnref n="32" /> to third parties is planned and, subject to a new CPP approval, where RIHP participants have not been properly informed in the initial consenting process about materials storage or cession after the project ends.

In these cases, the organism in charge of the collection is either subject to a dec-
laration<fnref n="33" /> to the Ministry of Research where collections will be used for their own
research program needs, or to an authorisation, for those wishing to transfer

<footnote n="30">³⁰ Article L.1123-12 PHC fixing the non-limitative list of assessment criteria used by ANSM.</footnote>

<footnote n="31">³¹ As defined in Article R.1123-42 PHC. See examples in clinical trials where ANSM authorization is required: ANSM (2015). Avis aux promoteurs d'essais cliniques de médicaments - Tome 1 - Annexe 14: Exemples de modifications substantielles et non substantielles pour l'ANSM. V.01/06/2015. https://ansm.sante.fr/var/ansm_site/storage/original/application/564a06 fb30def9d36ad3f0c17e3bd0b9.pdf.</footnote>

<footnote n="32">³² ‘Cession’ can be defined as a particular transfer of the samples including to cede rights upon the material to a third recipient, for its own uses. It shall be differentiated from collaboration with the biobank where the latter keeps custodianship and attached management rights on the material.</footnote>

<footnote n="33">³³ Articles L.1243-3 and R.1243-49 to R.1243-56 PHC.</footnote>
samples to third parties for research uses,<fnref n="34" /> in application of a Decree of 2017³⁵ (CODECOH procedures),<fnref n="36" /> and where individuals’ information is lacking. The Ministry, and the Regional Agency of Health (ARS) where hospitals are located, have 2 months to approve a declaration, with silence meaning approval, and 3 months regarding authorisations, with silence meaning rejection. Declarations have no validity deadline. Authorisations are valid for 5 years and must be renewed after submission of an activity report.<fnref n="37" /> Any substantial modifications to the elements<fnref n="38" /> presented in the application dossier must be submitted to the Ministry and, where relevant, to the ARS.<fnref n="39" /> A new CPP approval could be needed.

Whatever the procedure, biobanks wishing to export/import human biological samples<fnref n="40" /> for research uses need specific authorisation from the Ministry of Research. The Ministry of Research will check that the principles of free donation, informed consent rules and transport standards for labelling<fnref n="41" /> and packaging dangerous goods have been respected. This authorisation is delivered within a 3 months delay maximum.

Promoters of research using ethically sensitive biological elements, such as human embryos, gametes, or organs coming from deceased persons, need specific authorisation from the Biomedicine Agency (Agence de la Biomédecine).

Biobanks are accountable and must be able to answer to requests from competent authorities at any time, notably on the nature and characteristics of the stored samples, on the research projects using the samples, on consent or non-opposition from source individuals and on the fate of the samples. In all cases, specific rules and procedures fixed by the LIL regarding personal data collection, storage and other processing for health research purposes must be respected.

<footnote n="34">³⁴Articles L.1243-4 and R.1243-57 to R.1243-66 PHC.</footnote>

<footnote n="35">³⁵Décret n°2017-1549 du 8 novembre 2017 relatif à la conservation et à la préparation à des fins scientifiques d’éléments du corps humain, JORF du 10 novembre 2017, texte n°30.</footnote>

<footnote n="36">³⁶Ministry Online Application: https://appliweb.dgri.education.fr/appli_web/codecoh/IdentCodec.jsp.</footnote>

<footnote n="37">³⁷Article R.1243-63 PHC.</footnote>

<footnote n="38">³⁸Articles R.1243-54 regarding declared activities and R.1263-64 PHC regarding authorised activities.</footnote>

<footnote n="39">³⁹Article R.1243-55 PHC.</footnote>

<footnote n="40">⁴⁰Article L.1221-12 PHC for import/export for scientific uses of blood, blood components and derived products; Article L.1235-1 for organs and Article L.1245-5 for tissues and cells.</footnote>

<footnote n="41">⁴¹Article R.1235-3 PHC.</footnote>
# 3 Safeguards and Individual Data Subjects' Rights in Research Biobanks

## 3.1 How Research Biobanks Are Integrated Within the Data Protection Framework

The LIL is not focused on biobanks, or even mentions them, but it does directly apply to them and to the various operators implied in biobanking activities that fall under the scope of the LIL Title II, Chapter III.<fnref n="42" />

From a data protection law perspective, those responsible for biobanks are either the data controller, join-controller, processor or third party, depending on the processing context. Indeed, biobanks essentially function as platforms for controlling access and sharing biosamples and associated personal data for external research uses, although they can also develop their proper internal research programmes. In both cases, activities performed with personal data, including pseudonymised data, are qualified as data processing that pursues one or multiple, present or future, research purposes. Like the GDPR, the research activities covered are scientific, historical research, statistics and archiving in the public interest,<fnref n="43" /> and includes technological research (e.g. on medical devices) and innovation.

The LIL, following its amendment in 2018, did not fundamentally change the existing framework but incorporated some of the GDPR provisions, notably those updating the right to information, and provisions regarding Data Protection Officers<fnref n="44" /> (DPO), Data Protection Impact Assessment<fnref n="45" /> (DPIA), data transfers<fnref n="46" /> and CNIL remits. The LIL directly refers to the GDPR in several articles. New rules were inserted into Chapter III on accessing the National Health Data System (SNDS) databases for research purposes.

Definitions of ‘personal data’ and ‘processing’<fnref n="47" /> are identical to the GDPR ones. Sensitive personal data<fnref n="48" /> are a special category of personal data whose processing is forbidden in principle, with limited exemptions including processing that is necessary for scientific research.<fnref n="49" /> Sensitive data include data concerning health, genetics or biometrics, as defined in the GDPR. The CNIL developed a flexible approach to

<footnote n="42">⁴²Articles 57–79, Section 4 fixing specific rules for health research, study or evaluation purposes.</footnote>

<footnote n="43">⁴³Articles 44(3) and (6) LIL.</footnote>

<footnote n="44">⁴⁴CNIL (2018) Referentials for the certification of DPOs’ skills. https://www.cnil.fr/fr/certification-des-competences-du-dpo-la-cnil-adopte-deux-referentiels.</footnote>

<footnote n="45">⁴⁵CNIL (2018) List of activities requiring DPIA: https://www.cnil.fr/sites/default/files/atoms/files/liste-traitements-avec-aipd-requise-v2.pdf; DPIA guidelines and tools: https://www.cnil.fr/fr/PIA-privacy-impact-assessment.</footnote>

<footnote n="46">⁴⁶Title III, Chapter IV LIL.</footnote>

<footnote n="47">⁴⁷Article 2 LIL.</footnote>

<footnote n="48">⁴⁸Article 6(I) LIL.</footnote>

<footnote n="49">⁴⁹Article 6(II) and (III) referring to Article 9(2) GDPR for the list of exemptions to the initial prohibition of processing.</footnote>
the notion of health data which could be so qualified due to their nature, as a result of cross-processing or by destination.<fnref n="50" /> This allows operationalisation of the qualification. The principles<fnref n="51" /> of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, integrity and confidentiality, accountability and storage limitation are identical to the GDPR.

The LIL preserves important provisions for biobanking. First, regarding the purpose limitation principle, it is with the presumption of compatibility<fnref n="52" /> for repurposing personal data processing for scientific or historical research and statistics provided that the rules and procedures<fnref n="53" /> are satisfied. Second, the specific exception to storage limitation for personal data to be stored after the achievement of the initial processing purpose solely for archiving purposes in the public interest, scientific, historical research or statistical purposes, in accordance with Article 89(1) GDPR.<fnref n="54" /> In both cases, data shall be at least pseudonymised and will not serve individual decision-making.

Biobanks, as samples and data repositories, have a prominent custodian role over the legal and ethical compliance monitoring in both the deposit, the management of, and the access to, the bioresources.<fnref n="55" />,<fnref n="56" /> Confidential and secure data management is essential, notably through the definition of access rights and procedures considering the data nature or sensitivity (anonymised/anonymous data; pseudonymised data; directly identifiable data) and through efficient mechanisms to check the adequacy of the applicant's processing purposes.<fnref n="57" /> Biobanks' duty to ensure database security applies to facilities and ICT systems used to store, process and make available the data, including measures for external data users.<fnref n="58" /> French quality norm NFS-96-900 on BRCs and the ISO norms, in particular ISO 20387:2018 on Biotechnology and Biobanking, together with potential new labels<fnref n="59" /> on personal data protection, allow a certain alignment of management practices. Also, biobanks can apply to the Ministerial ASIP for specific certification of health databases hosting.<fnref n="60" />

<footnote n="50">⁵⁰ CNIL. Qu'est-ce qu'une donnée de santé? See: https://www.cnil.fr/fr/quest-ce-ce-qu'une-donnee-de-sante.</footnote>

<footnote n="51">⁵¹ Article 4 LIL.</footnote>

<footnote n="52">⁵² Article 4(2) LIL.</footnote>

<footnote n="53">⁵³ Under Title I, Chapter IV, V and Title II Chapter III LIL.</footnote>

<footnote n="54">⁵⁴ Article 4(5) LIL.</footnote>

<footnote n="55">⁵⁵ This presupposes the existence of a right of biobanks to refuse deposit or access requests based on legal or ethical non-compliance or uncertainties and of attached responsibilities they could endorse.</footnote>

<footnote n="56">⁵⁶ E.g. Borella et al. (2006).</footnote>

<footnote n="57">⁵⁷ For the biobank entry/exit points.</footnote>

<footnote n="58">⁵⁸ Articles 99–102, 121–122 LIL.</footnote>

<footnote n="59">⁵⁹ https://www.cnil.fr/fr/les-labels-cnil. Since March 2018, personal data protection labels are no longer issued by the CNIL itself but by certified organisations.</footnote>

<footnote n="60">⁶⁰ Article L.1111-8 CSP. See Agence Française de la Santé Numérique (ASIP) website: https://esante.gouv.fr/labels-certifications/hebergement-des-donnees-de-sante.</footnote>
Since 2006, the CNIL has followed the GDPR approach based on operators'
accountability and modified the declaration/authorisation system to create simpli-
fied procedures intended to ensure data subjects' protection while favouring
research, innovation and competitiveness. The CNIL adopted referentials
(Méthodologies de Référence, MR) specifying data protection rules in research
contexts. Processing within a MR scope can be implemented after a commitment of
compliance with the CNIL. We will concentrate on MR001,<fnref n="61" /> MR003⁶² and MR004⁶³
which are particularly relevant for biobanks. The use of a particular MR depends on
the qualification of the research activity. In any cases, samples and data collection
must be justified. The MRs articulate the LIL and the PHC. Processing falling out-
side the MRs' scope need CNIL authorisation.<fnref n="64" /> Biobanks receiving samples and
data will be checkpoints.

For each selected MR, Table 1 summarises the data protection rules impacting
depositors to biobanks and biobanks' users.

## 3.2 Overview of Data Subjects’ Rights in Research Biobanking

Generally, in France, data subjects participating in research biobanks have similar rights to participants in classical biomedical research projects. The French law functions by analogy.

The LIL approach of research is based on opt-out (non-opposition). Opt-in consent can be required under other laws (e.g. for participating in RIHP1 and 2; MR001). Consent to sensitive personal data processing with several purposes is accepted where these are clearly, intelligibly and explicitly presented to the individuals who can opt for or refuse each one.<fnref n="65" /> Genetic data processing is only authorised for medical or scientific purposes and based on opt-in, written, free and informed consent as required by Article 75 LIL. Nevertheless, Article L.1131-1-1 PHC explicitly allows opt-out consent where the genetic analysis is based on the reuse of already collected samples. A renewal of an individual's consent will only be necessary in case of the procurement of new samples for genetic analyses. The scope of this PHC article can be questioned as it does not explicitly cover the reuse of genetic databases without attached samples. We favour a broad interpretation with the same opt-out process for the reuse of genetic data.

Table 2 provides an overview of the 3 MRs data protection principles and
individual rights to be respected by depositors and access applicants to biobank

<footnote n="61">⁶¹ Délibération n°2018-153 du 3 mai 2018, JORF 13 juillet 2018, texte n°108.</footnote>

<footnote n="62">⁶² Délibération n°2018-154 du 3 mai 2018, JORF 13 juillet 2018, texte n°109.</footnote>

<footnote n="63">⁶³ Délibération n°2018-155 du 3 mai 2018, JORF 13 juillet 2018, texte n°110.</footnote>

<footnote n="64">⁶⁴ Article 66(III), 76 LIL.</footnote>

<footnote n="65">⁶⁵ CNIL. Conformité RGPD: comment recueillir le consentement des personnes? See: https://www.cnil.fr/fr/conformite-rgpd-comment-recueillir-le-consentement-des-personnes.</footnote>
<table><caption>**Table 1** Scope and basic rules of CNIL MR001, MR003, MR004 for personal sensitive data processing in health research</caption><thead><tr><th></th><th>MR001 regarding health research requiring prior informed consent</th><th>MR003 regarding health research that does not require consent</th><th>MR004 regarding research that does not involve human persons, studies and evaluations in health</th></tr></thead><tbody><tr><td>Type of research potentially including biobanking or access to biobank materials</td><td>- RIHP1.<br>- RIHP2.<br>- Genetic research.</td><td>- Cluster clinical trials of drugs for human use.<br>- RIHP3.<br>- RIHP2 for which only general public information will be provided, with CPP approval.<br>- Genetic research.</td><td>Other research and evaluation including further uses of existing samples and data from clinical or research activities, e.g. from existing databases/biobanks/National System of Health Data (SNDS).</td></tr><tr><td>Impact on participant's medical taking in charge</td><td>Allowed. New acts and supplementary measures with identified risks and attached response plans.</td><td>Only minimal. Can include some supplementary measures during usual taking in charge, e.g. limited additional blood procurement.</td><td>Not allowed.</td></tr><tr><td>Data minimisation</td><td colspan="3">Strict application of the personal data processing necessity and proportionality regarding each research purposes.</td></tr><tr><td>Purpose limitation</td><td colspan="3">Research with a public interest purpose only.</td></tr><tr><td>Research protocol</td><td colspan="3">Required in respect of the disciplinary standards</td></tr><tr><td>Kind of data excluded</td><td colspan="3">Any unlisted data, including geocoding data, National Identification Number, religious data, data relating to infractions.</td></tr><tr><td>Possible activities connected to biobanking</td><td>- Samples' procurement (invasive) or collection (non-invasive);<br>- Setting up of a biobank;<br>- Access and reuse of stored samples and data.</td><td>- Samples' procurement (minimally invasive) or collection (non-invasive);<br>- Limited sample quantity;<br>- Setting up of a biobank;<br>- Access and reuse of stored samples and data.</td><td>- Access and reuse of stored samples and data for this research;<br>- Samples' pooling (existing materials);<br>- Setting up of a biobank.</td></tr><tr><td>Data controller (Declarant)</td><td colspan="3">Research promoter</td></tr><tr><td>Administrative procedures</td><td>- Prior CPP approval.<br>- Commitment of compliance with CNIL.<br>- Recording of processing in DPO's registry.</td><td colspan="2">Research manager</td></tr><tr><td colspan="4"><b>Research settings falling outside the MR: CNIL authorisation.</b></td></tr><tr><td colspan="4"><b>Research settings falling outside the MR: INDS authorisation with potential CNIL advice.</b></td></tr></tbody></table>
<table><caption>**Table 2** Data subjects' rights and data protection measures in the CNIL MR001, MR003, MR004 for personal sensitive data processing in health research</caption><thead><tr><th></th><th>MR001 regarding health research requiring prior informed consent</th><th>MR003 regarding health research that does not require consent</th><th>MR004 regarding research that do not involve human persons, studies and evaluations in health</th></tr></thead><tbody><tr><td>Prior information</td><td>Yes. General information (e.g. on site) AND individual information complying with Articles 13, 14 GDPR and with the MR rules regarding minors or legally incapable participants.</td><td>Yes. General information (e.g. on site) AND individual information complying with Articles 13, 14 GDPR and with the MR rules regarding minors or legally incapable participants. Exceptionally, only general information where justified by the methodology and with competent REC approval.</td><td>Yes. General information (e.g. on site) AND individual information complying with Articles 13, 14 GDPR and with the MR rules regarding minors or legally incapable participants. For the reuse of samples, individual information is not needed when the participants already received the information about further uses for scientific research AND about a specific device available to him for acquiring knowledge of any new processing (e.g. biobank website).</td></tr><tr><td>Consent rules</td><td>Free, informed, explicit and written consent (Opt-in) for participation to the research or for undertaking genetic examinations for research.</td><td>Free, informed, non-opposition (Opt-out) both for participation to the research and for underlying personal data processing. Except where opt-in consent is required for primo-processing genetic data.</td><td></td></tr><tr><td>Right to refuse, to withdraw or object</td><td>Yes</td><td>Yes (refusal/objection)</td><td></td></tr><tr><td>Right to erasure</td><td>Yes</td><td></td><td></td></tr><tr><td>Right to restrict the processing</td><td>Yes</td><td></td><td></td></tr><tr><td>Right to access</td><td>Yes</td><td></td><td></td></tr><tr><td>Right to portability</td><td>The MR does not address it explicitly. Conditional application according to Article 20 GDPR.</td><td></td><td></td></tr><tr><td>Data recipients</td><td>Can access directly identifying data, for specific missions related to the research:<ul><li>Research professionals and stakeholders in quality assurance subject to professional secrecy;</li><li>Teams from the data controller's organisation and processors acting on his/her behalf;</li><li>Teams from participating research centres.</li></ul>A general rule excludes the same processor from processing both directly identifying data and health data of the same individual.</td><td></td><td></td></tr></tbody></table>

(continued)
<table><caption>**Table 2** (continued)</caption><thead><tr><th></th><th>MR001 regarding health research requiring prior informed consent</th><th>MR003 regarding health research that does not require consent</th><th>MR004 regarding research that do not involve human persons, studies and evaluations in health</th></tr></thead><tbody><tr><td>Storage limitation</td><td colspan="3">Patients' personal data:<br/>- Until the commercialisation of the product;<br/>- Until 2 years after the last publication of results;<br/>- Until the signature of the final report of the research.<br/>Professionals' personal data: until 15 years after the end of the research.<br/>Then all the data are archived according to applicable law.</td></tr><tr><td>Pseudonymisation</td><td colspan="3">Yes</td></tr><tr><td>DPIA<sup>a</sup></td><td colspan="3">Yes</td></tr><tr><td>Transfers</td><td colspan="3">Only where necessary to the research purposes.<br/>Only with pseudonymised data (from participants or professionals).<br/>Professionals' identifying data can exceptionally be transferred if necessary for a specific mission.</td></tr><tr><td>Territorial application</td><td colspan="3">Applies in France and other countries where the processed data concerns persons residing in France. Controllers established outside France can engage in compliance.</td></tr></tbody></table>

<sup>a</sup>The CNIL created a software, open source and free, available in English and 18 languages, to perform and manage DPIA in compliance with the GDPR: https://www.cnil.fr/en/pia-software-20-available-and-growth-pia-ecosystem

bioresources. Biobanks verify the adequacy of deposit/access requests regarding applicable ethico-legal frameworks and ensure a continuum regarding stored materials. This table reveals that the leeway provided under Article 89(1) GDPR is not used in the MRs for particularly derogating to data subjects' rights in research.

Once personal data enter a biobank, data subjects must continuously be able to exercise their rights. Privacy policies should be easily available to the public. Most of the French biobanks certified NFS-96-900 meet specific requirements that are in line with transparency such as in maintaining external communication regarding availability of the collections, terms of access and quality measures.

# 4 The National Exceptions to Individual Rights and the Role of Public Interest

## 4.1 Exceptions Regarding Data Subjects' Rights for Personal Data Processing in Research

Biobanking necessitates special measures to be able to process personal data over the long-term for future, quite broadly defined, uses. The GDPR has made available several means for Member States to derogate from individual rights for the benefit of scientific developments under certain conditions. The GDPR's flexibility is preserved in French law.
Regarding in particular the right to access, the LIL includes a special derogation 'where the personal data are stored in a form that manifestly excludes any risk as regard to privacy and data protection'. This exemption will last only for the duration necessary to reach the statistical or research processing purposes.<fnref n="66" /> Nevertheless, it is difficult to determine which situations are being targeted. Does that open a notion of 'relative anonymity' or 'de facto anonymity'<fnref n="67" /> based on each processing context, purpose, and technical and organisational measures in place to protect identity and the means reasonably likely to be used for (re)identifying the data subject?

Like the GDPR, the LIL explicitly provides exceptions regarding the right to information prior to the processing when respect for this right proves impossible or involves disproportionate efforts compared to the risks of the processing. These derogations are only planned in the context of indirect data collection and in the context of further uses of already collected data, either for storage, for historical, statistical or scientific purposes, or for further processing for statistical purposes.<fnref n="68" /> So, these exceptions could be invoked either before including the indirectly collected data in the biobank or after, at the time of accessing the bioresources, for the reuse of existing biobanks' samples or databases in research, including for genetic research. The data subject can also decide not to be informed where it would lead to reveal a diagnosis or prognosis.<fnref n="69" /> Such exceptional circumstances necessitate justification and could trigger, for the research promoter, the CNIL authorisation procedure, the MRs requiring data subjects to be informed, and REC approval for reuses in RIPH.

Article 110 LIL allows derogations to the right to oppose to a processing where this latter answers to a legal obligation imposed to the controller or processor or where it is explicitly planned by the act authorising the processing.

Recently, lawyers criticised<fnref n="70" /> the way the GDPR forces communication of the research promoter's DPO contact details within information notices provided to data subjects in clinical trials, claiming that DPO involvement could breach medical secret of which the sole investigator is the guarantor. Furthermore, they claim that the Clinical Trial Regulation is the special law that makes the investigator the only contact of the participants for exercising their rights. Therefore, in their opinion, DPO contact should not be provided. To date, the CNIL has not gone against GDPR.

The LIL refers to the GDPR provisions regarding the implementation of other rights, in particular regarding the right to limit processing, the right to data portability, the right to oppose and the data breach notification process.

Research exemptions to individual rights are not entirely fixed in France. Ordinance n°2018-1125 mentions the future adoption of a Decree determining the conditions and guarantees under which exemptions to data subjects' rights planned by Article 89.2 GDPR regarding its Articles 15 (access), 16 (erasure), 18

<footnote n="66">⁶⁶ Article 49(II) LIL.</footnote>

<footnote n="67">⁶⁷ Sariyar and Schlünder (2016).</footnote>

<footnote n="68">⁶⁸ Articles 116(II) and (III), 79 LIL.</footnote>

<footnote n="69">⁶⁹ Article 69 LIL.</footnote>

<footnote n="70">⁷⁰ Roche (2018).</footnote>
(restriction) and 21 (right to object) could apply.<fnref n="71" /> At the same time, exceptions to certain of these rights remain possible on a case-by-case basis. As the GDPR provides, such derogations could be accepted where the processing is necessary for scientific research purposes, it is lawful, where data minimisation is strictly respected, in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes and such derogations are necessary for the fulfilment of those purposes.<fnref n="72" />

## 4.2 The Public Interest Purpose of Processing in French Law

Since 2016, the notion of ‘public interest’ has been central for processing personal data in health research. Any processing in this field must contribute to the public interest,<fnref n="73" /> including for using simplified procedures (above-mentioned MRs). The public interest purpose is an actionable means to derogate from some general principles of personal data processing. Regarding the initial prohibition of processing sensitive data, Article 6(II) and (III) LIL allows controllers to process personal health data where the research processing pursues the public interest in respect of Title II Chapter III, including public health. The public interest purpose of the research processing also explicitly allows justified exceptions to the right to erasure<fnref n="74" /> and base adaptations of the right to information, to oppose and to data access for minors participating in certain types of research (further detailed below, Sect. 5.1).<fnref n="75" /> Outside archiving, the public interest purpose is not mentioned to exempt from the storage limitation principle in a research context. Data controllers involved in archiving in the public interest can derogate<fnref n="76" /> from the rights established under Articles 15, 16 and 18 to 21 of the GDPR.

But this blurry notion is problematic, in particular where competent authorities (CNIL and INDS) can refuse data processing requests based on this criterion. In 2016, under the auspices of the INDS, a legal interpretation<fnref n="77" /> of the notion enabled the identification of useful specifications for avoiding misunderstandings. This expertise provides that ‘public interest’ is a synonym of ‘general interest’ and ‘collective benefit’. Therefore, any uses essentially motivated by private purposes or aiming at re-identifying patients, or targeting prescription behaviours of health professionals for commercial purposes (e.g. in order to promote health products) are excluded from the public interest. The notion can be further understood by considering details provided

<footnote n="71">⁷¹ Ordonnance n°2018-1125, JORF 13 décembre 2018, Article 78.</footnote>

<footnote n="72">⁷² Décret n°2018-687 du 1er août 2018, op.cit. Article 23, Section 5; Article 100-1 of the consolidated version.</footnote>

<footnote n="73">⁷³ Article 66 LIL; Article L.1460-1 PHC.</footnote>

<footnote n="74">⁷⁴ Article 78 LIL ; see previous 40(II) old LIL.</footnote>

<footnote n="75">⁷⁵ Article 70 LIL.</footnote>

<footnote n="76">⁷⁶ Article 78 LIL.</footnote>

<footnote n="77">⁷⁷ Polton and Caillé (2017). In particular pp. 48–49 list forbidden or admissible acts regarding the requirement of public interest.</footnote>
within Article L.1461-1 (III) PHC dedicated to the SNDS, access to which is only granted to applicants pursuing the public interest. Without explicitly mentioning it, this Article states that SNDS makes available health data in order to contribute to the information on health and health service provision; on medico-social care and their quality; to the definition, implementation and assessment of public health and social protection policies; to the knowledge of health, social security and medico-social expenditures; to the information of professionals, structures and health or medico-social establishments on their activity; to health monitoring and safety; to research, studies, evaluation and innovation in the fields of health and medico-social taking in charge. Furthermore, Article 66(1) of the LIL explicitly identifies personal data processing implemented for ensuring a high level of quality and security of healthcare, drugs and medical devices as a public interest purpose. The CNIL can always consult the INDS to evaluate a public interest purpose.

# 5 GDPR Impact and Future Possibilities for Biobanking

## 5.1 French Specificities

French law integrates the GDPR and further develops individual rights on several points of interest for researchers.

First, the LIL states that personal data stored as research results are only accessible and modifiable by persons authorised by the data controller, in the respect of deontology. Personal data as research results must be anonymised before communication to third, except where the third's interest in the communication outweigh data subject's ones. In this regard the CNIL can approve anonymisation mechanisms.<fnref n="78" /> Then, anonymised data are no longer subject to the LIL.

Second, while the GDPR excludes its application to deceased persons, the LIL ensures privacy protection after a data subject's death with a new right to write and record advanced directives on personal data management. The directives will be implemented by a trustee identified by the data subject before his death or by a person designated by law. Here, the French legislator conceives of and protects the privacy of individuals as a continuum that death does not break. It is thus possible that a data subject can ask for restricted processing or erasure or, interestingly, to donate personal data from various sources to research organisations, which includes a biobank. These instructions shall be legally valid.

Data subjects' rights adaptations have been introduced to ease the implementation of RIHP2, T3 and other studies or assessments in the field of health that pursue a public interest purpose and involve minors. By derogation, Article 59 LIL allows prior information on the processing to be provided to only one of the holders of the parental authority if it is impossible to inform the other or if he/she cannot be consulted within a timeframe compatible with the specific methodological

<footnote n="78">⁷⁸ Article 8(II)(i) LIL.</footnote>
requirements of the research with regard to its purposes. This does not restrict the exercise, later on, by each holder of the parental authority, of the data subject's rights they have by law. Article 70 also enables new rights that increase the minor's autonomy in such research. The minor (aged 15 or more) may oppose the holders of parental authority receiving prior information about research participation where this leads to revealing information about an action of prevention, a screening, a diagnosis, a treatment or an intervention for which the minor expressly opposed the consultation of the holders of parental authority,<fnref n="79" /> or when family ties are broken and the minor personally benefits from appropriate insurance. The minor may also oppose data access exercised by the holders of parental authority to personal data collected during the project. The minor exercises his/her rights alone or accompanied by a major of his/her choice.

## 5.2 Perspectives Regarding Research and Biobanking

While a decree about national derogations from certain data subjects' rights under Article 89 GDPR is expected, France launched in 2016 its national plan for genomic-medicine<fnref n="80" /> with the aim of completing every year 200,000 human genome sequences. This will necessitate efforts in terms of samples and data storage and processing capacities but also a clear and appropriate legal and ethical framework. These new activities, plus the current revision of the bioethics law, highlight the new challenges for research biobanking.

A first set of challenges relates to the development of new techniques in genomics and the future capability to store and use bigger sets of genomic data in the form of Whole Genome/Exome sequencing. The CCNE<fnref n="81" /> and the State Council<fnref n="82" /> have taken a position on this matter, both favouring the practice of ‘enlarged informed consent’ or ‘consent by delegation’ based on the monitoring functions of competent and independent trusted third parties<fnref n="83" /> for genetic research, notably for the purpose of reuse of data. Of course, both acknowledge the need to ensure respect for the fundamental rights of individuals involved in such research and that there will be some difficulty to enforce those rights during the duration of the research. As such, they proposed to rely on new mechanisms involving either research ethics

<footnote n="79">⁷⁹ In application of articles L.1111-5 and L.1111-5-1 PHC.</footnote>

<footnote n="80">⁸⁰ Aviesan. Genomic Medicine France 2025. https://www.aviesan.fr/mediatheque/fichiers/version-anglaise/actualites-en/genomic-medicine-france-2025-web.</footnote>

<footnote n="81">⁸¹ CCNE, Avis 129, 2018. https://www.ccne-ethique.fr/sites/default/files/avis_129_vf.pdf. See p. 67.</footnote>

<footnote n="82">⁸² Conseil d'Etat (2018). Révision de la loi de bioéthique: quelles options pour demain? 28 June 2018. https://www.conseil-etat.fr/ressources/etudes-publications/rapports-etudes/etudes/revision-de-la-loi-de-bioethique-quelles-options-pour-demain. See p. 157.</footnote>

<footnote n="83">⁸³ E.g. Research ethics committees. Biobanks' internal independent review mechanisms could qualify.</footnote>
committees or an independent trusted third party in conjunction with supplying a
high level of information of participants. However, the Council rejected solutions
such as broad unspecified consent and dynamic consent because of their legal or
technical implications (see footnote 10).

A second set of issues relates to research on human embryos, notably the cre-
ation, in research, of transgenic, chimeric embryos; the use of induced pluripotent
stem cells and their ethical impact on the use of ‘natural’ human embryos; and the
need to recognise by law the 14-day deadline limiting embryo cultures in research.
A final challenge is the upcoming debate from a collective perspective of the impli-
cations of the production and use of large datasets through artificial intelligence or
genetic testing/sequencing to be routinely provided in the health care system and/or
commercially. This should take in their negative effects on solidarity, equality, the
risk of genetic reductionism, stigmatisation and discrimination.

6 Conclusions

Currently, the French regulatory environment for research biobanking remains com-
plex and fragmented due to the fragmented nature of the legislation to comply with.
Data protection law is a common feature of any type of health research and biobank
processing of personal data, whether the latter are attached to, or generated from, a
biological sample, with a risk-based approach for identifying requirements to be
met by researchers and biobankers. The GDPR has been fully implemented, with
the potential for further developments offered by its Article 89. We acknowledge the
efforts made by the CNIL to provide operators with explanatory and practical tool-
kits that ease both procedures and GDPR-compliance. CNIL action is pragmatic
and proactive, which are good qualities that can be used by DPO networks for the
purpose of boosting the understanding and adoption of a data protection culture, and
will lead to innovations in data protection.

Nevertheless, we think that important deficiencies remain in biobanking regula-
tion. The very specific role of biobanks is not fully addressed or recognised and
some contexts of biobanking need further regulatory clarification. Thus, we call for
the elaboration of a French Biobank Management Act to compile and develop fur-
ther the rules applicable to research biobanking that would consider existing and
new issues encountered by operators and the views of citizens.

References

Borella L, Dupont M, Hebert JC, Janin A, Lubin R. Pour l'INCA (2006) Charte Ethique des Tumorothèques. Ed. 2010

Clément B, Duyckaerts C, Hauw JJ, Ardaillou R (2019) Rapporteurs au nom de la Commission Biologie-génétique-technologie biomédicales. Académie Nationale de Médecine. Rapport. Sustainability of biological resource centres: a major challenge for biomedical research
Polton D, Caillé Y (2017) Cabinet Simmons & Simmons, pour l'INDS. Expertise juridique sur l'intérêt public dans le contexte des données de santé. V.2

Roche T (2018) Delsol Avocats. Article. ePub. Les coordonnées du DPO du promoteur ne doivent pas figurer sur les fiches d'information destinées aux personnes se prêtant à des recherches cliniques ! http://www.delsolavocats.fr/sdv/en/les-coordonnees-du-dpo-du-promoteur-ne-doi-vent-pas-figurer-sur-les-fiches-dinformation-destinees-aux-personnes-se-pretant-a-des-recherches-cliniques/

Sariyar M, Schlünder I (2016) Reconsidering anonymization-related concepts and the term “identification” against the backdrop of the European legal framework. Biopreserv Biobank 14(5):367–374

Société Française de Microbiologie (2014) Manuel de Sécurité et de Sûreté Biologiques, 1st edn. ISBN: 978-2-87805-030-1

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

<figure><img src="image_3.png" /></figure>