The GDPR and the research exemption: considerations on the necessary safeguards for research biobanks.

The General Data Protection Regulation (GDPR) came into force in May 2018. The aspiration of providing for a high level of protection to individuals' personal data risked placing considerable constraints on scientific research, which was contrary to various research traditions across the EU. Therefore, along with the set of carefully outlined data subjects' rights, the GDPR provides for a two-level framework to enable derogations from these rights when scientific research is concerned. First, by directly invoking provisions of the GDPR on a condition that safeguards that must include 'technical and organisational measures' are in place and second, through the Member State law. Although these derogations are allowed in the name of scientific research, they can simultaneously be challenging in light of the ethical requirements and well-established standards in biobanking that have been set forth in various research-related soft legal tools, international treaties and other legal instruments. In this article, we review such soft legal tools, international treaties and other legal instruments that regulate the use of health research data. We report on the results of this review, and analyse the rights contained within the GDPR and Article 89 of the GDPR vis-à-vis these instruments. These instruments were also reviewed to provide guidance on possible safeguards that should be followed when implementing any derogations. To conclude, we will offer some commentary on limits of the derogations under the GDPR and appropriate safeguards to ensure compliance with standard ethical requirements.

Analysis of state laws on informed consent for clinical genetic testing in the era of genomic sequencing.

This article assesses the adequacy of informed consent to clinical genetic testing laws based on an examination of 15 states with institutions that had been involved in a National Institutes of Health-supported Clinical Sequencing Exploratory Research Consortium project. We identified relevant statutory provisions through a legal search engine and included statutes that describe the informed consent requirements for clinical genetic testing and/or the protections for genetic material, information, or data. We found that statutory definitions were often limited in problematic ways, such as focusing only on variants known to be associated with disease or negative health effects or associated with asymptomatic disease. Some statutes required complex levels of detail if applied to genomic technologies and set confusing disclosure standards for current use and future access. Others had exceptions from informed consent requirements for future research use, limited requirements for the destruction of specimens as opposed to derived data, or linked key definitional components to the evolving concept of "identifiability." Further reform and research are needed to ensure that state law protections advance as rapidly as the science they aspire to enable.

One small edit for humans, one giant edit for humankind? Points and questions to consider for a responsible way forward for gene editing in humans.

Gene editing, which allows for specific location(s) in the genome to be targeted and altered by deleting, adding or substituting nucleotides, is currently the subject of important academic and policy discussions. With the advent of efficient tools, such as CRISPR-Cas9, the plausibility of using gene editing safely in humans for either somatic or germ line gene editing is being considered seriously. Beyond safety issues, somatic gene editing in humans does raise ethical, legal and social issues (ELSI), however, it is suggested to be less challenging to existing ethical and legal frameworks; indeed somatic gene editing is already applied in (pre-) clinical trials. In contrast, the notion of altering the germ line or embryo such that alterations could be heritable in humans raises a large number of ELSI; it is currently debated whether it should even be allowed in the context of basic research. Even greater ELSI debates address the potential use of germ line or embryo gene editing for clinical purposes, which, at the moment is not being conducted and is prohibited in several jurisdictions. In the context of these ongoing debates surrounding gene editing, we present herein guidance to further discussion and investigation by highlighting three crucial areas that merit the most attention, time and resources at this stage in the responsible development and use of gene editing technologies: (1) conducting careful scientific research and disseminating results to build a solid evidence base; (2) conducting ethical, legal and social issues research; and (3) conducting meaningful stakeholder engagement, education and dialogue.

Rules for processing genetic data for research purposes in view of the new EU General Data Protection Regulation.

Genetic data contain sensitive health and non-health-related information about the individuals and their family members. Therefore, adopting adequate privacy safeguards is paramount when processing genetic data for research or clinical purposes. One of the major legal instruments for personal data protection in the EU is the new General Data Protection Regulation (GDPR), which has entered into force in May 2016 and repealed the Directive 95/46/EC, with an ultimate goal of enhancing effectiveness and harmonization of personal data protection in the EU. This paper explores the major provisions of the new Regulation with regard to processing genetic data, and assesses the influence of such provisions on reinforcing the legal safeguards when sharing genetic data for research purposes. The new Regulation attempts to elucidate the scope of personal data, by recognizing pseudonymized data as personal (identifiable) data, and including genetic data in the catalog of special categories of data (sensitive data). Moreover, a set of new rules is laid out in the Regulation for processing personal data under the scientific research exemption. For instance, further use of genetic data for scientific research purposes, without obtaining additional consent will be allowed, if the specific conditions is met. The new Regulation has already fueled concerns among various stakeholders, owing to the challenges that may emerge when implementing the Regulation across the countries. Notably, the provided definition for pseudonymized data has been criticized because it leaves too much room for interpretations, and it might undermine the harmonization of the data protection across the countries.