1. Introduction: The Biobank Rights Enforcement Deficit

“Why should I fill in your questionnaire; if I don’t get to see what’s in it for me?”[1]

The rights of population biobank participants – to consent, to withdraw, to govern, to own, to share in the benefits, to feedback and to view their data (what we can term “biobank rights”) – have been discussed in many papers.[2] They have also been the subject of many guidelines.[3] Some rights have even been written into law.[4] To date, however, this body of papers, guidelines and law on the books has only produced “rights on paper.” It has failed to deliver the means by which biobanks can empower participants to actually and readily enforce their rights. Worse, some rights on paper are denied in practice, as their enforcement is claimed to require a disproportionate effort on the part of the biobank, which is typically funded for sample and data collection only, not for communications with participants.

This “enforcement deficit” is hard to justify in and of itself, but even harder in light of developments in information and communication technology (IT). Just as IT has been instrumental in reducing the effort required to build and use large-scale biobanks, that same technology may be deployed to empower biobank participants to enforce their rights in those biobanks. Recently, the concept of digital enforcement of rights was also adopted by the EU legislator in the European General Data Protection Regulation (GDPR).[5] Recital 59 of the GDPR provides that modalities should be provided for facilitating the exercise of the data subject’s rights under the GDPR, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller (e.g. a biobank) should also provide means for requests to be made electronically, especially where personal data are processed by electronic means.

In this paper, we describe a project which has done just that, by building an online application to elevate biobank participants’ rights from paper to portal.[6] We discuss the issues we encountered, as well as the unexpected benefits of the application for the biobank. The source code of our application, which is now part of the Netherlands Biobanking and Biomolecular Research Infrastructure (BBMRI-NL)[7] is, under certain conditions, available to population biobanks worldwide. We submit that rather than invoking the traditional statutory research exemption to fend off the exercise of biobank rights, biobanks might want to move forward and use IT to enhance their participants’ rights by building them into their infrastructure through an online portal, a move which has not escaped the notice of Nature.[8]

2. Building Biobank Rights into the Biobank Infrastructure

Our project was funded by BBMRI-NL. The remit of BBMRI-NL is to build a biobanking research infrastructure, with due regard to the associated legal issues. Rather than funding traditional legal research, BBMRI-NL chose to explore the building of a legal infrastructure, as a complement to its research infrastructure, for several reasons.

First, to walk the talk. It was considered ethically untenable to build a sustainable research infrastructure on the back of data and samples of participants without offering them a proper place in this infrastructure. Second, to maintain trust. In order to maintain trust, biobanks have to address the current asymmetry between high-tech digital biobanks on the one hand and participants with pen, paper and stamped envelopes on the other hand. Third, because biobanks now can. Current legislation qualifies the unabated enforcement of biobank rights, partly on the ground that honouring such rights poses a disproportionate burden on the biobank. Developments in IT now challenge this assertion somewhat, although IT solutions will require additional funding. Fourth, to face Facebook. Developments in social media enable further empowerment of research participants and have raised the expectations of new generations of biobank participants, as regards the availability, transparency, tracking, tracing, sharing, linking, logging and controlling of their data.[9] Denying biobank participants the settings, options and tools they can readily exercise on social media platforms (on which they may share data that is just as sensitive as the data they provide to a biobank) might become increasingly hard to justify. Fifth, to promote personal health management: connecting biobanks and their participants through a portal could foster the advent of personalised medicine, personalised public health and the integration of research and cure. Sixth, to enhance self-reporting into the biobank.  Establishing a two-way online communication channel between biobanks and their participants would open up avenues for uploading and tapping quantified self-data. Seventh, to show society value for tax money. While it does not constitute a patent, a product or a spin-off company, an application for feedback and access to personalised health information does represent value for the biobank participants. As such, it would help biobanks meet the societal requirement that their datasets and scientific output be valorised for the benefit of the public. Finally, to be compliant. As discussed above, the recently adopted EU General Data Protection Regulation provides that controllers of personal data (such as biobanks) shall facilitate the exercise of data subject rights. In the Chapter on Transparency and Modalities, the GDPR lists a series of data subject rights which could be of relevance to biobanks processing personal data, such as the right to information, right to (withdraw) consent, the right of access and the right to erasure (“right to be forgotten”).[10] Notably, the Regulation allows for derogations from these rights in the context and in the interest of scientific research; however, only in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

3. MyBiobank

In order to enable the transformation of a static, one-off biobank-participant relationship into a dynamic, ongoing participation, BBMRI-NL decided to enhance the rights of biobank participants by developing an application in the form of a portal: “MyBiobank.” This application should enable biobank participants to actually and readily enforce their biobank rights. The concept of biobank rights-enhancing technologies is rooted in data protection law, which proscribes the use of so-called “Privacy Enhancing Technologies” (PET) to help meet the goal of the law, i.e. to protect personal data against unauthorised use. In our project, we explored the potential application of the concept of PET to other biobank rights, such as the right to consent and the right to withdraw, by developing Consent Enhancing Applications; the right to access, correct and supplement data, by developing “Access Enhancing Applications”; and the right to feedback, by developing “Feedback Enhancing Applications.” Evidently, the application was to meet certain fundamental IT requirements pertaining to authentication, verification, data-integrity and security.

The portal was developed for the Netherlands Twin Register (NTR). Established in 1987 at the Vrije Universiteit Amsterdam, the NTR prospectively studies twins and their family members to gain insights into the influence of genes and environment on the development, health and behaviour of children (e.g. motor development, school achievement, behavioural problems such as anxiety and ADHD), and on outcome variables in adolescence and adulthood, including somatic and mental health (diabetes, depression), lifestyle, personality and ageing. NTR participants take part in surveys and other studies, including a large biobank project, and data of more than 70,000 young twins and their siblings have been collected from their teachers and parents. In older adolescents and adults, data have been collected in over 25,000 twins, their siblings, spouses, parents and adult offspring over a period of 25 years.[11]

4. Approach

To develop the portal, we took the following approach. First, we mapped the data content, IT architecture, information streams, wishes, obligations, possibilities and impossibilities of the NTR. Secondly, we identified the participant’ biobank rights through legal analysis of the pertinent statutes, regulations, case law and consent forms. Thirdly, we converted these rights into a set of legal specifications for the “MyBiobank-App.” This web application was then designed, tested, pre-released, and validated, including users’ tests, as per the technical specifications. We secured compliance with fundamental IT requirements pertaining to authentication, verification, data integrity, and data security. Finally, the design was set up in such a way as to allow for easy roll-out over other population biobanks and so become an integral part of the BBMRI infrastructure in the Netherlands and the European Union.

5. Use Cases

The functional design of the system was built on the basis of a number of use cases, which distinguished between two perspectives: the NTR Participants and the NTR Researchers, the latter including both researchers and IT personnel. From the participants’ perspective, the portal was intended to enable the following: to provide a secure, personal website; to enable access to prepared reports on research findings; to view resultant publications; to get an overview of pending and completed questionnaires; to link to active questionnaires; and to update contact details for administrative purposes. From the researchers’ perspective, the portal was intended to provide a safe, administrative web environment, a channel for communication (e.g. to report changes in address), access for participants to new surveys and questionnaires, linking publications to a participant’s participation in particular studies, linking publications to studies and an SSL-certified website with sound digital rights management and no online storage of identifying data, using open source software and open standards.

6. Legal Specifications

Based on the legal analysis of the pertinent statutes, regulations and case law, we mapped the features that a portal for population cohorts and biobanks would have to offer in general. This initial design of a generic template would have to include the functionalities set forth in Table 1:

Table 1. Initial design for digital biobank rights portal.

MyBiobank | Account | Log in (username-password) | Contact | Search | RSS Alerts
ACCESS TO PARTICIPANT’S BIOBANK DOCUMENTATION	FEEDBACK OF PHYSICAL MEASUREMENTS	FEEDBACK OF STUDY OUTCOMES & ACCESS TO QUESTIONNAIRE DATA	UPDATES OF QUESTIONNAIRE DATA	INFORMATION & CONSENT FOR NEW STUDIES
– Biobank Information Letter; – Biobank Protocol; – Participant Recruitment Letter; – Biobank IRB approval; – Consent Letter (template).	Survey outcomes: e.g. scores on personality scales. Physical measurements, e.g. blood pressure, cholesterol, BMI, ECG, cholesterol, blood pressure	– Overall study results based on the data collected among participants – Odds ratios derived from genetic data; – Overview of completed questionnaires and projects, aggregate results, publications and statistics.	– Invitation to new online questionnaires – Online submission of questionnaires.	Access to completed and current studies; Invitation to new studies; – study information; – research ethics committee approval; – study information – (re-)consent; – consent for Record Linkage to health registries.

7. Legal Complications

We then applied the legal requirements in this generic template to the specific characteristics of the NTR. We found that the generic design had to be amended in various aspects, reflecting the nature of the data present in the NTR, the outcome of further legal analysis, technical requirements and policy considerations, as summarised below.

7.1 The right not to know

As to the legal specifications, the design of the portal had to take into account (and in fact, was to be built upon) the “right not to know.”[12] Consequently, the application is set up in such a way that it is up to the participants to decide whether they want to access their data. The application contains various layers prior to providing access to participants’ personal data to make sure the right not to know is respected. Further, the portal had to contain a disclaimer to make clear to participants that the portal is not a substitute for their own healthcare providers.

7.2 Pull, no pushing

The Dutch law on the doctor-patient contract and ancillary laws on the provision of medical (specialist) care and counselling restrict the provision of medical counsel and care to qualified healthcare providers (e.g. genetic counselling is restricted to a limited number of certified academic centres). A population biobank is, typically, not a qualifying doctor and its participants are not (yet) patients with an expressed demand for care, so rather than pushing the information, the architecture of the portal reinforces the concept that participants who so desire, can “pull” the information from the portal.

7.3 No genetic data

As per the signed consent forms, the NTR does not provide feedback on genetic data. The rationale for this non-disclosure policy is that feeding back genetic test results to biobank participants would require the biobank to assume the role of a clinical geneticist. Statutory standards of clinical care would require results that are analytically and clinically valid and have clinical utility. The assessment of analytical validity would require the performance of independent confirmatory testing. Clinical validity refers to the quality and quantity of empirical evidence regarding the association between a genotype and a particular clinical outcome. The interpretation of reported associations requires a chain of evidence substantiating the validity of the association found in a single initial study.[13] Results that do not meet this basic prerequisite do not constitute “information.”[14] In addition, the broad array of new genome-scale tests has led to the discovery of multiple abnormal or “unexpected findings” that are analogous to the so-called “incidentalomas” that are often discovered in radiological studies.[15] Lacking clinical competence and professional clinical qualifications, biobank researchers would be overwhelmed by the complexity of pursuing all sorts of genomic measures. And, as even regular healthcare providers lack training and expertise in the interpretation of genetic research results, a biobank participant might be subjected to iatropic pathology, including multiple unnecessary follow-up tests. In view of the foregoing, no genetic data is fed back to the participants through the portal.

7.4 The right to withdraw

The thorniest legal issue was the right to withdraw. The right to withdraw is a fundamental right in biomedical research, but current Dutch law provides for a research exemption, to the effect that the right to have personal data erased from historic, statistical and scientific databases is qualified. The NTR does allow its participants to withdraw from the study, by a written statement by regular mail or email. Providing participants with a digital button to withdraw their consent to participation and their personal data would expose the datasets to the risk of being depleted by a mouse click. This would compromise not only data integrity, but also scientific rigour and justifiable demands for replication of findings. To uphold data integrity and scientific standards, therefore, it was agreed to leave the withdraw feature out of the portal, a decision which can be legally justified with reference to the statutory research exemption and which left the participants’ “paper right” to withdraw intact. These legal and policy considerations seem to fall in line with similar room for derogations of the right to erasure laid down in the EU General Data Protection Regulation. Pursuant to Article 17 of the GDPR, a data subject (e.g. a biobank participant) shall have the right to obtain from the data controller (the biobank) “the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.”[16] This right shall not apply, however, to the extent that processing is necessary for scientific research purposes, in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing.[17] As granting participants a right to have their personal data erased from its datasets could seriously impair the objectives of the NTR – a fortiori when such a right could be exercised electronically – it was left out from the eventual design of MyBiobank.

7.5 Disclaimer

Last but not least, the portal was to avoid “therapeutic misconception”[18] by the participants. As discussed above, the participants’ biobank is not their doctor (or at least not yet). To that end, a disclaimer was written into the portal, at various stages of the viewing process, the pertinent part of which reads as follows:

DISCLAIMER

… [I]n addition, please be advised that the reports amount neither to a medical diagnosis, nor to a medical prognosis, nor to the outcome of a population screening. If you have any complaints about your physical or mental health, you should contact your doctor. Participating in the Netherlands Twin Register and/or viewing your personal reports in MyBiobank is not a substitute for a visit to your doctor and not a substitute for your participation in a population screening programme.[19]

8. Twin (Family) Complexities

The legal complications for cross-sectional, non-family based studies were further compounded by the complexities of biobank studies that are carried out in families or in pedigrees, where data on one family member can be informative about the health risks of relatives, and by complexities in longitudinal projects. In twin families, the assessment of zygosity applies to both twins from a pair, though one of the twins may not want to be informed about the outcome. In projects that involve children, the issue is whether children are allowed to view the data provided about them by their parents. Is one parent allowed to view the data provided by the other parent? And how is this affected when children have reached adulthood? Making autonomy and privacy the overriding principles, it was decided that each individual would get access to the data he or she provided to the biobank. The parents of children will only receive information pertaining to what they have provided to the database themselves and their offspring will likewise only be able to access information they provided themselves. Of course, if family members want to, they can always compare their results, but whether they do so is their own decision.

9. Results

On 10 February 2013, at a festive weekend celebrating 25 years of NTR, a beta version of the MyBiobank portal was presented to the NTR participants and many visitors indicated they looked forward to receive their login. The results can best be summarised in the form of the screenshots of the final version of the portal as it was approved for release on 1 July 2013 (Figure 1).

Figure 1. A concept version of the MyBiobank (MyNTR) portal. (a) Shows the overview participants see when they log into the MyNTR portal. They have the option to continue to their latest individual reports, the latest description of general research findings or continue to the questionnaire that is still open for completion. (b) Presents an overview of general research findings; in this particular example about migraine. (c) Shows an example of a personalised report that is based on data provided by the participants. For a full demonstration of the most recent version of the portal, the reader is encouraged to refer to the NTR website (http://www.tweelingenregister.org/portaldemo-en/).

 

To date, approximately 15,000 participants have been invited to log-in to the portal and almost half of them have activated their access. Participants’ responses have been very positive, with some sending emails to express their appreciation for the personal feedback. In the near future, the NTR will start a systematic study among their participants regarding their opinion and use of the MyBiobank portal.

10. Next Steps

As both biobanks and biobank rights continue to evolve, MyBiobank is a work in progress and so is the science that provides its foundation and content. For example, as biobanks are being filled with a whole range of omics data, one day the portal could even help promote personal omics profiling, which is expected to benefit from combining genomic information with regular monitoring of physiological states by multiple high throughput methods.[20] Also, new technologies enable increasingly detailed forms of quantified self-reporting by participants. And as the role of the patient in medical research is expanding,[21] so might the role of the participant in biobank research. To keep track, the NTR will start monitoring uses and experiences among participants and researchers and seek ways for further enhancement. In addition, regulatory developments might call for further development, as the new EU General Data Protection Regulation grants upgraded control rights to data subjects over their personal data, notably the right to be forgotten and the right to data portability. To meet these challenges, BBMRI-NL has decided to fund the further development of MyBiobank, which started at the end of 2015.

11. Source Code

The portal was designed and built open source and as such is available for use by third party population biobanks, subject to the agreement on the mode and terms of implementation.[22]

12. Conclusions

To enable a more active involvement of participants in research, thereby addressing their rights as a participant, we designed and delivered a Biobank Rights Portal entitled “MyBiobank.” MyBiobank enables participants in a population biobank: (i) to actually enforce their biobank rights (such as consent, information, information feedback, privacy, governance, and benefit sharing), with due regard to the statutory exemptions to these rights; and (ii) to enrich the biobank through self-reporting. On the flipside, MyBiobank provides biobanks with an online tool: (i) to reduce time and costs of organising and distributing questionnaires; (ii) to honour biobank rights and meeting statutory requirements; (iii) to build and maintain trust and transparency among participants, researchers, research ethics committees, supervisory authorities, funders and the public; (iv) promote participant engagement; (v) to “valorise” findings, knowledge and data; and (vi) to share benefits with participants by providing them with a digital avenue to get to see “what’s in it for him or her.” The current portal has been met with enthusiasm by participants and researchers alike. It will be further developed in response to technological progress, possibilities and social preferences regarding feedback of genetic information, as well as in response to novel regulatory requirements (notably the new EU General Data Protection Regulation), which demand additional control by data subjects over their personal data.

Acknowledgements

This research and development was financially supported by BBMRI-NL, a Research Infrastructure financed by the Dutch government (NWO 184.021.007).

---

 

[1] Anonymous (question asked by a participant in the Netherlands Twin Register).

[2] A Cambon, E Rial-Sebbag and BM Knoppers, “Trends in Ethical and Legal Frameworks for the Use of Human Biobanks” (2007) 30 European Respiratory Journal 373-382.

[3] OECD, Guidelines for Human Biobanks and Genetic Research Databases (HBGRDs) (2009) available at http://www.oecd.org/science/biotech/44054609.pdf (accessed 30 Apr 16).

[4] See e.g. Human Genes Research Act of the Republic of Estonia, available at https://www.riigiteataja.ee/en/eli/531102013003/consolide (accessed 30 Apr 16). For a discussion of the recent Biobank Act of Finland (688/2012), see J Stjernschantz and S Soini, “A Big Step for Finnish Biobanking” (2014) 15 Nature Reviews Genetics 6.

[5] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

[6] For a similar project focusing on dynamic consent, see C Pattaro et al, “The Cooperative Health Research in South Tyrol (CHRIS) Study: Rationale, Objectives, and Preliminary Results” (2015) 13 Journal of Translational Medicine 348.

[7] BBMRI-NL, available at https://www.bbmri.nl/ (accessed 30 Apr 16). The Biobanking and BioMolecular resources Research Infrastructure – European Resources Research Infrastructure Consortium (BBMRI-ERIC) is a European organisation established under the ERIC legal framework, funded by yearly membership fees. Members of BBMRI-ERIC are Member States, third countries, as well as intergovernmental organisations. The purpose of BBMRI-ERIC is to establish, operate and develop a pan-European distributed research infrastructure of biobanks and biomolecular resources in order to facilitate the access to resources as well as facilities and support high quality biomolecular and medical research.

[8] Nature (Editorial), “Privacy in the Digital Age” (2013) 497 Nature 287, available at http://www.nature.com/news/privacy-in-the-digital-age-1.12978 (accessed 30 Apr 16).

[9]  J Kaye et al, “From Patients to Partners: Participant-Centric Initiatives in Biomedical Research” (2012) 13 Nature Reviews Genetics 371-376.

[10] See note 5 above.

[11] G Willemsen et al, “The Adult Netherlands Twin Register: Twenty-Five Years of Survey and Biological Data Collection” (2013) 16 Twin Research and Human Genetics 271-281.

[12] See e.g. R Chadwick, M Levitt and D Shickle, The Right to Know and the Right Not to Know: Genetic Privacy and Responsibility, 2nd ed (Cambridge: CUP, 2014).

[13] V Ravitsky and BS Wilfond, “Disclosing Individual Genetic Results to Research Participants” (2006) 6 American Journal of Bioethics 8-17.

[14] JA Bovenberg et al, “Your Biobank, Your Doctor? The Right to Full Disclosure of Population Biobank Findings” (2009) 5 Journal of Genomics, Society and Policy 55-79.

[15] IS Kohane, DR Masys and RB Altman, “The Incidentalome: A Threat to Genomic Medicine” (2006) 296 Journal of the American Medical Association 212-215.

[16] See note 5 above, Article 17 (1).

[17] Ibid, Article 17 (3)(d).

[18] PS Appelbaum et al, “False Hopes and Best Data: Consent to Research and the Therapeutic Misconception” (1987) 17 Hastings Center Report 20-24.

[19] JA Bovenberg et al, “Disclaimer” (2012), available for registered users at http://www.mijnntr.nl (accessed 30 Apr 16) (translated from Dutch).

8) R Chen et al, “Personal Omics Profiling Reveals Dynamic Molecular and Medical Phenotypes” (2012) 148 Cell 1293-1307.

[21] M Anderson and K McCleary, “On the Path to a Science of Patient Input” (2016) 8 Science Translational Medicine 336.

[22] Please address any inquiries in this respect to Jasper Bovenberg at jabovenberg@xs4all.nl.