BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £5, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!

Elisa Stefanini*

 

1. Introduction

There is no general legal framework applicable to biobanks for scientific research in Italy. In fact, the existing legislation only applies to the collection of tissues, blood and organs for human applications.1

Indeed, the applicable regulations come mainly from soft law such as non-binding recommendations of international organisations or opinions of international and national ethics committees or guidelines issued by medical and scientific associations. In particular, in the Italian context, considering that the amount of human samples and personal data collections are growing, these associations are attempting to create a regulatory framework to guide research and to increase confidence about the ethical principles and the rights of participants in genetic research.

In this regard, first of all the Guidelines on Genetic Biobanks issued in 2003 by the Italian Society of Human Genetics must be mentioned,2 since this document offers the main definition of “genetic biobank”,3 explains the purposes and benefits for the community, illustrates the ethical issues, with particular reference to consent and data protection issues and establishes the minimum organisational requirements and services that a biobank has to provide for the scientific community. This document is not binding but it can be considered as a point of reference in determining the eventual liability of the biobank in case of damages occurring to people involved in the research.

The same issues have been addressed by the Guidelines for the Institution and Certification of Biobanks, issued in 2006 by the National Committee for Biosecurity and Biotechnology,4 which provides uniform criteria for obtaining quality certification. The application of these criteria can turn small isolated collections into organised entities that can be considered “biobanks”.5 The same committee more recently (16 February 2009) issued advice on informed consent in the context of the collection of human samples for scientific purposes. All these documents aim to create positive conditions for research in the respect of rights and guarantees of the people involved while waiting for the government to step in to create specific regulations.

The only issue currently addressed by Italian law is data protection, since the functioning of a biobank normally implies the processing of personal data, especially medical and genetic data. This regulation was put in place by the General Authorisation for the processing of genetic data, issued by the Italian Data Protection Authority on 22 February 2007 (hereafter “General Authorisation”, see para 3) on the ground of section 90 of the Italian Data Protection Code (Legislative Decree 196/2003).6 The physical dimension of a biobank, as recipient of biological samples, has however never been autonomously considered.

The lack of clear and univocal regulations effects genetic research in Italy. Researchers identify the more critical issues as the singling out of subjects who are entitled to dispose of the samples, whether the scientific entities carrying out the research or the individuals from which the samples have been taken, and in the possible uses of these samples with the relevant eventual limitations. The answers to these questions go through an analysis of the meaning and the scope of the consent of the patients involved in each research project.

The purpose of this paper is to examine the consent issue in the context of genetic research and functioning of biobanks in Italy and to underline that what is especially necessary is an organic regulation that can resolve most of the uncertainty that burdens scientific research in Italy and that starts from the most basic concepts and definitions that are relevant to the issues concerned.

2. The Consent Issue in the Context of Scientific Research on Human Tissue Samples

Regarding genetic research carried out on human samples stored in biobanks, the consent issue must be analysed with respect to two different activities: the collection of human tissue samples from a patient and their storage.

Participation in a genetic research project generally implies the processing of genetic information but not always the taking of tissue samples. In fact, samples could previously have been taken for different purposes, especially in connection with a medical treatment and subsequently used for scientific research.

Therefore, we need to distinguish between two different situations:

1. When human samples have to be taken with the direct purpose for use in a specific research project;

2. When samples come from collections of tissues collected for medical purposes and kept by hospitals or other medical facilities.

With respect to these situations, two different kinds of consent, protecting different rights of the individual, have to be considered: the first one is “informed consent” to the medical treatment consisting in the taking of the sample. The second is consent to the processing of personal, sensitive and genetic data connected to the carrying out of the scientific research project.

In theory, the distinction between the consent to the sample taking and the consent to the data processing is evident. In practice, it is not always clear whether the consent obtained relates to the use of tissues or data or both, especially when there is just one form where the individual consents to participation in a research project.

2.1 The Principle of “Informed Consent” in the Context of Genetic Research

“Informed consent” derives from the principle of self-determination in the medical context – that is a declination of the right to personal liberty. In the West particularly there is:

[A] strong moral conviction grounded on the notion of human dignity and respect for individual autonomy, that everyone has the right to self-determination with respect to his/her body. And this conviction has been translated into a legal recognition that every person has the right to have his or her bodily integrity protected against invasions by others, and in the legal rule that consent must precede any such touching.7

So, regardless the purpose, medical or scientific, no one can undergo any medical treatment without having expressed his or her previous consent: otherwise, the activity of the physician constitutes an actionable assault.8 The right to personal integrity, both physical and psychological, was also considered as an international human right by the European Court for Human Rights in 2004.9

In the Italian legal system, the principle of informed consent in medical practice derives directly from section 32 of the Italian Constitution, which provides that no one can be obliged to undergo any medical treatment except under provisions of law. This section has to be read in connection with section 13 about the right to personal liberty, according to which “No one may…be subject to any restriction of personal liberty except by order of the Judiciary stating a reason and only in cases and with modalities provided for by law”.10 Therefore, section 32 can be regarded as a specification of section 13 in the medical context, as a means of improvement of the individual’s self-determination with regard to his or her own body.11

The principle of informed consent was also enunciated by law, especially in section 3 of Law 23 December 1978, n 833, concerning the establishment of the national sanitary service, according to which all medical treatments are voluntarily-based. Finally, section 35, paragraph 1 and section 38 of the Italian Code of Medical Ethical establish the obligation of the physician to respect the patient’s will, except in exceptional cases of urgency:12 this is a non-binding regulation, but it is very important to measure the duty of care of the physician in case of contention.

However, when samples come from collections of tissues taken for medical purposes and kept by hospitals or other medical facilities, most of time the informed consent of the patient for the use of his or her sample for scientific purposes is missing. In Italy, there is no provision of law which specifically regulates the eventual reuse for scientific purposes of human samples already taken from patients for therapeutic reasons and stored in hospitals or other medical centres, so the informed consent issue in this context is not addressed. Therefore, researchers do not know what actions can be taken, and especially, whether they have to contact the patients from whom samples have been taken and to obtain their informed consent. In most cases, this activity would be very difficult and onerous, and sometimes completely impossible (for example, if the patient has since died).

At the international level, the criterion chosen to establish whether informed consent for carrying out scientific research on human samples is necessary is the possibility of identifying the patient from which the sample was taken. This approach is embraced by the Declaration of Helsinki, according to which “for medical research using identifiable human material or data, physicians must normally seek consent for the collection, analysis, storage and/or reuse” (principle 25). Similar provisions are included in the Oviedo Convention, issued by the Council of Europe in 1997, where section 16 expressly requires the consent of the individual to participation in any scientific research and section 22 states that “when in the course of an intervention any part of a human body is removed, it may be stored and used for a purpose other than that for which it was removed, only if this is done in conformity with appropriate information and consent procedures”. However, even when Italy ratified the Oviedo Convention with Law 28 March 2001, n 145, it did not depose of the instruments of ratification; therefore, the process is not complete, and the government has not still issued the necessary decrees to implement the Convention in the Italian legal system.13

According to such an approach, as long as the research is carried out on identifiable human samples, it must be considered as research on individuals. Therefore, in such cases, the informed consent of the individual for participation in a genetic research project shall always be present as basic principle of legitimacy.

Nevertheless, this can be challenged by a legal point of view which considers the rights and values that the principle of informed consent aims to protect. In fact, this principle protects the right of the individual to the self-determination regarding his or her health.14 Therefore, it has to be applied when a sample is taken from the patient, but it is not required for the use of the sample for scientific purposes which have no effect on the patient’s health.

However, another interpretation could be supported: as long as sections 13 and 32 of the Constitution protect the right of self-determination of the individual regarding his or her body, this right could exist regardless of any possible impact on the individual’s health. Should this interpretation be agreed, the principle of informed consent should be always applied in order to respect the individual’s right to self-determination.

Furthermore, another interest of the tissue originator also needs to be protected, that is, the right to keep control over the genetic information which can be extracted from his or her sample. A different kind of consent is to be required to respect this right.

2.2 Consent to Processing Genetic Data for Genetic Research

The second kind of consent is the consent to the processing of personal, sensitive and genetic data. In fact, as long as the research is carried out through the utilisation of genetic data and other personal data, the data protection legislation is applied.15 According to section 4(b) of the Data Protection Code, personal data is “any information relating to natural or legal persons, bodies or association that are or can be identified, even indirectly, by reference to any other information including a personal identification number”.16 Moreover, to assess whether data is regarded as identifiable, according to the Directive 95/46/EC on the protection of individuals with regard to the processing of personal data, “account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person”.

This definition is especially important in the context of scientific research in order to assess whether the utilisation of a codification system can allow the data to be considered as anonymous. However, provided that most of time the research project itself requires the possibility of matching the genetic data extracted from a sample with the health status (and its eventual changes) of the relevant patient, the existence of a system allowing the identification of the tissue sample originator cannot be eliminated.

The duty to collect consent to the processing of personal data, regardless the category of data, does not aim to protect the right of the data subject to make decisions regarding his or her own body with respect to a medical treatment affecting his or her health. Indeed, this kind of consent protects the right of the individual to keep control over his or her personal and especially sensitive and genetic information as a piece of his or her identity.

To allow it to achieve its purpose of protecting the informational liberty of the data subject, consent has to be properly informed. According to section 13 of the Data Protection Code, the individual must be informed about the identity of the controller, the purposes and modalities of the processing, the rights of the data subject and the entities to whom the data may be communicated. With specific reference to scientific research, this means that the individual should be advised of the nature and the objectives of the particular project which is going to use his or her personal data and of the risks and expected benefits.

The requirement of the data subjects’ consent to the processing of their genetic data must, therefore, always be respected as long as the research is carried out on identifiable samples. This is necessary because the right of informational privacy is protected for the entire period that the data is processed in a identifiable manner since the subjects are exposed to all the risks connected to the continued circulation of their data.

In fact, while it is not possible to test a person without his consent, since sections 13 and 32 of the Italian Constitution protect people against restrictions of their personal liberty, in a biobank genetic data are recorded for very long time so that they could be known without need to re-test the relevant individual. Therefore, even if the General Authorisation establishes a complex security system for ensuring the confidentiality of the genetic stored data, such as a coding process, the availability of a large amount of identifiable genetic data may increase some risks for the data subjects.

However, these requirements can in some cases hamper research since collecting consent from the originators of all the samples actually stored in hospitals or other scientific facilities to use them for scientific purposes could be almost impossible. Therefore, to avoid the impossibility of using these very important materials, the Data Protection Code includes an exemption to the consent requirement: section 110 states that consent to the processing of sensitive data is not required if data subjects cannot be informed on specific grounds (for ethical reasons, for instance when the data subject is unaware of his or her condition, or methodological reasons, for instance when it is unnecessary inform the subject about the assumptions underlying the research, or because it is organisationally unfeasible) and the research programme has been subject to a reasoned, favourable opinion by a geographically competent ethics committee as well as being generally authorised by the Data Protection Authority. Even if this exemption is expressly provided for with exclusive reference to sensitive data, it can also be regarded as applicable to genetic data.

This provision derives from a balance between two opposite rights which both have constitutional importance: the right of confidentiality and the right to the scientific research. The later can cause an exemption from the consent requirement in exceptional cases and in the presence of appropriate guaranties for the donors so as not to overburden scientific research with too many restrictions.

3. Data Protection Regulation Applicable to Biobanks for Scientific Research in Italy

Under Italian legislation, the General Authorisation for the processing of genetic data is the only regulation that can be applied to scientific research carried out on human tissue samples, and, therefore, to the functioning of existing biobanks.17

As far as the processing of genetic data is concerned, the relevant regulation was missing until the General Authorisation was issued. In fact, Italian data protection legislation, while providing the legal framework for the processing of data concerning health, did not regulate the processing of genetic data and gave the mandate to the Data Protection Authority to issue these regulations.

In particular, since Italy ratified European Directive 1995/45/EC by Law 31 December 1996, n 675, the data concerning health are considered a special category of information, so that specific requirements must be met for the processing to be legitimate (section 8). According to section 22 of Law 675/1996, the processing of sensitive data (which include data concerning health) was allowed only with the data subject’s written consent and the Data Protection Authority’s prior authorisation.18 Since 1997, this authorisation has been released each year, as a “general authorisation”, by the Italian Data Protection Authority and establishes the subjects and the purposes of the legitimate processing of sensitive data. However, Law 675/1996 did not mention the specific category of “genetic data”. Therefore, in 1999, Legislative Decree n 135 concerning the processing of sensitive data by public entities mentioned for the first time this special category of data, giving the mandate to the Data Protection Authority to issue, within the next twelve months, a specific regulation to authorise some categories of subjects to process genetic data.19 Nevertheless, no provision was enacted until 2003, when the new Data Protection Code came into force and renewed the mandate of the Data Protection Authority (section 90), which finally issued the General Authorisation in 2007.

The choice for an administrative instrument, such as the authorisation of an independent authority, to regulate this topic raises some criticism, considering that the law has not provided any specific indication about the content of this authorisation. This circumstance is problematic with respect to the rule of law, especially in sensitive matters, which involve individuals and their fundamental rights.20 We can infer that the legislator prefers a procedural approach to the critical questions raised by the processing of genetic data and aims to set strict rules and procedures to grant fair uses of them.21 Therefore, an administrative independent authority is considered more suitable when following this approach.

According to the General Authorisation, which sets specific limitations for the use of genetic data,22 any processing of genetic data requires the consent of the data subject,23 which must be released on the presentation of a completed information notice. This information notice shall include, in addition to the contents listed by section 13 of the Data Protection Code, the following information: (a) a detailed list of all the specific purposes to be achieved; (b) the possible findings, also including any unexpected ones that might come from the processing of genetic data; (c) whether the data subject is allowed to limit the scope of communication of his or her genetic data and the transfer of biological samples, including their possible use for other purposes; (d) the retention period of genetic data and biological samples. In cases of processing for scientific and statistical research purposes, the information notice shall also specify the following: (a) that the consent must be given freely and may be withdrawn at any time without this being in any manner detrimental and/or prejudicial to the data subject, except where the data and biological samples do not allow the data subject to be identified any longer; (b) what arrangements have been made to allow data subjects to be only identifiable for as long as is necessary; (c) whether the data and/or biological samples may be retained and used for other scientific and statistical research purposes - as long as they are known – which shall be appropriately specified also with regard to the categories of entity the data may be communicated and/or the samples transferred; and (d) how data subjects can access the information contained in the research project.

The consent that the data subject will give will have a different scope depending on the completeness and specificity of the information notice received. The issue is whether broad consent (i.e. consent of the originators to their materials being used for unspecified future scientific purposes) should be obtained or whether under the strictest interpretation of the principle of self-determination it would be necessary to obtain specific consent from participants for each research project that makes use of their samples and data.

This question is linked to the issue whether it is necessary to re-contact the tissue originators for each new use not specifically consented to during the first donation. There is a fundamental divergence about this between North America and Europe. The former have opted for specific consent which requires the individuals to fill detailed forms for each possible future use of their tissues. The latter uses a more general consent so that there is no need to go back to the participants to obtain new consent for each and every proposed genetic study.24 The degree of the specificity of consent balances between the need for the respect of individuals’ self-determination and the public interest not to burden researchers with complex administrative procedures.25

The choice of the Italian Data Protection Authority is an intermediate position, since materials can be released on the grounds of an information notice which can provide for data and/or biological samples to be eventually retained and used for other scientific purposes, which should be appropriately specified as long as they are known by researchers. In particular, the utilisation of the samples and the relevant genetic data for additional research projects, in relation to which the consent has not been collected, is allowed only if the scientific purposes sought are directly connected with those expressly consented to by the data subjects.

In addition, the General Authorisation entitles the data subject who undergoes a genetic test the right not to know the results.26 This is to avoid serious psychological consequences in case of unexpected findings. Section 90 of the Data Protection Code provides that “The authorisation…shall also specify the additional items of information that should be contained in the information notice…with particular regard to the purposes sought and the results to be achieved also in connection with the unexpected information”. The right not to know is additionally addressed by the medical Code of Ethics that obliges the physician to respect the documented wish of the patient not to be informed (section 30). From the implementation of the principle in this context, one can infer that the right not to know must be taken into account because it represents an enhancement of personal autonomy but it is not an absolute right, in the sense that it may be restricted when disclosure is necessary to avoid risks of serious harm to the patient or to other persons. The evaluation is up to the physician.27

4. Conclusion

Since the General Authorisation about the processing of genetic data is the only applicable regulation to genetic research, the data protection issue is actually the only one addressed by Italian law with regard to the functioning of biobanks for scientific purposes.

Nevertheless, the General Authorisation often uses as synonyms the terms “data” and “sample”, starting from the definition of biological sample as “container of genotyping information which characterise an individual”. This means that human tissue samples are considered only as “genetic information carriers”. This assimilation is particularly evident when a data subject withdraws his or her consent to the processing of data for research purposes: in fact, when this happens, the relevant biological sample is also destroyed except when the sample can no longer be connected to the subject.

This assimilation implies that the only kind of consent addressed by Italian regulation is the consent to the processing of genetic data which can be extracted from the tissue samples. The informed consent issue meanwhile is addressed only with reference to the medical treatment consisting in the taken of the samples: in this case, the patient must be informed about the purposes of the treatment, whether medical and/or scientific. Regarding the reuse of samples originally collected for different reasons for scientific research and actually stored in biobanks, there is not any specific regulation, except for the General Authorisation concerning the processing of genetic data.

It could be very important to define the status of these samples since they have other than an informational dimension, a material dimension that should be considered autonomously by the legislator. For these samples, some authors28 suggest adopting a property scheme to clarify the powers of the different subjects involved in the research (especially donors and researchers) and who is entitled to dispose of them.

Moreover, since it extends its scope not only to the data but also to the samples in consideration of their informational dimension, the General Authorisation might generate problems of overlapping if specific rules for the managing of the samples were issued. In fact, even if in theory the distinction between samples and genetic data is clear (for example, digitalised DNA should fall into the scope of the data protection regulation, while DNA in its natural state should fall under the samples-regulation), in practice, the two dimensions could be confused.

The difference between the two dimensions of the tissue samples has also been pointed out by the Italian Data Protection Authority, which issued a decision on 21 June 2007.29 There, it specified that its own jurisdiction is limited to the results of the analysis carried out on a genetic sample and does not include the biological sample itself. Therefore, it cannot grant a request to obtain access to a sample.

Finally, with reference to the informed consent issue, Law 22 February 2006 n 78,30 which implemented Directive 98/44/EC, concerning the patentability of biotech inventions has to be mentioned: in fact, this law provides that if an invention is based on biological material of human origin, the patent application must include a document where the person from whom the material had been taken has expressed free and informed consent to participation to the research (section 5, paragraph 3).31 This provision should be better coordinated with other relevant pieces of legislation. What happens, for instance, when an invention results from research carried out on samples stored in biobanks when the specific consent of the patients has not been collected? The provision might imply that each patient is to be contacted again when the hospital where his or her samples are kept intends to use them for scientific purposes.

In conclusion, it has to be pointed out that, in Italy, various issues related to biobanks are not still addressed by law and this situation causes uncertainties that discourage researchers. This is especially true for genetic research projects carried out on human tissue samples stored in hospitals or other scientific facilities without the specific patients’ consent to their use for scientific purposes.

Therefore, a systematic regulatory framework for biobank management in Italy is needed, which must be able to resolve most of the uncertainty that burdens scientific research. This framework should start from basic concepts and definitions, and should provide security and quality for stored human tissue samples and relative medical and genetic data through the establishment of ethical and operational standards shared at an international level.

---

© 2004-2008 University of Edinburgh and Contributors.

ISSN 1744-2567. DOI 10.2966/scrip.