BBMRI-ERIC policy for access to and sharing of biological samples and data

1. Introduction

BBMRI-ERIC is a pan-European research infrastructure which facilitates access to human biological samples (e.g., tissue, blood, DNA) and associated clinical and research data from individual biobanks. BBMRI-ERIC is a European infrastructure with the aim to encourage and expedite effective and ethical access to samples and data from biobanks, preferably in the context of high-level research collaboration between providers (e.g., biobanks, including scientists and physicians who contributed to the biobanks) and requesters. As of early 2017, BBMRI-ERIC consists of 19 Member States and one international organisation (IARC). BBMRI-ERIC operates on a non-profit basis. This access policy presents three areas of guidance:

  1. ethical principles;
  2. governance procedures; and
  3. practical procedures for access.

Together with existing legal frameworks, these three areas provide the ethical and legal framework and practical procedures to guide access to and use of biological samples and associated data, as well as to tools and resources developed by BBMRI-ERIC. This policy is a binding document for BBMRI-ERIC itself, for BBMRI-ERIC Partner Biobanks, and for any requesters, who are seeking access to samples/data from BBMRI-ERIC Partner Biobanks via BBMRI-ERIC. It will not supersede access policies and procedures of individual biobanks but will provide a framework that BBMRI-ERIC Partner Biobanks must adhere to.

This policy will be amended/changed in accordance with changes in the regulatory framework.

2. Definition of Terms

Samples/Data

Biological samples or data stored in, and under stewardship of, one of the BBMRI-ERIC Partner Biobanks, as well as data derived through the use of the requestor.

BBMRI-ERIC Partner Biobank

Biobanks participating in BBMRI-ERIC infrastructure as part of the National/Organisational Nodes that have signed the BBMRI-ERIC Partner Charter. Please note that individual biobanks remain in control over ultimately granting/denying access to potential users/requesters.

Requester

A qualified person requesting samples/data. Needs to be registered as specified in Step-1 and -2.

Bona Fide Researcher

A researcher with:

  1. an intention to generate new knowledge and understanding using rigorous scientific methods;
  2. an intention to publish the research findings and share the derived data in the scientific community, without restrictions and with minimal delay, for wider scientific and eventual public benefit; and where
  3. the intended activities are not inconsistent with legal and ethical requirements or widely recognised good research practice; and
  4. they have a bona fide research project.

Bona fide research project: In practical terms, a research project or proposal that has been approved by a recognised funder, or a researcher that belongs to a research organisation that has the capability to lead or participate in high quality, ethical research should normally be considered bona fide.

National/Organisational Node

A National Node or an Organisational Node as defined in the Statutes of BBMRI-ERIC (Article 1.6 and 1.8).

Provider

A BBMRI-ERIC Partner Biobank providing samples/data.

MTA

A contract between the requester and the Partner Biobank specifying conditions under which the biological material and/or data are transferred from the biobank to a recipient. A data-only transfer agreement is sometimes called a Data Transfer Agreement (DTA) or Data Access Agreement (DAA).

Project Outcome

Can be published in the form research papers, patents, new therapies and other types of commonly acknowledged medical research achievements. This also includes a report on the use of samples and/or data.

Availability Information

The provider provides Availability Information regarding samples/data via BBMRI-ERIC to the requester. It is made available before the requester initiates direct interaction with the provider, in order to get access to the samples/data. ‘Availability Information’ is treated as confidential by BBMRI-ERIC, i.e., it will not be disclosed to other providers.

Personal Data

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (GDPR Article 4.1).

Pseudonymisation

‘Pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person (GDPR Article 4.5). [Guidelines for pseudonymisation are expected to be part of the Code of Conduct on Processing of Personal Data for Purposes of Scientific Research in the Area of Health]

Human Biological Samples

Constituent parts of the human body, or human biological material, including organs and parts of organs, cells and tissues, and body fluids.

3. Legal Premise

The Access Policy implements Article 10.6.c of BBMRI-ERIC Statutes.

All proceedings related to access and sharing must be compliant with national and European legislation such as the Directive 95/46/EC and, as of 28 May 2018, the EU General Data Protection Regulation and a Code of Conduct (GDPR Article 40). It is the national legislation that applies to the data controller responsible for a biorepository, a registry, or a collection of personal data which, in turn, applies to the processing of samples and data, irrespective of where the samples and data are used. The processing of data and the use of biological samples must be compliant with the provisions of the informed consent form and/or decision of an ethical review board, and/or a data protection authority/officer if applicable. If none of the above is applicable, it must be compliant with national legislation.

4. Governing Ethical Principles

BBMRI-ERIC will facilitate and support access to samples and data from participating biobanks, as well as access to, and the use of, resources and tools developed by BBMRI-ERIC according to the following principles:

  1. Scientific integrity: BBMRI-ERIC requesters and providers are expected to act in an honest, transparent, equitable manner and uphold the highest standards of quality in scientific research.
  2. Responsibility and accountability: It is both the requesters’ and providers’ responsibility to ensure that they have read and understood the relevant policies and procedures and that they act in accordance with them (including the respective biobank’s as well as BBMRI-ERIC’s policies and procedures). Should policies or procedures established by BBMRI-ERIC be contravened, the requester or provider is expected to report this to BBMRI-ERIC immediately.
  3. Respect for responsible governance regarding data and research: Requesters and providers are expected to take the necessary precautions and safeguards to avoid subjects’ privacy breaches. This entails protecting their personal data and putting in place state-of-the-art safety measures for data security.
  4. Respectful use of limited resources: Request for access to biological samples of a limited nature will be granted particularly sparingly. Requesters are expected to request only as much as is required and to obtain results that cannot be effectively achieved otherwise.
  5. Accessibility to research results: Requesters should be willing to make their research results accessible for academic purposes on a royalty-free basis and in a timely manner.
  6. Attribution: The intellectual investment of investigators involved in the creation of data registries and bio-repositories is often substantial, and should be acknowledged. This should be specified in Material and Data Transfer Agreements (MTA/DTA) signed by both parties.
  7. Respect for intellectual property: Sharing of data and biological samples needs to be performed in a way that protects intellectual property rights of the parties involved. It also needs to address the requirements of institutions and third-party funders.
  8. Equity and inclusivity of users: Bona fide researchers who meet the relevant criteria should be granted access based on fair and non-discriminatory terms.
  9. Public engagement: BBMRI-ERIC supports the engagement of relevant stakeholders and the public and welcomes their active participation in biobanking.
  10. Reciprocity: Stewardship also implies giving something back. Feedback regarding general results should be channelled towards institutions and patients.
  11. Confidentiality: BBMRI-ERIC and its Partner Biobanks shall treat all the access requests confidentially and will not use them for any purpose other than assessing the availability of the samples/data and access provisions.

5. Procedures Governing Access to and Use of Samples/Data

  1. BBMRI-ERIC encourages BBMRI-ERIC Partner Biobanks to refer to the European Charter for Access to Research Infrastructures2 (ECfARI) and the International Charter of Principles for Sharing Biological Samples and Data3 when updating existing access policies or establishing new ones. Due to the diversity of the BBMRI-ERIC Partner Biobanks, access units and modes are to be defined by each biobank. The ECfARI requires research infrastructure to define their access units and access modes. The ‘access units’ [ECfARI 3.d.] that BBMRI-ERIC recommends are samples and resources consumed for preparation and delivery of data sets. BBMRI-ERIC recommends that ‘access mode’ [ECfARI 5.b.] is excellence-driven access [ECfARI 5.b.1.]. Biobanks can adapt these recommendations according to their preferences.
  2. The samples/data remain under the stewardship of the BBMRI-ERIC Partner Biobanks as the original source, unless otherwise specified under a separate agreement. Consequently, BBMRI- ERIC only facilitates access, while BBMRI-ERIC Partner Biobanks actually grant and provide access. Access should be based on requests for specified research projects.
  3. The quality of data and biological samples shall be ensured by the provider.
  4. The requester needs to ascertain that the samples and data provided are stored in a secure storage and operation facility accompanied by an appropriate access policy, including a description of who can access the facility, the time-period the samples/data will or need to be stored, and concrete steps for sharing samples/data.
  5. Material Transfer Agreements (MTAs), Data Transfer Agreements (DTAs) or Data Access Agreements (DAAs) should always be used to govern material transfer between parties.
  6. Samples/data can only be used for academic or industrial research purposes, depending on the legislation of the Member State or international organisation: The usage and limitations need to be specified in an MTA/DTA between the requester and the BBMRI-ERIC Partner Biobank.
  7. All projects using identifiable human biological materials and derived data (beyond the original project for which samples/data were initially collected and provided) are subject to the overarching principle above, i.e., they must also be evaluated by an appropriate and legitimate ethical review board.
  8. The entity which provides biological samples or personal data shall explicitly document any restriction of use or obligation applicable to these biological samples or data (e.g., the limited scope of purpose imposed by the consent form, the obligation to report incidental findings, publication restrictions such as non-discrimination clauses, etc.).
  9. Requests for access to samples/data issued by requesters will be required to follow the request procedure for samples/data via the BBMRI-ERIC IT services below (Section 6).
  10. DTAs or DAAs should be used for parties outside the EU, unless there are specific legal provisions between the EU and the third country (e.g., Privacy Shield for U.S., or countries accepted by the European Commission in accordance with Article 25, Directive 95/46/EC) using standard EC contract clauses, e.g., Commission Decision 2001/497/EC, C(2004)5721.
  11. In order to maximise the value of the biobank resources, providers may request that provenance data as well as data derived from samples/data are transferred back to the respective provider free of charge (so-called ‘return of data’). If the provider does not have the capacity to store the data, the provider may contact BBMRI-ERIC to facilitate storage
  12. XII. Access will be cost-neutral for BBMRI-ERIC Partner Biobanks. It may be that BBMRI-ERIC Partner Biobanks require the requesters to partially or fully cover the costs incurred in providing samples and/or data. Cost aspects must be regulated in the MTA/DTA between the requester and the BBMRI-ERIC Partner Biobank.

6. Request Procedure for Access to Samples/Data via BBMRI-ERIC IT Services

The basic framework governing the request procedure for accessing samples/data via the BBMRI-ERIC IT services comprises the following steps:

Step-1 Registration of requester: 

BBMRI-ERIC verifies the identity of each requester and his/her institutional affiliation (employee status).

Step-2  Request of samples/data: 

A requester files a request for access to samples/data via the BBMRI-ERIC IT services. Each request must include information about the approved/proposed research project including its ethical approval status, expected properties of and amount of samples/data and their anticipated use, as well as the destination of the samples (if different from the location of the requester). A provider may either request refinement of the request or provide Availability Information to the requester via BBMRI-ERIC. In compliance with the governing ethical principles in paragraph XI., Availability Information is treated as confidential by BBMRI-ERIC, i.e., it will not be disclosed to other providers. Providers will not use requests for any other purpose than assessing the availability of the requested samples/data and providing offers.

Step-3  Access control & samples/data delivery: 

After receiving adequate Availability Information, the requester follows up directly with the provider (biobank) in order to provide any additional information needed to assess whether access can be granted. As part of this process, the provider must comply with the regulatory and ethical conditions (e.g., data protection regulations, assessment of compliance of informed consent with the approved/proposed project, checking whether the amount of deployable/extraditable samples required is scientifically justified) and transfer liability to the requester by using MTAs/DTAs as deemed appropriate. The provider has to decide whether samples/data are released for the project requested. Similarly, access to deliverable/extraditable samples may be subject to prioritisation. For approved requests, the MTA/DTA will need to be executed and access charges paid before samples/data are released to the requester.In the case that BBMRI-ERIC is the data controller, special provisions have to be defined and agreed on a case by case basis and made available to the requesters.

Step-4  Return of results: 

Providers need to collect reports on project outcomes for accountability purposes regarding the utilisation of the BBMRI-ERIC infrastructure. Providers are encouraged to require the return of derived data from the requester (see Access Criteria above) and integrate this requirement into their biobank policy and the respective MTA/DTA.

Step-5 Request completion notification: 

For each request obtained via BBMRI-ERIC, for which Availability Information has been provided according to Step-2 and where Step-3 has been completed, the BBMRI-ERIC Partner Biobanks are required to inform BBMRI-ERIC whether the request has been completed successfully (whether samples and/or data were provided to the requester and/or whether Step-4 and -5 were also completed), or whether it failed. In case a request fails, reasons for failure have to be specified. For successfully completed requests, the providerwillreportprojectoutcomes toBBMRI-ERIC.

As access facilitator, BBMRI-ERIC provides infrastructure implementing Step-1, Step-2 and Step-5. BBMRI-ERIC is not directly involved in Step-3 and Step-4.