Health data protection and confidentiality in EU BTC legislation: ethical and safety standards.

PURPOSE: The current paper focuses on the ethical approaches to data protection and confidentiality (DP&C) and the quality and safety (Q&S) requirements in the European Union (EU) blood, tissues and cells (BTC) legislation, namely: Directive 2002∕98∕EC, Directive 2004∕23∕EC, Directive 2005∕61∕EC, Directive 2005∕62∕EC, Directive 2006∕86∕EC, Commission Directive (EU) 2015∕565, SWD(2019) 376 final and the external evaluation SANTE∕2017∕B4∕010.
BACKGROUND: In the EU, the ethical requirements for the BTC legal framework focus also on the quality, eligibility, safety, and protection standards. In addition, the SWD(2019) 376 final on the evaluation of the EU BTC legislation released in October 2019 draws attention to the challenges of technology, consent and donation, testing procedures and management of the BTC services. CONTENT: The paper highlights the EU BTC setting standards by examining the particular provisions for the: hemovigilance, eligibility of donors, blood and blood components (BBC), consent, decisions required at the Member States (MS) level, healthcare standards, measures for the blood establishments (BE) and tissue establishments (TE) and particular issues concerning the donation of tissues and/or cells (T&C).
CONCLUSIONS: Nevertheless, the intended function of the analysis is to focus on the EU BTC legislation and to enable research responsive to the latest initiatives launched by the European Blood Alliance (EBA) and Nuffield Council on Bioethics (NCB) in the field of the definitions and ethical processes.

⧉ Introduction

The European Commission (EC) published the Staff Working Document SWD(2019) 376 final in October 2019 intending to display guidance on the blood, tissues and cells (BTC) legislation [1]. Therefore, SWD(2019) 376 final reviews the main terms and definitions of the Directive 2002/98/EC [2] and Directive 2004/23/EC [3], the BTC services and standards at the European Union (EU) and Member States (MS) levels, the specific settings for the transposition of BTC legal framework and the monitoring activities. Therefore, the EC evaluation (2019) identifies the settings of the EU legislation regarding donor testing, traceability and authorization process. It also discusses the ethical standards by considering the EU competence following the article 168(4)(a) TFEU [4], namely: the role of the technological development for life, consent, the requirements for quality and safety (Q&S) regarding the inter-MS exchanges and the standards for “legal certainty” (Concern 2, EC Evaluation 2019).

Previously, the main legislation in the BTC sector, namely Directive 2002/98/EC (EUBD) on human blood and blood components (BBC) and Directive 2004/23/EC on human tissues and cells (EUTCD), highlights the particular requirements for data protection and confidentiality (DP&C), security information and standards, blood donation (BD), quality management (QM), exchange of health data and information at MS level. Therefore, both directives reinforce the need for data confidentiality provided by the authorized procedures following the Q&S system and the requirements of good practice.

In this context, the general provisions of the Directive 2005/61/EC [5], Directive 2005/62/EC [6], Commission Directive 2006/86/EC [7], Commission Directive (EU) 2015/565 [8] propose special ethical considerations with relevance to: (i) the context of traceability and hemovigilance; (ii) the Q&S management system; (iii) the personnel and recorded data; (iv) the confidentiality engagements; (v) the information on serious adverse events and reactions (SAER); (vi) the conditions of storage for the tissues and cells (T&C); (vii) the legal conditions for the “mandatory consent”; (viii) data and information for the T&C donation; (ix) exchange of information between the competent institutions. In this context, recent studies focus on the spectrum of the quality perspectives and regulatory framework of the transposition of EU BTC legislation at a national level [9,10,11,12,13].

⧉ DP&C, mandatory consent, QM

To ensure DP&C, EUBD proposes the framework for the Q&S standards and blood safety [14], data protection, confidentiality and regulation of blood establishments (BE) [15,16], protection of donors and the principle of non-remuneration of BD [17], the Q&S measures and the BD selection [18]. Accordingly, the Commission Directive 2004/33/EC defines and identifies the technical conditions for the EUBD implementation [19]. Nevertheless, most of the opinions of recent literature focus particular attention on the ethical principles in biomedical research referring to informed consent, protection of health data, patients’ rights, public health [20,21,22,23,24].

The reasoning of the EUBD provisions for DP&C is related to “all data” following the aims and objectives of the EU provisions, namely the “human health protection” (Article 24 EUBD). This explanation includes the legal provisions requiring the data collected to be anonymized with the aim to no more identify the donor [Article 24(a) EUBD]. The related provisions also call for the introduction of additional measures to guarantee data security, as well as to ensure the protection of donor files, but also against unauthorized actions [Article 24(a) EUBD].

Other provisions regarding DP&C refer to the ways of resolving the contradictions between data, as well as guaranteeing the principle of non-disclosure of information, without authorization by ensuring the traceability of donations [Article 24(b)(c) EUBD]. Eventually, the information and provisions needed to be provided to prospective donors (PD) contain three main provisions that are fundamental for the data protection (e.g., unauthorized procedures related to the identification of the donor, health data or tests carried out by PD) (Annex II, Part A, Commission Directive 2004/33/EC). On the other hand, the information requested from the donors by BE for each donation refers to personal data of the donors, health, and medical data (Annex II, Part B, Commission Directive 2004/33/EC). Subsequently, in setting the Q&S conditions for BBC, the EU law requires MS to follow all necessary measures for the import of BBC from third countries under the Q&S standards provided at the EU level (Point 2.3, Annex V, Commission Directive 2004/33/EC).

Other provisions of EUTCD establish new ethical approaches to “consent” (Article 13 EUTCD), DP&C (Article 14 EUTCD), T&C storage (Article 21 EUTCD), information required for the donation of T&C (Annex EUTCD), guidance for the “donor identification system” (DIS) [Article 8(2)EUTCD]. Moreover, EUTCD also focuses: (i) the “mandatory consent” (Article 13 and Annex EUTCD) and the Q&S system of human T&C following the principle of “self-sufficiency” at the EU level [Recital (1), Recital (4), Recital (5), Recital (8), Recital (11) and Recital (15) EUTCD]; (ii) the use, storage and distribution of human T&C [Recital (2) and Article 21 EUTCD]. As such, EUTCD (Annex, Part A) requires “living donors” to provide the information needed for the donation of T&C as well as for the procurement. Therefore, an accurate approach to the EUTCD ethical issues addresses the “mandatory consent” before the authorization for the procurement of human T&C or other authorization procedures established in the MS [Article 13(1) EUTCD]. In this context, contemporary researches cover new bioethical perspectives of consent and related legal approaches [25,26] in the EU legislation.

To improve protection, EUTCD emphasizes the need to guarantee all data and information required in the Annex. The authorization assessment at the MS level should address particular measures following the Annex, Part A of the EUTCD (e.g., staff responsible for the information given to donors, the need to provide accurate data concerning the results of the tests, the protection of personal data of the donor, practical issues about the therapeutic approaches, benefits and medical records, safeguard measures for the donors).

Starting from the information required for the “mandatory consent”, EUTCD argues that the bioethical issues must include also the certification procedure and the authorization phase to carry the procurement of T&C. In this context, EUTCD argues the need to adhere to the principles of “voluntary and unpaid” donation of T&C [Article 12(1) EUTCD]. Moreover, the data security operations are discussed with particular reference to the guarantees for donors’ data and files against any unauthorized actions [Article 14(2)(a)(b) EUTCD]. Finally, EUTCD addresses the need for the implementation of procedures aimed to resolve data errors [Article 14(2) EUTCD] by explicating the ethical decisions related to the necessity to guarantee the principles of traceability for the donation of T&C [Article 14(2)(c) EUTCD].

⧉ Responsible person (RP) for BE, traceability and notification for SAER

For the explanation of the ethical decisions, EUBD details other three issues related to: (i) the responsible person (RP) designated for the BE (Article 9 EUBD); (ii) the measures and procedures related to traceability (Article 14 EUBD); (iii) the notification of SAER (Article 15 EUBD). Moreover, EUBD outlines the regulatory requirements for the designation of the RP in compliance with the MS legislation, following the information provided to the competent institutions and the provisions for qualified personnel (Article 10 EUBD), the QM for BE (Article 11 EUBD), traceability (Article 14 EUBD) and notification of SAER (Article 15 EUBD). Complex explanations are determined for the structural and organizational requirements to perform the tasks for the personnel (Article 10 EUBD) and documentation (Article 12 EUBD). All the mentioned activities described for the RP are in particular related to the national provisions and the conditions for the performance of tasks [Article 9(3)(4)(5) EUBD]. Other issues of necessary procedures for BBC focus on the screening of traceability, indication and information provided to PD (Article 16 EUBD) or required from donors (Article 17 EUBD).

In addition, according to the legal context of the EUTCD, the provisions for the ethical guidance explicate the tasks and qualifications required for the RP for tissue establishments (TE) (Article 17 EUTCD), the normative framework for QM (Article 16 EUTCD), traceability (Article 8 EUTCD), T&C reception (Article 19 EUTCD) and the implementation of the DIS related to a unique code for the donation and the products incorporated [Article 8(2) EUTCD]. It also discusses the practical points related to the TE, namely: “data required”, “data storage” and other “relevant data” to ensure the traceability for T&C.

Concerning the SAER, EUTCD refers to the normative context at the MS level, as the procedure of notification provides an outline of the need to guarantee the Q&S of T&C from the procurement to distribution [Article 11 EUTCD]. In addition, EUTCD provisions seek to briefly explain the system of notification with more consideration of the reactions related to the “clinical application” [Article 11(1) EUTCD]. Moreover, Article 11 EUTCD also provides an analytical framework for the notification of SAER. Therefore, it is outlined that the EUTCD main guidelines refer to three provisions based on the: (i) the responsibility of the MS to guarantee the management of information and the “clinical application” regarding the SAER and influencing the Q&S of the T&C [Article 11(1) EUTCD]; (ii) the responsibility of the personnel and of the TE aimed to guarantee traceability in accordance to the Q&S standards [Article 11(2) EUTCD]; (iii) the need to provide “a report analysing” for the notification of SAER including the cause and the effects [Article 11(3) EUTCD]. It is argued that the TE will guarantee the procedure required for the “recall from distribution” of the products related to SAER [Article 11(5) EUTCD].

⧉ Legal and ethical overview of EU BTC

In the light of the basic EU BTC legislation, it is also important to outline the External Report SANTE/2017/B4/010 launched in December 2018 [27] that standardizes supporting research aimed to stimulate a complex approach to the ethical standards. The final report sets a four findings framework to evaluate the BTC legislation by focusing the: (i) relevance of the legislation and the need to adapt to the biotechnological evolutions (Finding E.3.1, Relevance, SANTE/2017/B4/010); (ii) effectiveness following the Q&S standards and the complementary legislation related to the BE or TE, the MS authorities and the EU facilities (Finding E.3.2, Effectiveness, SANTE/2017/B4/010); (iii) efficiency of the transposition of the EU legal provisions at MS level (Finding E.3.3, Efficiency, SANTE/2017/B4/010); (iv) coherence, harmonization and coordination between the decision criteria for the implementation of the EU legislation, the national requirements and the Q&S standards (Finding E.3.4, Coherence, SANTE/2017/B4/010). In addition, the conclusions of the supporting report stimulate the gathering of particular approaches to the standards and requirements, the latest developments for the BTC sector and the ethical considerations related to assisted reproductive technology (ART).

On the other hand, the emerging ethical considerations related to voluntary non-remunerated blood donation (VNRBD) are examined by the European Blood Alliance (EBA) in 2016 [28]. The EBA Report reviews the definitions and the legal context stated by the EUBD and the SWD/2016/0130 final [29] by acknowledging the voluntary donation, the principle of the non-remuneration, the blood safety standards and blood availability. Furthermore, under the definitions provided by the Nuffield Council on Bioethics (NCB) in 2011 [30], the EBA Report acknowledges the need for a more comprehensive definition of “compensation”, “donation”, “person”, “recompense”, “reimbursement”, “specific consent”, “generic consent”, “tiered consent”, etc. The EBA Report (2016) also observes other essential approaches for the ethics of biomedical research namely: (i) the need for the respect of the donor’s dignity and (ii) the requirements for the harmonization of the VNRBD at the MS level. Another EBA Report notifies also in October 2016 the role of the selection of blood donors and protection of donors stipulated by EUTCD. This approach is reflected by the need to state new criteria for data collection and eligibility standards depending on the risk assessment and to establish particular “deferral criteria” related to risk assessment [31].

⧉ Ethical issues in EBA Position on the revision of BTC legislation (May 2021)

The latest report published by EBA in May 2021 on the revision of the BTC legislation describes the main recommendations for future provisions based on the “need for European self-sufficiency” (Point 3, Position Statement EBA) [32]. The EBA Position Statement reveals four stages of the EU policies, suggesting the necessity to achieve the reinforcement of the legislation and the importance of voluntary donations.

First, the framework proposed by EBA focuses on the principles of ethical research and guidelines related to BTC donations. EBA also recommends the promotion of technical and medical evolutions following the regulatory framework of the General Data Protection Regulation (GDPR).

Second, EBA underlines the importance of the network between crisis response and health emergency policies in the context of the coronavirus disease 2019 (COVID-19) pandemic (Point 5, Position Statement EBA) [32] by recommending the adoption of explicit provisions aimed to reinforce protection and to focus on suitable measures for voluntary non-remunerated donation (VNRD).

Special positions apply to the health protection of the donors and the need to consider the latest technological advances and medical approaches.

Third, the EBA statement also explicates the ethical considerations related to future definitions concerning “compensation” for donors requiring the implementation of the definition launched in 2011 by the NCB [30]. The Glossary of terms proposed by NCB refers to a two-level form of defining and explaining “compensation” as “payment to a person in recognition of non-financial losses” while donating “bodily material” [30].

Fourth, EBA also offers explicit information on the importance of VNRD by identifying the ethical principles regarding VNRD as a fundamental basis of future EU BTC legal provisions concerning “treatment using labile products” and T&C requiring the need to encourage the protection of donors. Moreover, the principle of “no financial gain principle” concerning health measures and services is explained and disseminated. In addition to the explicit requirements of VNRD and the need to ensure an EU self-sufficiency in the area of blood products, it is also addressed the need for the “high quality of lives” of the patients. Particular approaches apply to the principle of self-sufficiency and patient blood management (PBM) [32]. It is also explained the EU legal framework with more consideration to the COVID-19 pandemic and technical aspects addressing prospective regulatory framework about the response to a health emergency, crisis preparedness and epidemiological challenges.

⧉ Conclusions

The article explicates the ethical approach to the EU BTC legislation referring to three relevant conceptions of the status of safety requirements and DP&C. Therefore, the determination of the normative context guides ethical decisions by drawing an analytical framework of the concepts, provisions, decisions, and bioethical understanding.

Conflict of interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

All authors read and approved the final manuscript.