Norwegian Biobanks: Increased Complexity with GDPR and National Law

Abstract

Norway is generally regarded as having good opportunities for biobank research because of Biobank Norway—its national infrastructure of biobanks—which represents one of the world’s largest existing resources within biobanking. It covers both consented population-based and disease-specific clinical biobanks. However, the regulatory framework in Norway for biobanking is fragmented, which makes navigating the legal landscape challenging. The Personal Data Act (PDA) implements the General Data Protection Regulation (GDPR), and a few adjustments were made in the national health legislation in order to bring it into line with the GDPR. The Health Research Act (HRA) enables the use of biobanking and personal data in research with and without the consent of individuals. There are some disagreements about the changes brought about by the GDPR when it comes to research on biological material that includes personal data. When implementing GDPR Article 89, it was emphasised that the Data Protection Officer (DPO) has an important role even though the research ethics committee has allowed the use of data (the regional committee for medical and health research ethics (REC)). This has created conflicts. This article highlights key issues and ambiguities related to the GDPR and national legislation, and the relationship between the two.