Obtaining consent from COVID-19 patients for the use of blood samples for scientific research by deCode genetics

The Data Protection Authority (DPA) has completed its investigation into the obtaining of consent from COVID-19 patients at Landspítali for the use of their blood samples for the purposes of the scientific study Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes. It is the conclusion of the DPA that Landspítali and deCode genetics´ processing of personal data in the lead-up to an addition to the scientific study in question was not in accordance with data protection legislation.

The DPA's investigation began due to information received about blood samples taken at Landspítali in accordance with instructions given on 3 April 2020. According to the information, the samples were taken from all COVID-19 patients admitted to the hospital or who had visited Landspítali as outpatients due to COVID-19 over a specified time period and which had been sent to the genetics research company deCode genetics. The information received also indicated that the blood samples were transferred to deCode genetics before an addition to an ongoing scientific study by the company, i.e. the research project, Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes, was agreed but the National Bioethics Committee (NBC) gave permission for the addition on 7 April 2020. The NBC´s letter to deCode genetics, dated that day, states that the NBC had reviewed the application and set the condition that a specific informed consent be obtained from individuals able to give such consent before samples were obtained from them for scientific purposes.

The reply from deCode genetics states that blood samples were taken on 3-7 April 2020 from individuals with the COVID-19 disease admitted to Landspítali or who had visited the hospital as outpatients due to the disease and that this was before an informed consent due to the addition to the research was signed. This was done in accordance with instructions from the Chief Medical Officer and formed part of clinical work. Members of staff at Landspítali took the samples but deCode genetics staff managed their processing and aliquoting. Antibody testing was performed by deCode genetics and the results sent to Landspítali. The reply also states that after the NBC had granted permission for the addition to the study on 7 April 2020, only samples from COVID-19 patients who had signed an informed consent for participation had been processed, aliquoted and transferred to the company.

The reply from Landspítali states that the Head of the Department of Infectious Diseases had decided, i.a. because of the intended addition to the scientific study Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes, to begin the collection of blood samples in collaboration with deCode genetics, in his capacity as the study´s principal investigating doctor, and to send the samples to the company. The collection of samples and their transfer had also served a clinical purpose but they had ultimately only been used for scientific research purposes.

The DPA´s conclusion details that according to legislation on scientific research in the health sector, the DPA is the supervisory body for the processing of personal data in such research. The law makes it clear that it is not permitted to begin the processing of personal data for the purpose of scientific research in the health sector unless the permission of the NBC, in accordance with the law, has been obtained, in addition to consent from the data subject, as defined by the law and the NBC´s permission. It also states that in this case, it is clear that the addition to the study was permitted by the NBC on 7 April 2020, after blood samples were taken for the purposes of the addition. In view of this, and how explanations in relation to the blood sampling are contradictory, it was the DPA´s conclusion that Landspítali and deCode genetics´ processing of personal data in the lead-up to the addition to the scientific study in question was not in accordance with data protection legislation.

Reykjavík, 23 November 2021

Reference 2020061951/GRB

Decision

On 23 November 2021, the Data Protection Authority (DPA) made the following decision in case no. 2020061951:

I.
Procedure
1.
Facts of the case – Request for explanation and information

The DPA received information on 3 April 2020 that instruction had been given at Landspítali that blood samples be taken from all COVID-19 patients admitted to the hospital or who visited Landspítali as outpatients due to COVID-19 and that these should be sent to the genetic research company deCode genetics.

On 2 April 2020, the DPA had received from the NBC an application from deCode genetics, dated that day, where permission was sought from the NBC for an addition to the scientific study Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes. The application specified that […], the CEO of deCode genetics would be the principal investigator of the study. Among co-researchers would be […] Chief Epidemiologist, […] Medical Director of Health, […] Head of Landspítali´s Department of Clinical Microbiology, […] project manager for the study and other scientific staff at the company. […], Head of Landspítali´s Department of Infectious Diseases would also be a co-researcher, as well as the study´s principal investigating doctor.

With the addition, permission was sought to take serum and plasma samples from individuals diagnosed with COVID-19 and who were admitted to or who visited Landspítali as outpatients due to the disease to measure antibodies, obtaining these individuals´ consent once they had recovered. Only then would they be invited to participate. 

The DPA gave its opinion by e-mail on 3 April 2020, stating that the Authority had no objection to the NBC processing the application substantially. The DPA also stated that it had not determined whether the condition of Article 24 of Act No. 44/2014 on Scientific Research in the Health Sector applied with regard to obtaining consent in emergencies but that the Authority made the assumption that the NBC would conduct such an assessment.

deCode genetics´ application was processed by the NBC on 7 April 2020. The NBC´s letter to deCode genetics, dated on that day, states that the Committee has reviewed the application and that it sets the condition that specific informed consent is obtained from individuals competent to give such consent, cf. Article 22(1) of Act No. 44/2014, before samples are taken from them for the purposes of scientific research. Authorisation is given to take samples from those who are not competent to grant informed consent due to illness if conditions in Article 23(1) of Act No. 44/2014 are met.

According to the information received by the DPA, the blood samples taken were sent to deCode genetics before the above addition was agreed by the NBC on 7 April 2020 and consent was acquired from relevant individuals retrospectively. 

In view of the above, the DPA decided to investigate whether the personal data in question had been processed lawfully, fairly and in a transparent manner in relation to the data subject, cf. Article 8(1)(1) of Act No. 90/2018 on Data Protection and the Processing of Personal Data, cf. Article 5(1)(a) of Regulation (EU) 2016/679. deCode genetics and Landspítali were informed by letter dated 7 October 2020. In the letter, certain explanations were requested, as detailed in Chapter I.2.1 and I.2.2 below. The DPA did not receive a reply from deCode genetics within the required time period and the Authority´s request was therefore reiterated by letter, dated 26 November 2020. 

Among the data available in the case is a processing contract which the Chief Epidemiologist made with Landspítali on 21 December 2015, as well as a processing contract the hospital made with deCode genetics as sub-processor, dated 12 March 2020.

2.
Replies to the DPA´s Letter
2.1.
Replies on behalf of Landspítali

In Landspítali´s reply to the DPA, dated 10 November, an answer was received to the following question posed to the hospital and deCode genetics in the DPA´s letter dated 7 October 2020: 

  1. "Were blood samples taken from patients who had been diagnosed with the COVID-19                   disease and admitted to Landspítali or who had visited as outpatients due to the disease on         account of the above addition to deCode genetics´scientific study before the NBC granted             its permission for the addition on 7 April 2020?“

In Landspítali´s response, it says that the hospital´s CEO had made inquiries about the above from those within the hospital in a position to give instructions such as those the DPA received information about having been given on 3 April 2020. Landspítali had not been able to ascertain whether the instructions in question were given. However, […] the Chief Medical Officer had sent instructions on that day by e-mail to […] the hospital´s Head of Department of Clinical Research. A copy was sent to the study´s principal investigating doctor and […] doctor, in addition to the Landspítali CEO. In the e-mail, the Chief Medical Officer requests that it be ensured that samples from the blood of COVID-19 infected individuals (and those with suspected infections, if possible) be preserved by Landspítali. A dedicated member of staff (possibly a deCode genetics member of staff or in collaboration with the company) will oversee the blood sampling and that he does not have a problem with this. It also says that they discussed measuring important proteins in each and every patient´s sample, should the situation arise in the future that conclusions from such a measurement could have a deciding effect on treatment and vaccination of patients. Finally, it says in the e-mail, that any other utilisation of the COVID-19 samples obtained in this way by Landspítali, such as for scientific research, would be governed by rules on scientific research

For technical reasons, it was later not possible to gather the samples in question and this therefore did not take place. 

In the DPA´s letter dated 7 October 2020, four further questions were posed in addition to the one discussed above. These were not answered by Landspítali as they were based on the reply to question 1 being in the affirmative. The same questions were sent to deCode genetics and they are published here with the company´s replies in Chapter I.2.2.

2.2.
Replies on behalf of deCode genetics

In deCode genetics´ letter to the DPA dated 11 December 2020, replies were received to the DPA´s letter dated 7 October of the same year. The questions from the letter are as follows, as are the answers to each one:

  1. Were blood samples taken from patients that had been diagnosed with the COVID-19                    disease and had been admitted to Landspítali or had visited as outpatients due to the                    disease on account of the above addition to the deCode genetics scientific study, before the          NBC granted its permission for the addition on 7 April 2020?“

In deCode genetics' response, it says that blood samples were taken from 3-7 April 2020 from individuals with the COVID-19 disease who had been admitted to Landspítali or had visited as outpatients due to COVID-19 and that this was before an informed consent on account of the addition to the scientific study was signed. This was done in accordance with instructions from the Chief Medical Officer and formed part of clinical work. Landspítali staff took the samples but deCode genetics staff managed their processing and aliquoting. Certain doses of the samples were stored to make further services measurements and for possible measurements on account of scientific research, subject to permission from the NBC. 

Antibody measurements were made by deCode genetics and the results sent to Landspítali, as such conclusions can be useful in assessing patient condition and in making decisions about treatment. In addition, conclusions of antibody measurements were sent to the Chief Epidemiologist, as were conclusions from all antibody measurements from individuals who had been screened by deCode genetics for antibodies against the SARS-CoV-2-virus. The reply also states that the line between clinical work and scientific research is always somewhat unclear when dealing with an unknown disease. Finally, it says that after the NBC granted permission for the addition on 7 April 2020, only samples from the COVID-19 patients who had signed an informed consent for participation had been specifically processed, aliquoted and transferred to the company. 

  2. "If so [as detailed in question 1], what information was supplied and how?"

In deCode genetics' reply, it says that as the samples taken 3-7 April 2020 were obtained as part of a clinical service, no information was supplied, apart from the information doctors give to patients in their care. 

  3. "If so, as detailed in question 1, were any of the blood samples used for the scientific study             and then on what basis?"

In deCode genetics' reply, it says that after the NBC granted permission for an addition to the study on 7 April 2020, the study was introduced to individuals who had been diagnosed with COVID-19 and admitted to Landspítali or who had visited the hospital as COVID-19 outpatients. Those who decided to participate in the research and had signed an informed consent had been informed by the study's principal investigating doctor that samples might have been taken from them in the previous days on account of clinical services in accordance with instructions from the Landspítali Chief Medical Officer on 3 April 2020. All confirmed with him that they wanted these samples also to be used for the purposes of scientific research. 

The reply also states that on 12 April 2020, after a verbal inquiry from the Chief Executive of the NBC about the sample taking at the hospital, the party at deCode genetics responsible for communication with the NBC and the DPA had sent him a reply about the sampling by e-mail. In the e-mail, deCode genetics asked about the NBC's position on the preservation and use of samples taken before the Committee granted permission for an addition to the scientific study in question on 7 April 2020. Furthermore, it stated that if the NBC considered that samples acquired without consent on account of clinical services to Landspítali and the Chief Epidemiologist (with the possibility of use for research at a later date) should be destroyed, they would be destroyed. In connection with this, it says in deCode genetics' reply to the DPA, the Chief Executive of the NBC confirmed by e-mail on 15 April 2020 that the company's answers to his verbal inquiry had been passed on to the Committee and that they were saved with other data about the case. However, no reply was received from the Committee about the issues raised by deCode genetics when giving the replies. 

  4. "How was consent obtained for blood sampling after the NBC granted its permission on 7               April 2020? What information was supplied and how?"

In the reply from deCode genetics, it says that the study´s principal investigaing doctor introduced it to patients with the COVID-19 disease who had been admitted to Landspítali by letter and that he answered their questions. He received the consent from those who chose to sign it. The managing doctor of the COVID-19 outpatient ward had acquired participants in the same way. 

  5. "If the participaton of any of the patients was based on Article 23 of Act No. 44/2014, then               how were the conditions of that Article met?"

In deCode genetics' reply it says that no consent was obtained on the basis of the above Article. 

In the conclusion of the letter, it says that all intervention by deCode genetics in sampling, analysis and other assistance to Landspítali and health authorities was first and foremost for clinical purposes to assist the authorities with communicable disease control. The fact that these measures would also be of use to possible scientific research, which might later be conducted, was a secondary issue in this context.

3.
Further exchange of letters

In view of the above response from deCode genetics, where it is stated that samples were taken at Landspítali on 3-7 April 2020, despite the hospital's statement to the contrary, the DPA again sent a letter to Landspítali, dated 11 March 2021, requesting further explanation as detailed in Chapter I.3.2. The DPA also sent a letter on the same day to the NBC and requested the explanations detailed in Chapter I.3.1.

3.1.
The National Bioethics Committee's reply

In the NBC's reply to the DPA, dated 16 March 2021, responses were received from the Committee to the following questions:

  1. "Is the NBC's position, which deCode genetics requested by e-mail on 12 April 2020,                     available?"

In the NBC's response, it is stated that the samples in question, taken on 3-7 April 2020, were taken for treatment purposes and later used for scientific research purposes as available data. It was therefore not considered necessary to further contact deCode genetics on account of the matter. It is not within the remit of the Committee to issue instructions about the destruction of clinical samples. 

  2. "Why was the DPA not given the opportunity to comment on the preservation of samples               taken before 7 April 2020?"

In the NBC's reply, it is stated that the application to the Committee for the study in question and all additions to this were forwarded to the DPA on the basis of Act No. 44/2014 on Scientific Research in the Health Sector and that the DPA had not raised any objection to the Committee substantially discussing the applications.

3.2.
Replies from Landspítali

In Landspítali's reply to the DPA, dated 24 March 2021, the hospitals' response to the following questions were received:

  1. "What [accounts for] the discrepancey between the responses of Landspítali and deCode               genetics, but as stated above, deCode genetics states in its letter dated 11 December 2020           that blood samples were taken at Landspítali on 3-7 April 2020 and sent to deCode                       genetics?"

In Landspítali's response, it says that the taking of samples from the blood of COVID-19 infected patients and those with a suspected infection had been planned, if possible, and the samples were to be stored at Landspítali. This did not, however, take place for technical reasons, as already stated by the hospital. 

It also says that with further enquiries it emerged that the Head of the Department of Infectious Diseases and the study's principal investigating doctor had decided, on the one hand, with a view to the e-mail from the Chief Medical Officer to the Head of the Department of Clinical Research, and on the other hand, with a view to the planned scientific study with deCode genetics, to commence the collection of blood samples in collaboration with the company and to send them the samples. The response stated that the final position of the Head of the Department of Clinical Research on the capacity to carry out the instructions from the Chief Medical Officer had not been available until 6 April 2020. These samples were therefore in the end only utilised for the purposes of scientific research. 

  2. "If blood samples were taken on the days in question, what then is Landspítali's assessment        of whether it is the hospital or deCode genetics that is [the controller] for the processing of            that personal data?"

It is clear from Landspítali´s response to question 1 that the hospital does not consider itself to be the controller of the processing of personal data for the samples in question but that these are preserved and processed as part of the scientific study Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes.

  3. "If blood samples were taken on the days in question, was Landspítali´s Data Protection                 Officer consulted?"

In Landspítali's response, it is stated that the hospital's Data Protection Officer was not consulted. 

In view of Landspítali´s response to question 1 above, the DPA sent a further letter to Landspítali, dated 22 June 2021, where the question is reiterated. In Landspítali´s response to the DPA, dated 1 September of the same year, it is stated that the hospital cannot explain the discrepancy between the replies from the hospital and deCode genetics. Landspítali is not aware of replies having been received by the hospital in relation to patients' ID numbers and is not aware of such replies having being entered into the health records of individual patients.

II.
Criteria and conclusion
1.
Delimitation of the case – Scope of application

In accordance with the above, it is clear that blood samples were taken on 3-7 April 2020 at Landspítali and these used for the purposes of the scientific study Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes, before the NBC granted deCode genetics permission for an addition to the research on 7 April 2020.

Hence, this case revolves around the obtaining of consent from COVID-19 patients at Landspítali for the use of their blood samples for the purposes of the above scientific study and is therefore subject to Act No. 90/2018 on Data Protection and the Processing of Personal Data and Regulation (EU) 2016/679, as defined in Article 4(1) of the Act, cf. Article 3(2) and (4) of the Act and Article 4(1) and (2) of the Regulation. Pursuant to Article 39(1) of the Act, the case furthermore comes under the authority of the DPA. 

Pursuant to Article 30 of Act No. 44/2014 on Scientific Research in the Health Sector, the DPA monitors the processing of personal data in such scientific research.

2.
Controller – Processor – Processing contracts

The party responsible for the processing of personal data being in accordance with Act No. 90/2018 is called the controller. Pursuant to Article 3(6) of Act No. 90/2018, this refers to an individual, legal entity, government authority or other party who decides alone or in collaboration with others, the purpose and method for processing personal data, cf. Article 4(7) of Regulation (EU) 2016/679.

The processor is an individual or a legal entity, government authority or other party who processes personal data on behalf of the controller, cf. Article 3(7) of the Act, cf. Article 4(8) of the Regulation. 

The controller is obliged to ensure that the processing is in accordance with Act No. 90/2018 and Regulation (EU) 2016/679. Part of this is to ensure that the processor organises processing in accordance with the instructions of the controller. Those instructions must, in accordance with Article 28(3) of the Regulation, be documented in a contract where the subject and time period of the processing, its nature and purpose, type of personal data, categories of data subjects and the obligations and rights of the controller are identified. 

It is clear that the Chief Epidemiologist made a processing contract with Landspítali on 21 December 2015 and that on 12 March 2020, Landspítali made a processing contract with deCode genetics as a sub-processor. The latter contract provides that deCode genetics' processing of personal data on behalf of Landspítali consists of the collection of and screening for the COVID-19 virus in biological samples which the company itself collects or receives from the hospital. 

On behalf of Landspítali and deCode genetics, it is maintained that the blood samples taken on 3-7 April 2020 at Landspítali were originally taken for clinical purposes, although it is stated in the hospital's reply that the principal investigating doctor also made the decision to have the blood samples taken with a view to the planned addition to the scientific study Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes. In deCode genetics' response, it says that the company performed antibody tests and submitted its results to Landspítali, as these might be useful in assessing patients' condition and making decisions about treatment. It must be assumed that such antibody measurements by deCode genetics are allowed within the processing contract of the parties dated 12 March 2020.

Based on Landspítali's explanations that sampling took place on account of treatment, it is clear that the necessary data about the sample taking should have been registered in the data subject's health record, cf. Article 6(1)(7) of Act No. 55/2009 on Health Records. Furthermore, it is clear that on sending samples for analysis, necessary data must be shared for the identification of the samples. Landspítali must be considered to be the controller for the processing of personal data entailed in the above registration, as well as the processing of the identifying data in question. However, deCode genetics is the controller of the processing of the personal data that took place on account of the above addition. 

The parties' processing contracts are not analysed further in this context but it should be noted that these are discussed in the DPA's Decision, dated 23 November 2021 on the processing of personal data in connection with screening for the SARS-Cov-2 virus and antibodies to it (2020061954), as well as the DPA's Decision, dated the same day, on the security of personal data at the Landspítali Department of Clinical Microbiology unit located at deCode genetics´ premises (2020112772). 

It is clear from Landspítali and deCode genetics´ replies that the blood samples were also used for the addition to the above scientific study. This Decision will therefore, in Chapter 4 and Chapter 5 below, look at how this arrangement adheres to Act No. 90/2018 and Act No. 44/2014 on Scientific Research in the Health Sector, cf. Regulation No. 230/2018.

3.
The legality of the processing

All processing of personal data must come under one of the provisions in Article 9 of Act No. 90/2018, cf. Article 6 of Regulation (EU) 2016/679. In general, processing of personal data for the purposes of scientific research is to be based on the consent of the data subject, cf. Article 9(1) of the Act, cf. Article 6(1)(a) of the Regulation or the public interest, cf. Article 9(5) of the Act, cf. Article 6(1)(e) of the Regulation. 

In addition, the processing of sensitive personal data, as this is defined in Article 3(3)(b) of the Act, cf. Article 9(1) of the Regulation, must additionally be in accordance with one of the specific conditions in Article 11(1) of the Act, cf. Article 9(2) of the Regulation. These include that the processing of sensitive personal data is authorised if the data subject has given explicit consent to the processing for one or more specified purposes, cf. Article 11(1)(1) of the Act and Article 9(2)(a) of the Regulation. The processing of sensitive personal data is also authorised if it is necessary for scientific research purposes, provided that it is carried out on the basis of law which provides for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject, cf. Article 11(1)(10) of the Act, cf. Article 9(2)(j) of the Regulation. In this regard, Act No. 55/2009 on Health Records and Act No. 44/2014 on Scientific Research in the Health Sector should be referred to. 

In addition to authorisation in accordance with the above, the processing of personal data must be in accordance with all principles of Article 8(1) of Act No. 90/2018, cf. Article 5(1) of Regulation (EU) 2016/679. This case tests the principle of personal data being processed lawfully, fairly and in a transparent manner in relation to the data subject, cf. Article 8(1)(1) of the Act, cf. Article 5(1)(a) of the Regulation, but this principle is discussed in more detail in Chapter 4 below. The principle of clear definition of purpose with the processing, cf. Article 8(1)(2) of the Act and Article 5(1)(b) of the Regulation, i.a. that personal data should be collected for a specified, legitimate and objective purpose, is also tested here.

4.
Information supplied to data subjects and transparency

In scientific research, one must, as always, respect the general principles of data protection legislation in the processing of personal data. Among these is the principle that in processing personal data, care must be taken to process this lawfully, fairly and in a transparent manner in relation to the data subject, cf. Article 8(1)(1) of Act No. 90/2018 on Data Protection and the Processing of Personal Data and Article 5(1)(a) of Regulation (EU) 2016/679.

The requirement for transparency entails the controller´s duty to supply information to the data subject, cf. Article 17 of the Act and Articles 13-14 of the Regulation, which should always be observed, however, with certain exceptions. 

The demand for lawfulness and fairness entails i.a. that when processing is based on the data subject´s consent, that consent must be informed and not forced. Supplying information, in accordance with the above, must therefore be satisfactory. Furthermore, consent must be given of free will, which entails that there should be no clear difference in situation between the data subject and the data controller.

Article 13 of Regulation (EU) 2016/679, cf. Article 17 of Act No. 90/2018, emphasises the obligation of the controller when it comes to obtaining personal data from a data subject. For example, Paragraph 1 of the provision states that the data subject should be provided with the name and contact details of the data controller; contact details for a personal data protection officer, if applicable; and information on the purpose of the intended processing of personal data and its basis in law. 

The data controller should also, pursuant to Article 13(2) of the Regulation, give the data subject further information to ensure fair and transparent processing, including the period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period; the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; about there being the right to withdraw consent at any time, without though this having an impact on the legitimacy of the processing on the basis of the consent up until the revocation; and the right to lodge a complaint with a supervisory authority in the area of data protection. 

In addition to provisions in Act No. 90/2018 and Regulation (EU) 2016/679 about the controller´s obligation to supply information, Chapter V of Act No. 44/2014 on Scientific Research in the Health Sector should be adhered to when obtaining consent for the processing of personal data for such research. In addition, Rules No. 230/2018, set on the basis of that legislation, on how to select and approach people for participation in scientific research in the health sector and what information they must receive before consent is sought, should be observed. In Article 2 of the Rules, it is stated that the aim is to ensure the quality of the procedure that underpins the protection of personal privacy and to respect people´s self-determination when informed consent is obtained for scientific research in the health sector. 

Pursuant to Article 18 of Act No. 44/2014, consent shall be in writing and freely granted after the participant has been provided with adequate information on the study, risks it may entail, potential benefits and the nature of the participation. The participant shall be clearly informed that he/she may decline to take part in a scientific study or withdraw from participation at any time after it commences, without stating any reason. 

In Article 7 of Rules No. 230/2018, it is stated that the health practitioner or organisation that has treated or diagnosed the party in question explore the patient´s will for participation in scientific research in the health sector. In Article 8 of the Regulation, it is stated that patients´ interest in participating in scientific research may be explored verbally. It is not permitted to apply direct or indirect pressure on participants to gain their participation. This is particularly important when a health prcatitioner which the patient may feel obligated to introduces the research to his patient. 

In accordance with Article 10 of Rules No. 230/2018, before an individual is asked to participate in scientific research in the health sector, he should be presented with specific written information, aimed at the needs and ability of the prospective participant, and this should be explained further verbally, if necessary. The information must contain the name, position and workplace of the controller of the research and names of co-researchers (Item a); the purpose of the research, how it will be executed and its potential usefulness (Item b); who collaborates with the controller and who will see the data (Item c); what data will be used for the research, including whether biological samples will be used or whether data will be collected from medical records or other public records (Item e); and what permits the scientific research and the gathering of data is based on (Item i).

5.
The DPA´s conclusion

As discussed above, the reply from Landspítali, dated 24 March 2021, states that the Head of the Department of Infectious Diseases had decided, i.a. on account of the planned addition to the scientific study Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes, to commence blood sampling in collaboration with deCode genetics as the principal investigating doctor of the research and to send the samples to the company. The taking of samples and the transfer of these also served a clinical purpose but in the end they were only utilised for scientific research. 

In the reply from deCode genetics, it says that the samples in question were used for the addition to the above scientific study. It describes how the addition was introduced to COVID-19 infected individuals after permission had been granted by the NBC on 7 April 2020. Everyone confirmed to the study´s principal investigating doctor that they wanted the samples to be used for the purposes of the study and signed an informed consent to that effect. 

From Article 12(1) of Act No. 44/2014, it is clear that it is not permitted to begin processing of personal data for the purposes of scientific research in the health sector unless permission has been granted in accordance with the law by the NBC, in addition to the consent of the data subject, as is required in the Act. Furthermore, it is clear that if the taking of the biological sample had originally served a clinical purpose and that later a decision had been made to use it for the purposes of scientific research, such use is permitted with the same conditions. When consent is required, it shall be in writing and granted freely after the participant has received adequate information about the research. In this case, it is clear that the research addition in question was agreed by the NBC on 7 April 2020 or after the blood samples had been taken for the purposes of the addition. 

With a view to the above, as well as how explanations in relation to the blood sampling are contradictory, it is the assessment of the DPA that the processing of the personal data in question did not fulfil the requirement for personal data being processed lawfully, fairly and in a transparent manner in relation to the data subject, cf. Article 8(1)(1) of Act No. 90/2018, cf. Article 5(1)(a) of Regulation (EU) 2016/679, as well as the requirement of a clearly specified purpose with the processing, cf. Article 8(1)(2) of the Act and Article 5(1)(b) of the Regulation. 

As discussed above in this Decision, the CEO of Landspítali stated in his letter to the DPA, dated 10 November 2020, that he had been unable to verify that the instruction had been given at the hospital to take blood samples from all COVID-19 patients admitted or from those who visited the hospital as outpatients and that these should be transferred to deCode genetics. It was not until he made further enquiries within the hospital and after the DPA had sent a second letter on 11 March 2021, requesting specific explanations, that it emerged that the instructions in question had been given and the DPA was notified of this by letter from the hospital dated 24 of the same month. In the same letter from Landspítali to the DPA, it is stated that the hospital´s Data Protection Officer had not been consulted on the matter. It is therefore clear that overview was lacking in Landspítali about what went on in relation to blood samples taken on the days 3-7 April 2020 in the hospital and which were used in the addition to the scientific research Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes.

As detailed above, there must not be a clear difference in position between the data subject and the controller when obtaining consent. Article 8 of Rules No. 230/2018, which stipulates that prospective participants in a scientific research in the health sector should not be subjected to direct or indirect pressure to gain their participation in the research and that it is particularly important that when a health practitioner that the patient may consider himself obligated to introduces the research to his patients, applies. It is known that the Head of the Department of Infectous Diseases and the principal investigating doctor introduced the study to COVID-19 patients and obtained the consent of those who had been admitted to Landspítali. Article 10(1) of Act No. 44/2014 provides that the NBC has the role of evaluating scientific research projects in the health sector with the objective of ensuring that they are consistent with scientific and ethical principles. In accordance with this, this is a matter which should be evaluated by the NBC. 

Furthermore, this Decision discusses above that a party tasked with communication with the NBC and the DPA sent an e-mail to the CEO of the NBC requesting the Committee´s opinion on the preservation and use of samples taken before the Committee had granted its permission on 7 April 2020 for the addition to the study in question. The DPA points out that it would have been in accordance with good governance that the NBC alerted the DPA specifically about deCode genetics´ enquiry in light of the Authority´s role in this policy area. 

In replies from deCode genetics, it has been maintained that the boundaries between clinical work and scientific research is always fairly unclear when dealing with an unknown disease. In this regard, the DPA points out that Act No. 44/2014 applies to scientific research in the health sector and that this legislation must be respected despite a global pandemic, as stated in the Instructions of the European Data Protection Board (EDPB) No. 3/2020, on the processing of personal data for the purposes of scientific research in relation to the spread of COVID-19, issued on 21 April 2020. 

However, the DPA is also aware of the threat the COVID-19 disease has posed to Icelandic society since the beginning of the epidemic and the pressure Icelandic health authorities have been under. In view of these special circumstances, a fine has not been imposed in this case.

D e c i s i o n:

The processing of personal data by Landspítali and deCode genetics in the lead-up to the addition to the study Epidemiology of the SARS-CoV-2 virus and the effect of genetics and underlying diseases on the COVID-19 disease it causes, permitted by the NBC on 7 April 2020, was not in accordance with Act No. 90/2018 on Data Protection and the Processing of Personal Data, cf. Regulation (EU) 2016/679.

The Data Protection Authority, 7 January 2022

Ólafur Garðarsson

Chair

Björn Geirsson                            Sindri M. Stephensen

Vilhelmína Haraldsdóttir                            Þorvarður Kári Ólafsson