Information notice relating to the management of the University of Namur biobank

As part of its scientific research missions, the University of Namur operates the NAB-X Biobank, which has been notified to the Federal Agency for Medicines and Health Products (FAMHP). A biobank is defined as a structure that obtains, processes, stores and makes available human body material (HBM), such as blood samples, together with data relating to the material and to the donor.

These data are obtained either directly by the University of Namur from donors, where appropriate for the purposes of a study, or are provided by hospital institutions under an agreement concluded with UNamur.

The management and operationalisation of this biobank are based on the processing of traceable human material, which requires the ability to locate and identify the material at every stage, from its collection to its provision to researchers or its destruction. This traceability requirement, as well as the need to ensure the quality and biological safety of the material, intrinsically involves the processing of personal data.

The legal framework applicable to biobanks also requires the biobank operator to communicate data relating to the use of HBM to an approved ethics committee, which is responsible for issuing ethical opinions on the use of HBM, as well as to the FAMHP.

For the purposes of this activity, the University of Namur processes personal data falling into the following categories:

• General identification data [category grouping the following types of data: surname, first name, postal address, e-mail addresses, copy of identity card, identity photograph, telephone number …]
• Identifiers allocated by UNamur [category grouping the following types of data: donor identification number …]
• Personal characteristic data [category grouping the following types of data: age, gender …]
• Data relating to the context of collection [category grouping the following types of data: source and context of the collection, identity and contact details of the physician responsible for the collection …]
• Data relating to the context of the use of human body material [category grouping the following types of data: study supervisors, purpose of the study …]
• Traceability data [category grouping the following types of data: codes associated with the sample, dates of entry, exit and destruction, identity of recipients …]
• Data relating to proof of consent [category grouping the following types of data: date and purpose of consent, signatures …]

These data are used, under the responsibility of the physician managing the human body material (HBM), to:

• manage obligations relating to the traceability of human body material and the feedback provided by the HBM manager within the biobank to the data subject where research carried out by a third party generates clinically significant information for the data subject’s health;
• manage the collection and retention of the consent of persons whose human body material is collected, stored or used;
• manage the assessment of participants’ eligibility for a collection of HBM;
• manage the operation and operationalisation of the biobank, including the collection, processing, storage and destruction of HBM;
• manage the framework governing the provision of human body material and associated data to researchers;
• comply with reporting obligations and prior consultation of the ethics committee responsible for supervising the activities of the biobank;
• comply with the obligations imposed on biobank operators vis-à-vis the FAMHP.

• The use of human biological material and clinical data is carried out, as appropriate, to fulfill a public interest mission related to research (Article 6(1)(e) of the GDPR) or on the basis of consent specifically obtained from the individual for the processing of their data (Article 6(1)(a) of the GDPR). Consent may be withdrawn at any time without affecting the lawfulness of processing already carried out. 
• The processing of data related to proof of consent is carried out in compliance with legal obligations arising from the GDPR and the Law of December 30, 2008, on the collection and use of human biological material intended for human medical applications or for scientific research purposes, as well as the Royal Decree of January 9, 2018, on biobanks (Article 6(1)(c) of the GDPR). 
• The processing of data relating to the submission and follow-up of requests for opinions from the Ethics Committee regarding the storage or use of human biological material within the biobank is carried out to perform a task in the public interest related to research (Article 6(1)(e) of the GDPR).
• Data processing related to the traceability of human biological material, the management of donor consents, as well as reports submitted to the ethics committee overseeing the biobank and notifications to theAFPMS are carried out in compliance with legal obligations arising from the Law of December 30, 2008, on the collection and use of human biological material intended for human medical applications or for scientific research purposes, and the Royal Decree of January 9, 2018, on biobanks (Article 6(1)(c)).

For the purposes described above, the University of Namur also processes personal data belonging to the following special categories:

• health data relating to the assessment of participants’ eligibility for a collection;
• clinical data associated with the collection of HBM and the analysis of samples;
• genetic data associated with the analysis of samples.

The processing of these special categories of data is justified, depending on the context of the collection, where:

• it is carried out with the explicit consent of the data subject (Article 9(2)(a) GDPR); or
• it is necessary for scientific research purposes (Article 9(2)(j) GDPR).

Where special categories of data are processed in order to comply with the legal obligations of the biobank operator, such processing is carried out for reasons of public interest in the area of public health (Article 9(2)(i) GDPR).

The categories of persons whose data are processed for the purposes of this activity are as follows:

• persons who have been subject to a collection of human body material intended to be collected by, used through or stored in the biobank (and, where applicable, their legal representatives).

The data processed originate from one or more of the following sources:

• the data subject themselves;
• data provided by a third party or originating from third-party databases (including CHU UCL Namur – Godinne, Clinique Saint‑Pierre Ottignies, Clinique Saint‑Luc Bouge), in particular as regards residual human body material originating from a sample initially collected for the donor’s diagnosis or treatment and which proves redundant once those purposes have been fulfilled.

The data are processed exclusively by authorised persons and departments of the University for the purposes of carrying out the activity.

Internal recipients mainly belong to the following categories:

• the manager of the biobank’s human body material;
• authorised staff within the Faculty of Medicine and its Pharmacy Department (coded data only);
• researchers authorised to receive the data for research purposes (pseudonymised data only).

External recipients belong to the following categories:

• the physician responsible for the collection of HBM and the staff in charge of data entry under their supervision;
• external researchers and partners authorised to receive the data for research purposes (pseudonymised data only);
• the FAMHP, to the extent required by legislation for the performance of its legal missions.

The retention period is determined according to the following criteria:

• for data collected or used in the context of scientific studies: the need to retain the data for the purposes of carrying out a scientific study and for the internal monitoring of the provision of HBM and associated data;
• for human body material and associated clinical data stored in the biobank outside a clinical study: a minimum retention period of five years from storage in the biobank and a maximum of fifty years, the duration varying depending on the availability of residual samples;
• for data relating to compliance with legal obligations: for as long as the biobank exists and is required to demonstrate compliance with those obligations.

Data subjects whose personal data are processed have the rights described on the page
https://www.unamur.be/en/privacy-policy.

Any request or question relating to files processed in the context of this activity may be addressed to: nabx@unamur.be or dpo@unamur.be.