Privacy policy for the Blood Service Biobank

Why is my data being collected?

Your data is combined with the samples you have donated and collected in the Blood Service Biobank for research and product development related to health promotion, illness prevention, and the blood supply chain. In long-term biobanking seeks to promote health by facilitating studies that prevent diseases and identify disease mechanisms, and by supporting the development of treatments and diagnostics.

The biobank processes the personal data of sample donors for the purpose of carrying out tasks provisioned under the Biobank Act (688/2012). The purpose of the Biobank Act is to support research that utilises human biological samples and protect the rights of donors. The legal justification for processing personal data under the EU General Data Protection Regulation is the performance of a task carried out in the public interest. The task carried out in the public interest is to enable scientific research as referred to in the Biobank Act. The biobank processes special categories of personal data, such as health data and genomic data. The biobank processes personal data on the basis of Articles 6(1)(e) and 9(2)(i) of the General Data Protection Regulation (2016/679).

The Blood Service Biobank only collects samples and data from persons who have granted written consent to their use by the biobank. As of 1.1.2024, when the Biobank Act changes, the person’s consent to the collection of samples and the processing of both the sample and sample-related data will be required, as will their acceptance to attach information related to the person and their health status to the sample and to release it for biobank research. No action is required from people who have previously given biobank consent, as this will remain valid after 1.1.2024.

What data is collected about me?

• name, personal identity code, contact details,
• the date of the biobank consent or when consent and acceptance were granted,
• permissions specified in the biobank consent form or consent and acceptance form (permission to report incidental findings, permission to contact the donor concerning any further sample requests),
• the health information you have provided to the biobank (information on the
  additional information form collected in connection with the biobank sample),
• blood donation event and history data, information about blood group and blood suitability
• quality, number, and dates of samples stored in the biobank
• information about research projects for which samples and data have been released, quality and number of released samples and data,
• the data returned to the biobank from research projects (research results).

How is my data obtained?

The biobank stores personal data that you provided upon registration, in other words when you signed the Blood Service Biobank consent form or the biobank consent and acceptance form. If you fill out the biobank’s additional information form, the information provided therein will also be stored in the biobank registry. Data collected in conjunction with your blood donation will also be stored in the biobank. In addition, data analysed from your samples during biobank research is returned to the biobank.

For research utilising the Blood Service Biobank’s materials it may on a case-by-case basis, be necessary to obtain data from other data registries to supplement the sample you have provided, such as information concerning your health status, past medical treatment, or examinations. This data may be requested from patient registries, national social welfare and health care registries such as the statutory registries maintained by the National Institute for Health and Welfare (e.g. Care and Cancer registries), the registry on causes of death maintained by Statistics Finland, from registries maintained by the Social Insurance Institution (e.g. registry on the special reimbursement of medicine expenses), and from other biobanks. The Blood Service Biobank does not store or retain this information; instead, the data is made available to the project for research purposes for a specified duration, after which it is deleted from the research project registry.

For what purposes are my personal data used?

Material stored in the biobank registry may be transferred or released for biobank research. Researchers submit an application to the biobank describing the objective of research and the intended use of the samples and data. The applications are evaluated by the medical evaluation board of the Blood Service and the director of the biobank, and data is only released for applications that demonstrate the right to process the data under the biobank Act and otherwise meet the conditions for processing required by law and the Blood Service Biobank. The Blood Service Biobank only releases samples and related data for biobank research that has been carefully assessed in accordance with the Blood Service’s operating principles and values, while safeguarding the donor’s privacy.

The material may be released for research purposes to researchers representing domestic and international universities, hospitals, and research institutions, as well as to health care companies (for example, pharmaceutical companies, diagnostic and analytical laboratories). The data may also be released to researchers in the Blood Service’s own research groups for the purposes of research involving biobank samples. Research or product development work may be carried out in collaboration with the Blood Service or the rights to access the material may be granted to independent research groups.

The biobank data is transferred and released for research projects in a coded form (pseudonymized data), meaning that any information that may be used to identify the individual has been removed. Data that includes identifiers may only be released in special cases, for example to another data controller for the purpose of combining data from different registries. Even in such cases, directly identifiable information is removed after combining the data and before the samples and data are released for use in research. In each disclosure, the provided material is limited to the necessary for conducting the research.

The Blood Service signs an agreement with the recipient before the transfer, or release of the material, about the research use of the samples and data, the permitted period of use, restrictions on disclosure to third parties, and obligation to return the data. Any subcontractors used are required to employ sufficient technical and organisational measures to protect personal data.

Can my personal data be shared with parties outside of the EU?

The samples and data in the Blood Service Biobank may be transferred or released outside the EU and EEA for the purposes of research and product development, in compliance with the appropriate security measures. The grounds for transfer and the security measures to be taken are evaluated on a case-by-case basis, depending on the donor’s consent and the recipient of the data. In these cases too, the identifying information of both the individual and the sample remains only with the biobank.

In all cases, the Blood Service signs an agreement with the recipient on the intended use of the samples and data in research, the permitted period of use, restrictions on disclosure to third parties, and obligation to return the research data.

How is my data protected?

Employees of the Blood Service are under obligation to maintain confidentiality. Access to the registries is restricted by user credentials and permitted to only the individuals who need registry data in their duties. Registry screening and the addition, editing and deletion of data are restricted to those with access rights. Log data on the use of the registry is saved. Printed documents containing data are stored by the Blood Service in locked premises with controlled access and in locked cabinets.

Will my data be used for profiling or automated decision-making?

No.

For how long will my data be stored?

Your data will be stored in the biobank until further notice, and the necessity of storing the data will be assessed at least every 10 years.

How can I review my data and rectify any inaccurate information?

You have the right to know where your data and samples have been transferred or released to from the Blood Service Biobank, and from which registries or research data has been collected. You can review the information collected about you by completing, printing and signing the Request for data form from the Blood Service’s website and submitting it to the Blood Service by post or in person. The Blood Service will send you the information in the registry by post.

You can request the rectification of inaccurate information in writing using the Rectification request form found on the Blood Service’s website. You can also ask for your contact details to be updated over the phone.

Can I request the erasure of my data or object to the use of my data?

You can withdraw your biobank consent before you provide a sample and before the sample and related data are transferred to the biobank. You can also object to the future use of your samples and data in the biobank (exercising the right to object in accordance with Article 21 of the GDPR), in which case the biobank may no longer use or release the sample or related data for new projects. After a data subject has exercised their right to object, the biobank may no longer process personal data. The biobank will notify the research projects to which samples or data have been handed over about the use of the right to object.

After exercising your right to object, all data and samples concerning you will be deleted from the biobank’s registry, except for information concerning the exercising your right to object. You will be sent a confirmation of the erasure of the data.

Please note, that once you have done this, you can no longer submit a request for information to the biobank, as no data is stored as a rule. For example, after exercising your right to object, you can no longer enquire about which studies your samples and data were used in, or receive research results.

Can I lodge a complaint with the authorities?

If you feel that your personal data has not been lawfully processed, you may lodge a complaint with the competent supervisory authority.

Person responsible for the data registry

Kimmo Pitkänen, Manager, Person responsible for the Blood Service Biobank
The Finnish Red Cross, Blood Service
Härkälenkki 13
01730 Vantaa
tel. 044 434 4398

biopankki@veripalvelu.fi

You can contact the Blood Service Biobank’s Data Protection Officer by email at:

tietosuojavastaava@veripalvelu.fi

Updated on 1.3.2024