Privacy Statement for Blood Service Biobank Register

Why is my data collected?

The Blood Service Biobank collects your data together with the samples you have donated for purposes of medical research and product development. Biobanking is a long-term effort that seeks to promote health by facilitating studies that prevent disease and identify disease mechanisms and by supporting the development of treatments and diagnostics.

The Biobank processes the personal data of sample donors for the purpose of carrying out work as provided for under the Biobank Act (688/2012). The purpose of the Biobank Act is to support research that utilises human biological samples and to protect the rights of donors. The legal justification for processing personal data under the EU General Data Protection Regulation is to carry out work that is in the public interest. The work carried out in the public interest enables scientific research to be conducted as referred to in the Biobank Act. The Blood Service Biobank collects samples and data only from persons who have given their biobanking consent in writing.

What data is collected about me?

• Name, personal identity code, contact details
• The date of your biobanking consent
• Permissions specified in the biobanking consent (permission to report any incidental findings, permission to contact you concerning any further sample requests)
• Health information you have provided to the Biobank (supplementary information form completed in conjunction with your biobanking consent)
• Blood donation events and history, blood group and blood compatibility data
• Quality and quantity of your samples stored in the Biobank, as well as when and where the samples were provided
• Research projects to which the samples and data have been disclosed and the quality and number of these samples
• Research results returned to the Biobank.

How is my data obtained?

The Biobank stores data that you have provided upon registration, in other words when you signed the Blood Service Biobank consent form. If you complete the Biobank Supplementary information form, the information provided therein will also be stored in the registry. Data collected in conjunction with your blood donation will also be stored in the Biobank. In addition, data analysed from your samples during Biobank research is returned to the Biobank.

On a case-by-case basis, the material provided by the Blood Service Biobank to research projects may need to be supplemented by data obtained from patient registries, national social welfare and health care registries such as the statutory registries maintained by the National Institute for Health and Welfare (e.g. Care and Cancer registries), the registry on causes of death maintained by Statistics Finland, or from registries maintained by the Social Insurance Institution (e.g. registry on the special reimbursement of medicine expenses) on your state of health or past medical treatment or examinations. The Blood Service Biobank does not store this data; however, the data is made available to the project for the purposes of research for a specified duration, after which it is deleted from the research project registry.

For what purposes is my data processed?

Material stored in the Biobank Registry may be transferred or disclosed for purposes of Biobank research. Researchers submit an application to the Biobank describing the objective of the research and the intended use of the samples and data. The applications are evaluated by the medical evaluation board of the Blood Service and the director of the Biobank, and data is only disclosed for applications that demonstrate the right to process the data under the Biobank Act and otherwise meet the conditions for processing required by law and the Blood Service Biobank.

The material may be disclosed for research purposes to researchers representing Finnish and international universities, hospitals and research institutions, as well as to health care companies (for example, pharmaceutical companies and diagnostic and analytical laboratories). The data may also be disclosed to the Blood Service’s own research groups for purposes of research involving Biobank samples. Research or product development work may be carried out in collaboration with the Blood Service or, alternatively, access rights to the material may be granted to independent research groups.

Any data transferred or disclosed to research projects is in coded form, in other words any information that may be used to identify the individual has been removed. Data that includes personal identity codes may be disclosed only in special cases, for example to another data controller for the purpose of combining data. Even in such cases, directly identifiable information is removed after combining the data and before the samples and data are disclosed for use in research. In each disclosure, the material provided is limited to that necessary for conducting the research.

Before the transfer or disclosure of the material, the Blood Service signs an agreement with the applicant concerning the intended use in research of the samples and data, the permitted period of use, restrictions on disclosure to third parties, and obligation to return the data. Any subcontractors used are required to employ sufficient technical and organisational measures to protect personal data and sign a data processing agreement.

Upon request, you can obtain information on the recipient to whom the Blood Service Biobank has transferred or disclosed your data and samples, and from which registries or studies data has been collected.

Can my data be transferred outside the EU?

The samples and data in the Blood Service Biobank may be transferred or disclosed outside the EU and EEA for purposes of research or product development, in compliance with the appropriate security measures. The grounds for transfer and the security measures to be used are evaluated on a case-by-case basis. In these cases too, the Biobank refrains from disclosing personally identifiable information relating to both the sample and the data.

In all cases, the Blood Service signs an agreement with the recipient on the intended use of the samples and data in research, the permitted period of use, restrictions on disclosure to third parties, and obligation to return the data.

How is my data protected?

Employees of the Blood Service are under obligation to maintain confidentiality. Access to the registries is restricted by user credentials and permitted only to those individuals who need registry data in their duties.

Registry screens and the addition, editing and deletion of data are restricted to those with access rights. Log data on the use of the registry is saved. Printed documents that contain data are stored by the Blood Service in locked premises with controlled access and in locked containers.

The samples and data are disclosed only to research projects considered by the Blood Service to be ethically acceptable and trustworthy. The samples and data are disclosed to research projects in coded form to ensure that all personally identifiable information on the sample and data is retained by the Biobank.

Will my data be used for profiling or automated decision-making?

No.

For how long will my data be stored?

Your data will be stored in the Biobank until further notice, and the need for storage will be assessed periodically.

How can I review my data and rectify any inaccurate information?

You may check the data collected about you by completing, printing and signing the Request for data form available on the Blood Service website and submitting it to us by post or in person. The Blood Service will send your data in the register to you by post.

You may request rectification of inaccurate information in writing by using the Rectification request form found on the Blood Service’s website. You can also ask for your contact details to be updated over the phone.

Can I request the deletion of my data or object to the use of my data?

Yes, you can withdraw your biobanking consent at any time.

If your material stored in the Biobank has not yet been disclosed to any research projects, you may request that all your data be deleted from the Biobank registries. In the event that your material has a already been disclosed to a research project, your data cannot be deleted completely. Instead, your original consent must be stored together with your later withdrawal of consent. For example, in order to verify the accuracy of research results, it may sometimes be necessary to store the material used in research. After you have withdrawn your biobanking consent, your samples and data will no longer be disclosed to other research projects.

If you wish to request the deletion of your data, please fill in

1. the Rectification request form (available on the Blood Service Privacy Policy webpage) and
2. the Withdrawal of biobanking consent form (available on the Blood Service Biobank webpage), and send the signed forms to the Blood Service Biobank.

Can I lodge a complaint with the authorities?

If you feel that the processing of your personal data is not lawful, you may lodge a complaint with the supervisory authority.

 

Person in charge of the registry and contact details

Kimmo Pitkänen

Finnish Red Cross Blood Service

Härkälenkki 13

FI-01730 Vantaa, Finland

tel. +358 44 434 4398

biopankki(at)veripalvelu.fi