France has a specific framework to organise import/export of human samples for research. It is described under law and other regulations. They indicate the French agency delivering an authorisation and the different requirements to be fulfilled.

HUMAN SAMPLES

 

• Bioethics Law n°.2011-814, July 7th, 2011 (modifying the previous Law of 2004 published in article 12 of the French Official journal on  August 7th, 2004 and French Public Health Code): especially Article L1245-5 of the French Public Health Code

• Ordinance nº 2007-613, April 26th, 2007 (published in article 12 of the French Official journal on  April 27th, 2007)

• Decree n°2008-891, September 2nd, 2008 concerning the importation and the exportation of human body products

• Decree n° 2000-156, February 23th, 2000

• Arrêté du 20 avril 2000 fixant le modèle de dossier de demande d’autorisation d’activité d’importation et d’exportation à des fins scientifiques d’organes, de tissus et de leurs dérivés, et de cellules du corps humain

• French Public Health Code

• French Civil Code, Book One, Title One

• Comité Consultatif National d’Ethique pour les Sciences de la Vie et de la Santé, Advice n.77 of 2003 on the Ethical problems raised by collections of biological material and associated information data : « biobanks », « biolibraries », Problèmes éthiques poses par les collections de materiel biologique et les données d’information associées: « biobanques », « biothèques », available in  French and in English. 

ASSOCIATED DATA

 

• Data Protection Act n. 78-17, “Loi Informatique et Liberté” of 6 January 1978, consolidated version of 2009 (also available in English)

• Decree n°2005-1309 of 20^th of October 2005 on personal data protection (also available in English)

• Recommendations of the CNIL on personal health data processing,  “Délibération n°97-008 du 4 février 1997 portant adoption d'une recommandation sur le traitement des données de santé à caractère personnel”

 The French rules to export (updated on 2011-03-02)

DEFINITIONS

According to the Advice n.77 of the French National Consultative Ethics Committee of 2003, Joint declaration of the NER and the CCNE supplementing their Opinions on Biobanks

"Biobanks": Biobanks are privately or publicly maintained institutions for the long-term storage of human bodily substances and for the storage of personal data and information on the donors of these substances. Bodily substances include cells, tissue and blood, as well as DNA, the physical medium of genetic information. Data and information are deemed to comprise both genetic information from individuals and health- and lifestyle-related information on those individuals. The particularity of the biobanks to which these opinions are devoted lies in this twofold character: the specific importance of the collections of samples stems from the combination of samples with such data and information. Since any collection may become the subject of genetic research at some point, attention must also be given to the regulation of genetic research in the context of biobanks.

According to the Data Protection Act n.78-17 of 1978

"Data Processing": Collection, recording, use, transfer or disclosure of personal information, and any operating files or databases, including interconnections.

 

"Sensitive data": Personal data that reveals, directly or indirectly, the racial and ethnic origins, the political, philosophical, religious opinions or trade union affiliation of persons, or which concern their health or sexual life.

 

The "data controller" means, unless expressly designated by legislative or regulatory provisions relating to this processing, a person, public authority, department or any other organisation who determines the purposes and means of the data processing.

 

The "recipient of a processing of personal data" is any authorised person to whom the data are disclosed, other than the data subject, the data controller, the sub-contractor and persons who, due to their functions, are in charge of processing the data. However, the authorities who are legally entitled to ask the data controller to send them the personal data, in the context of a particular mission or that of the exercise of a right to receive such data, shall not be regarded as recipients.

PROCEDURES

Informed consent

 

The establishment applicant must detain prior informed consent from the donor of the biological material. Written consent must be established after clear information. The consent can always be withdrawn (Article L 1211-2 of the Public Health Code).

 

The donor has to give his consent for the storage, the handle, the use and the research purpose for which he has given its tissues and cells AND associated data.

 

Export of the human biological material and linked personal data has to be mentioned in the original consent form. 

In addition, the consent has to mention the processing of associated personal data for research purposes. Transfer of personal data to a non-European country must be specifically mentioned and approved by the data subject in the informed consent process.  The CNIL provides models of mentions .

When the samples are exchanged for the purposes of biomedical research this mention is evaluated by a Committee on Protection of Individuals (CPP).

 

“Non-Opposition” for secondary use of the biological material :

The consent for secondary use of human biological material is under a legal regime of “non-opposition” (opt-out) : After information for new use from researchers, human biological samples can be used except in case of opposition from the donor.

Information and consent of the donor can be waived if he/she cannot be found or when a CPP has gave its approval.

Authorisations and notifications

 

The applicant organism must comply with legal rules regarding human biological material collections : Articles L 1243- 3 and L 1243- 4 of the French Public Health Code.

 

For the activity of collection, storage, use of human biological material for research

 

Applications of the establishment’s activity to the Ministry of Research

Establishments which collect, store and transform human samples for transfer with scientific purposes need to declare this activity to the Ministry of Research (Article L 1243-3 Public Health Code).

Establishments which collect, store and transform human samples for cession need an authorisation from the Ministry of Research (Article L 1243-4 Pubic Health Code).

Application for advice on the research project/program to a Committee on Protection of Individuals (Comité de Protection des Personnes –CPP)

The research project/program including export of human biological material provided by a living donor has to be approved by a CPP.

 

For the export

 

Professional must be competent in medical biology.

Application for specific authorisation of the export to the Ministry of Research

According to Article R 1235-6 and following of the Public Health Code :

The specific form to be fulfilled is a request for an authorisation.

Download the authorisation form

The form must be sent to the French Ministry of Research :

 

Ministère de la recherche

Direction Recherche

1 rue Descartes

75231 PARIS CEDEX 05

Practical information to send the form

• in registered letter with acknowledgment receipt

• 4 copies

• accompanying letter from the legal representative of the applicant organism

Specific procedures for export

Institute/Researchers from the National Institute of Health and Medical Research (INSERM)

The applicant must fulfil the export application and send it to the Institut Thématique Multi-Organisme “ITMO Santé Publique” by e-mail.

 

“ITMO Santé Publique” contact : import.export.isp@inserm.fr

 

When the export includes storage of biological material the applicant must enclosed a copy of the declaration or authorisation granted by the Ministry concerning the establishment activity.

“ITMO Santé Publique, Mission infrastructures de Recherche Clinique” will complete the export file and will send it to the Ministry for examination.

The applicant will be notified of the Ministry acceptation. If the Ministry does not give an answer after 3 months the request must be considered as REFUSED.

After reception of the notification, the institute can formalize the export with it(s) partner(s) with a Material Transfer Agreement (MTA) under the Regional Direction (DR) supervision. The applicant has to send a copy of the export/import authorisation granted by the Ministry.

The MTA must be signed either by the Regional Direction or INSERM Transfert and the external partner(s).

The scientific responsible must send any modification of the dossier’s elements to the ITMO without deadline. The ITMO will transfer the modifications to the Ministry of Research.

Exporter must send copies of export’s monitoring documents to the DR.

Managers of the project shall regularly report advances and/or modifications of the project to the relevant services of INSERM.

Institute/Researchers from the National Center of Scientific Research (CNRS)

The applicant must fulfil the import/export file available online and send it to the Regional Direction of CNRS.

The use of MTA is required. The CNRS provides MTA model to be used.

Managers of the project shall regularly report advances and/or modifications of the project to the CNRS.

Data transfer requirements

 

Data protection

 

The French National Data Protection Supervisory Authority is called “Commission Nationale Informatique et Liberté” (CNIL).

 

Health data including genetic data are considered as sensitive data according to the definition of the Law(Law n. 78.17, Article 8-I). By principle collection, processing and transfer abroad of such data is forbidden except if the data subject has given its expressed consent or for necessary medical research (Law n.78.17, Article 8-II-2° et 8-II-6° and 8°). The transfer abroad is restricted to foreign countries ensuring a sufficient level of protection concerning personal data.

 

A data controller, Responsable du traitement, responsible for the legality of transfer and processing operations must be appointed by the personal data exporter (Law n.78-17, Article 3).

 

A data protection officer, Correspondant informatique et libertés (CIL), could be appointed by the data controller. This appointment provides certain advantages in the procedure (exemptions to declare) except when a data transfer to a non-european country is planned. The CIL must be declared to the CNIL (Law n.78-17, Article 22 III, Decree n.2005-1309, Title III). More information on the CIL’s designation, missions and responsibilities. 

 

Obligation of the data controller, Responsable du traitement des données

• To accomplish formalities with the CNIL
• To inform the data subject about the processing
• To respect the finality of the processing
• To respect the storage and processing duration
• To respect privacy and confidentiality
• To correct and update data
• To inform the CNIL of any changes in the processing
• To accept on-site inspections by the CNIL, and reply to any request for information

 

Rights of the data subject:

• Right to information about the processing
• Right to oppose and to withdraw his consent to processing and transfer
• Right to access to the data
• Right to correct data

 

The data subject must have given his/her written informed consent to the transfer and processing of his/her personal data abroad (Bioethics Law of 2004, Title II, Article 4; Law n. 78-17, Article 56, 69; Decree 2005-1309, Article 39, 90, 91). He/She must be informed of its right to opposition concerning the personal data storage and processing and the right to access to the data for requesting their modifications, withdrawal or destruction (Law n. 78-17, Chapter IV, V and IX; Decree n.2005-1309, Title VI, Chapter I). The type of data (identifying or anonymised), the purpose of the processing as well as the recipient identity, the data processor identity and data uses conditions should be explained to the data subject (Law n. 78-17, Article 57).

The data to be transferred should be anonymised or at least coded. Exemptions are overseen by Law and managed by the CNIL (Law n. 78-17, Article 55, 61; Decree n.2005-1309, Article 34).

Confidentiality and security must be ensured by the partners in the data processing and management (Law n.78-17, Article 34, 35 and Recommendations of the CNIL on personal health data processing of 1997).

 

Notification and Authorisation

 

This section applies to establishments which are not exempt of formalities by the law (Law n.78-17 Article 26 and 27).

 

The principle is to declare all data processing operation to the CNIL. Formalities change according to the finality of the data processing, the category of data, their destination and the use of certain guaranties in the operation. These criteria are used by the CNIL in order to define what kind of procedure is relevant for a specific case.

 

Specific rules are applying for data transfer and processing for a biomedical research.

 

Specific support for researchers (INSERM/CNRS)

The INSERM has established a Mission Informatics and Freedom, “Mission Informatique et Liberté”, intended to assist researchers depending from INSERM in administrative procedures and legal rules to comply with.

The CNRS has established specific internal procedures dedicated to its facilities for declaring data processing for research purposes to the CNIL (CNRS, Guide Règlementation, Fiche 4). Forms are available on the CNRS website.

The CNIL will oversee the respect of the Data protection law during the research project/program.

 

The receiver country must be considered as being sufficiently protective of personal data. Export of personal data for scientific research to another country is only authorised for a lawful purposes if this State ensures an adequate protection as defined by the European Commission (Same level of protection as in France; Law n. 78-17, Article 31, III; Article 68; 69; 70). The CNIL published an interactive map concerning the level of protection ensured by States.

 

DATA TRANSFER WITHIN THE EU

 

All European member States are considered as sufficiently protectors of rights and freedom concerning personal data processing. Export with these European countries does not require specific declaration if they have been planned within the original declaration or authorisation of processing. Personal data always need to be coded unless specific derogation.

 

DATA TRANSFER OUTSIDE THE EU MEMBER STATES

 

When the export of human biological material includes the processing of personal data the declaration of data transfer should be done electronically to the CNIL before the data transfer and processing within a Non-European State. Detailed information can be found in the Decree 2005-1309 dedicating its Title VII to data transfer outside the EU.

There are two kinds of procedures to perform with the CNIL, case by case: the notification (simplified declaration procedure, point A below) or application for advice and authorisation (point B below). These procedures have common provisions (Law n.78-19, Chapter IV, Section 3) and specific rules according to each case.

 

A- Data transfer (or export) notification for medical research purposes (simplified declaration procedures)

 

Methodology of reference

This declaration procedure, discribed by the Data protection Act (Law n.78-17, Chapter IV, Section 1), aims the most common categories of data processing which is not likely to be in violation of privacy or liberties (Law n.78-17, Article 24-I). 

Processing having a same finality, or linked finalities, concerning the same kind of personal data or having the same recipient can be declared in a unique declaration (Law n.78-17, Article 23-II).

 

A simplification of notification process has been performed for transferring personal data within a biomedical research project approved by a CPP. This simplification consists in the respect of a Methodology of reference. This is the object of a commitment declaration. This does not aims researches excluded from the scope of the Methodology (Methodology, point 1.2). Usually, the Methodology of reference and simplified procedure apply for the processing involving unidentifying data (Law n.78-17, Article 24; Decree 2005-1309, Article 27).

 

Methodology of reference for personal data processing in biomedical research (MR-001).

 

Contractual clauses, Binding Corporate Rules (BCR) and Safe Harbor (for transfers to USA) ensuring an adequate level of data protection in the export

When the receiver is established in a country which has been not considered as ensuring a sufficient level of data protection the exporter can introduce contractual clauses to enhance data protection and allows a secured exchange (Law n.78-17, Article 69). Other systems are planned as BCR and Safe Harbor. For more information consult the CNIL website and the following practical guides (cf. infra).

 

When the processing is not related to a Methodology of reference the operation must hold the positive advice from the Consultative Committee on data processing for biomedical research, Comité consultatif sur le traitement de l’information en matière de recherche dans le domaine de la santé (CCTIR),and an authorisation delivered by the CNIL (cf. point B, below).

 

B- Advice/Authorisation for the transfer and processing of personal data outside the EU for medical research purposes

 

This applies to activities or data which are not concerned by the “simplified procedure”.

This procedure is described by the Data Protection Act (Law n.78-17, Chapter IV, Section 2) and concerns, among other, genetic data processing (Law n.78-17, Article 25-I 2°).

Processing having a same finality, concerning the same kind of personal data or having the same recipient can be authorised by a unique decision from the CNIL (Law n.78-17, Article 25-II).

 

The procedure includes two steps:

 

• Approval from the Consultative Committee on data processing for biomedical research (CCTIRS). This positive advice is a prerequisite for the processing of the authorisation application by the CNIL.

More explanations on the CCTIRS and practical information are available in the document published by the French Ministry of Research entitled “The CCTIRS use manual”, “Le CCTIRS mode d’emploi” .

Application form for the CCTIRS advice is available on the CNIL website.

 

•  Application for authorisation to the CNIL (including export by principle) before starting the transfer and the processing of personal data in another country (“research authorisation”). Applications should be preferably done online using electronic forms but printable forms for the CNIL authorisation are also available on the CNIL website. When the application is done using paper forms delays for the treatment of the application could be longer.

 

After two month without response by the CNIL, the processing is considered as AUTHORISED.

 

Where you are not aimed by this authorisation you have to notify the CNIL as described above (point A).

 

For more information on the French data protection system, notification process and rules, you can consult the legal pathways website, section “France”.

 

The infringement to the declaration/authorisation processes to the CNIL involves penalties according to French Penal Code.

 

Practical Guides for the declaration to the CNIL

• CNIL, Practical Information Guide on formalities for the creation (and processing) of data for medical research, of 2008, providing specific information on administrative processes. 
• Guide for the transfer of personal data to Non-European countries and Guide for using specific processes to frame the exchange in an adequate protection way (Contractual clauses, Binding Corporate Rules etc.).

 

In case of doubt on the procedure to follow you can contact the CNIL.

 

CNIL contact:

 

Commission Nationale de l’Informatique et des Libertés

21, rue Saint-Guillaume - 75340 Paris Cedex 07

Téléphone: 01 53 73 22 22

Site internet: www.cnil.fr

 

Transport requirements

 

Specific mentions on the external packaging :

• the « elements or products of human origin » mention completed if necessary, with the mention “autologous use”;

• the precise nomination of the element or of the product;

• if necessary, the trade name associated to the element or the product;

• the trade name of the uses provide in articles L. 1245-4 and L. 1261-2 of the French public health code at which the element or the product is destined;

• for the importation, the names and addresses of the supplier, of the mandated organism to import and of the recipient;

• for the exportation, the names and addresses of the mandated organism to export and of the recipient.

Many revisions of the law have been made, but there is no update of the cross references between the different parts of the regulation of import and export of biological samples for research.

 

This regulation excludes gametes, gene and cell therapies. A new regulation is covering these activities since May 2008, but is only concerning therapeutic uses.