In Italy there is no specific legal framework for exchange of human tissues and cells for research.

Italian regulation regarding human samples and associated data is encompassed in personal and sensitive data protection acts (laws, decrees, guidelines and authorisations), according to the interpretation that the exchange as well as import/export of biological material for research uses can be considered “treatments” (term used by law) of samples and related data.

Moreover, ethical guidelines and opinions were adopted on biobanks activities by the Italian National Bioethics Committee (CNB) in association with the National Committee for Biosecurity, Biotechnology and Life Sciences (CNBBSV - Comitato Nazionale per la Biosecurezza le Biotecnologie e le Scienze della Vita) inspired by European and International regulation (e.g. Organisation for Economic Cooperation and Development (OECD) Guidance for the Operation of Biological Research Centres (BRCs) : Certification and Quality Criteria for BRCs of 08 January 2004; and the Recommendation of the Council of Europe, Rec(2006)4 of the Committee of Ministers to member states on research on biological materials of human origin, adopted on 15 March 2006 at the 98th meeting of the Ministers’ Deputies).

HUMAN SAMPLES

• Circular n.3 of the Italian Ministry of Health on recommendation for the transport security of infected biological material (08/03/2003)

• Circular n.16 of the Italian Ministry of Health on shipment of perishable biological materials and/or potentially infected (20/07/94)

• National Bioethics Committee and National Committee for Biosecurity, Biotechnology and Life Sciences, Presidency of the Ministers Council: Collection of biological samples for research purposes: the informed consent (16/02/2009)

  Purpose and scope

  This document provides practical information and models concerning the biological material donor informed consent. Models are in relation to the purposes and use of the material and they are varying from a specific consent to a broad consent, focussing on the partially restricted consent for research.

• National Bioethics Committee and National Committee for Biosecurity, Biotechnology and Life Sciences, Presidency of the Ministers Council: Guidelines for the recognising and accreditation of research biobanks (2008)  

  Purpose and scope

  These guidelines of 2008 provide core information for the accreditation of Italian research biobanks, including storage, distribution and traceability conditions for biological material. They are a complement of the guidelines of 2006 listed below.

• National Committee for Biosecurity, Biotechnology, Presidency of the Ministers Council: Guidelines for the institution and the certification of biobanks (19/04/2006)

  Purpose and scope

  These guidelines containing information on biobanks give general and technical instructions for the acquisition, maintenance and distribution of biological materials. It contains also information on the control of Biological Resource Centres (BRC) as defined by the OECD.

  The purpose of these guidelines is to ensure the highest quality and authenticity of the biological material, the safety for research and development in various laboratories and to contribute to health protection ofthe laboratory staff, the public and the environment.

  It provides a definition of “biobank”, guidelines for good management, certification and criteria to ensure the rights of biological material donors for biomedical research.

ASSOCIATED DATA
 

• General Authorisation for the Processing of Genetic Data

  Purpose and scope

  This authorisation applies to the processing of genetic data, and also to the collection and use of biological samples for health care and research purpose. This originally only applied from April 2007 until 31 December 2008, but its effectiveness is regularly extended following the Autorità Garante decisions. Actually the general authorisation apply until the 30th June 2011 (see the coresponding decision of the Autorità Garante).

• Legislative Decree n. 196/2003, Personal Data Protection Code; available in English (30 June 2003)

  Purpose and scope

  This Decree is a “Code” on protection and treatment of personal data in any field, there is a specific section regarding the treatment of personal and sensitive data for scientific research or statistical and historical purposes. It provides rules of international flows. The Decree does not mention biological samples and human bodily materials, however information and data deriving from processing and analysing biological material are clearly to be referred to as sensitive personal health data. This Decree shall not apply to anonymous data.

• Guidelines for Data Processing within the Framework of Clinical Drug Trials, issued by the Italian Data Protection Authority. (24/07/2008). Especially §10 “Cross-Border Data Flows”.

  Purpose and scope

  This paragraph, within the mentioned Guidelines, deals with the lawful way of transferring to non-European countries (where there could be no adequate protection of personal data) and also to the USA, the information relating to individual/patients as well as biological samples of the same individuals involved in studies such as clinical and pharmacological trials. The paragraph refers to “standard contractual clauses” (see norms ** below) and points out that in order to make use of the said clauses, it is necessary to specify the roles played by various entities involved in transfer and processing of the data and samples (i.e. the data exporter must be the actual “data controller” while the data importer must be the actual “data processor” or otherwise a distinct “data controller”. Additionally, the main processing operations, the transferred data and samples are intended for have to be specified.

  (**) see (for transfer to non-EU countries)

  • The European Commission's decision dated 27 December 2001, no. 2002/16/EC, amended in 2010 by the European Commission's decision no.2010/87/EU, and the related Autorità Garante's decision no. 3 dated 10 April 2002, document no. 1065361, and the decision no.35 dated 25 March 2010, document no. 1728496,
  • The European Commission's decision no. 2001/497/EC dated 15 June 2001, and the Autorità Garante's decision dated 10 October 2001, document no. 42156; Additionally, the European Commission's decision no. 2004/915/EC dated 27 December 2004 and the Autorità Garante's authorisation dated 9 June 2005, document no. 1151949.

Moreover (for transfer to USA):

• The European Commission's decision no. 2000/520/EC dated 26 July 2000 and the Autorità Garante's authorisation dated 10 October 2001, document no. 30939.

 The Italian rules to export (updated on 2011-02-15)

DEFINITIONS

For the purposes of the General Authorisation for the Processing of Genetic Data (22/02/2007)

"Genetic data" shall mean any data that, regardless of its type, concerns an individual's genotypic characteristics, or the pattern of inheritance of such characteristics within a related group of individuals.

"Biological sample" shall mean any sample of biological material containing information on an individual's genotypic characteristics.

"Genetic test" shall mean the analysis, for clinical purposes, of a specific gene, or of a product and/or function thereof or of other DNA constituents and/or a chromosome, in order to carry out a diagnosis or confirm a clinical suspicion in an individual already affected by disease (diagnostic test), or else in order to detect or rule out a mutation associated with a genetic disease that might develop in a healthy individual (presymptomatic test), or in order to assess an individual's liability to develop common diseases (predictive test).

According to the Legislative Decree n. 196/2003 (30/06/2003)

“Processing for scientific purposes” shall mean any and all processing operations that are performed for purposes of study and systematic research with a view to developing scientific knowledge in a specific sector (Section 4 of the decree).

According to the Guidelines for the institution and the certification of biobanks of the National Committee for Biosafety and Biotechnologies (19/04/2006)

“Biological Resource Centres” (BRC in English; CRB in Italian, “Centri di Risorse Biologiche”)

BRC, as defined by OECD, provides services and preservation of living cells, genomes of organisms and information relating to inheritance and functions of biological systems.

They preserve

• banks of cultivable organisms (e.g. microorganisms, plant cells, animal and human cells) and their replicable parts (e.g. genomes, plasmids, viruses, DNAs),
• viable but not cultivable organisms,
• cells and tissues,
• databases containing information about the molecular, physiological and structural information relevant to those banks and mobile computing.

“Biobanks” (point 3.3 of the Guidelines)

Biobanks in Italy are referred to as “Services Unit, without lucrative scope, finalized to the collection and storage of biological material for diagnosis, biodiversity studies and research”. Biobanks must be framed within activities of the BRC (Biological resource centres).

There are two kinds of biobank in respect of purposes and type of tissues:

• “Genetic biobank” with research purposes, where personal, clinical and genealogical data are necessarily linked to the sample, and
• “Human tissue biobank” with more therapeutic purposes and more focussing on cancer research.

PROCEDURES

Who can export?

The applicant shall be an institute (public/private organisation) officially registered and certificated by regional authorities or autonomous provinces and the Italian Ministry of Health (General Authorisation for the Processing of Genetic Data, point 2).

The procedures for registration and certification by territorial authorities do not exist at the moment.

• Certification: refers to the requirements for biochemical laboratories (ISO norms).
• Accreditation refers to “peer accreditation”.

Authorisations:

The authorisation from the Data Protection Authority (Autorità Garante) is required at the beginning of any kind of “treatment” of sensitive and particularly genetic data; that means export and import of biological samples and related data and information are to be authorised in principle by the authority and the request must be done by the institution or biobank before starting its activities. The authorisation is valid for a period of time and the authority renews it periodically by a general document which covers type of institutions and type of activities (called “treatment”) import and export included.

In any case, Italian law specifies that the respect of the “Good Practices Code” concerning sensitive data treatment is taken into account for the Garante authorisation and processing legality (Legislative Decree n. 196/2003).The export/import of biological samples is to be considered within the activities and for the aim of medical research projects which need an approval from the Local Ethics Committee or by a regional or local competent authority (General Authorisation for the Processing of Genetic Data).

The research centre should hold a quality certification. The certification ensures that the centre respects the level of quality required in the field of security, hygiene, and organisation (e.g. ISO terms: ISO 9001 for all health structures and specific ISO 15189 for genetic biobanks and laboratories).

The certification shall ensure the biological material integrity and quality is guaranteed in the storage, handling and distribution of human samples (National Bioethics Committee and National Committee for Biosecurity, Biotechnology and Life Sciences, Presidency of the Ministers Council: Guidelines for the recognising and accreditation of research biobanks of 2008, page 10).

Exporter liabilities in the exchange

• To detain written donor’s informed consent for storage, use and distribution of the human biological sample
• To detain prior authorisations by Local Ethics Committee (concerning ethical aspects of the research and the use of genetic information) and National Data protection authority (for the institute or hospital that conduct the genetic data treatment)
• To notify of the operation to the Data protection authority (Autorità Garante)
• To ensure biological material quality, authenticity, safety
• To ensure the traceability of the material
• To ensure the confidentiality and security of the associated data transfer and processing
• To ensure the exchange and transport security, biosafety (packaging, labelling)
• A Material Transfer Agreement (MTA) undersigned by the exporter and the receiver

Informed consent:

Written informed consent, for any kind of “treatment” and also to export biological material and associated data for research purposes, is required from the sample donor (Legislative Decree n. 196/2003, Section 43 and 77, Guidelines on biobanks 2006, point 3.7; Guidelines of 2009 on informed consent).

In fact, human biological material and genetic information associated must be treated as any other medical information, as “personal sensitive data” and therefore it is forbidden to give this information to third parties, another European country or third country, without written explicit consent from the biological material donor.

The general donor’s informed consent shall contain clear information on

• Research purposes, storage duration, uses of biological sample
• Localisation of the biological sample storage and any shipments of samples (here is the export specification) within the scope of the study and/or of the Biobanking project
• Risks and benefits for the donor and/or the society/institution
• Identification of all entities involved in data processing with their roles and responsibilities;
• The “Titolare” (the controller) of the personal data treatments and the “Responsibles” of the Institution and/or Biobank, their addresses and telephones
• Assurance that the purpose of data processing is fair, lawful and legitimate;
• Implementation of precautionary security measures to reduce risks on data disclosure
• Biological material and sensitive data accessibility
• Commercial uses of the output (if there is any)
• Results of the research
• Possibilities of withdrawal consent (on the storage, the use or the transfer of samples and data) and the right of the donor to oppose to the use for legitimate reasons
• Explicit authorisation by the donors to the “treatments” of his/her personal data on the basis of the Legislative Decree n. 196/2003. CONSENT WITHOUT THIS LEGAL SPECIFICATION IS NOT VALID.

The National Ethics Committee together with the National Committee for Biosafety, Biotechnology and Life Sciences provided a model of consent (National Bioethics Committee and National Committee for Biosafety, Biotechnology and Life Sciences “Recommendations on informed consent concerning human biological materials used in research purpose” of 2009.You can use the “consenso informato” model p.22).

Informed consent for secondary use

In principle, informed consent for secondary use of human biological material already stored shall be required when a new use (as export and external storage and uses) of the human biological sample and data was not originally planned on the first consent (National Committee for Biosafety and Biotechnology Guidelines for the certification of biobank of 2006, point 3.9 and National Ethics Committee together with the National Committee for Biosafety, Biotechnology and Life Sciences Guidelines of 2009 on informed consent):

• Donor’s informed consent is required when data are directly or indirectly identifiable
• However, when tissues and cells are not linked to identified or identifiable individuals the material could be used in secondary medical research without seeking the consent of the donors in retrospect.
• Consequently, it is possible to state that Consent is not required when the processing concerns complete anonymous or irretrievably anonymized data (Legislative Decree n. 196/2003).

In case of doubt on the necessity of a new informed consent for a secondary use the Institution carrying out the research or managing the Biobank has to require the Ethics Committee approval.

Note: When scientific data have been produced with the consent of a person, she/he should not have the right to ask for their destruction but only the anonymisation of the data, while she/he may always ask for the destruction of the biological samples.

Samples and data international transfer legal conditions

(Legislative Decree n. 196/2003, Section 43, 44 and 45; General Authorisation for Genetic Data Processing 2007 and the Guidelines for Data Processing within the Framework of Clinical Drug Trials, issued by the Italian Data Protection Authority. 24 July 2008, §10 “Cross-Border Data Flows”).

The samples and data transfer to European or non-European countries must be necessary for the research purposes and requires that the biobank is included in the scope of the General Authorisation for the Processing of Genetic Data issued by the Italian Data Protection Authority (“Garante per la protezione dei dati personali”). This means that each institution which runs a biobank and/or the scientific projects which makes use of genetic data must be authorised by the Italian Data Protection Authority. Modalities to be authorised depends on the nature of the Institution (public/private) for which there are general authorisation issued by the Authority periodically or specific authorisations.

The General Authorisation provides permission to export/transfer of human biological samples and/or data used for scientific or statistical research purposes if the biobank is officially registered and respects all the requirements included in this General authorisation.

Consequently, an authorisation issued by the Garante is only required for specific and/or exceptional circumstances (General authorisation for the Processing of Genetic Data, point.10). In this case, Italian law specifies that the respect of the “Good Practices Code” concerning sensitive data treatment is taken into account for the Garante authorisation and processing legality (Legislative Decree n. 196/2003).

To export within the European Union:

To export human biological samples and linked data within the European Union the exporter needs to obtain prior “authorisations” by Local Ethics Committees and, if necessary, Personal Data Protection Authority. While, the “notification” of the transfer and shipment to the Data Protection Authority is an obligation.

To export outside the European Union, the exporter has to:

• ensure that the country of destination or transit of the data has an adequate level of protection of individuals, laws protecting privacy and security in medical research and processing operations involving human biological material and sensitive data (Legislative Decree n. 196/2003, article 44 and 23§6 and 26§4; and Directive 95/46/CE European Parliament and Council, 24/10/95).
• detain an authorisation for the research by the Ethics Committee and, when it is relevant, a transfer authorisation by the Data Protection Authority. However, the notification of the transfer and shipment to the Data Protection Authority is an obligation.

Notification

In any cases, the Controller (“Titolare”) of the processing of genetic data is under the obligation to submit a notification to the Garante before the start of processing.

The notification shall include :

(Legislative Decree n. 196/2003, article 16, 37, 38, 154, point 1, letter l, 163, 168, 181, point 1, letter c, 162, point 1)

1. the name, or business name and domicile, residence or headquarters of the owner;
2. the aims and mode of processing;
3. the nature of the data, the place where they are kept and the categories of interest with which the data relate;
4. the scope of communication and dissemination of data;
5. transfers of data to countries outside the European Union or if they target some of the data referred to in Articles 22 and 24 (health sensitive data), outside the national territory;
6. a general description allowing to assess the adequacy of technical and organizational measures taken for the security of data;
7. details of the database or databases to which the treatment refers and the possible connection with other treatments or databases, even outside the national territory;
8. the name, or business name and domicile, residence or registered office of manager, in the absence of such indication is considered the responsibility of the notifier;
9. the quality and the legitimacy of the notifier.

This notification must be done electronically and shall be signed by the notifier and the controller.

Italian Data Protection Authority contact
Dipartimento Registro dei Trattamenti,
Piazza di Monte Citorio n. 121,
00186 Roma
Fax n. 06.69677785
E-mail: rgt-info@garanteprivacy.it.

Data Protection

Concerning all the transfers of personal and sensitive data for scientific purposes to another country, a data processor security system is required (Legislative Decree n. 196/2003, Sections 28 at 36, Title IV, V, VII and Annex 4).

Traceability and safety :

(National Bioethics Committee and National Committee for Biosecurity, Biotechnology and Life Sciences, Presidency of the Ministers Council, Guidelines for recognising and accreditation of research biobanks, 2008, point 12, 13, 14)

Exchange and international transport Biosafety: exporter has to respect regional, national transport security rules and use security standards for the good packaging according to the biomaterial classification (See the requirements of the Circular n.16 of the Ministry of Health on shipment of perishable biological materials, 1994 and Circular n.3 of the Ministry of Health on recommendation for the biomaterial transport security, 2003).

• The exporter shall conserve official documents concerning
  • Export managers
  • General information on biological material (life duration…), the donor and the research project concerned
  • Labelling and batch numbers
  • Date of biological sample procurement, storage duration and preservation modalities
  • Risks
  • Destination or origin country of the human material
  • Suitability of Health structure and facilities of arrival
  • Transport date, ways and modalities
  • Border crossing and check points
• The Data Controller (“Titolare”) who is also the exporter shall give to the receiver institution the following information on the biological material (Guidelines on biobanks 2008, point 14):
  • Identification and batch number,
  • Sample life duration,
  • Instruction on the opening, handling and storing, information on biosecurity,
  • The Material Transfer Agreement (MTA) to protect intellectual property rights.
  • The address where eventually return the sample.
  • A list of shipped biomaterial and a receipt, (by fax or email), in return of the received biomaterial.

As often “Law follows Science”, actually in Italy for border transfer, whatever the biomaterials are, the technical norms in use are still those for the hemoderivates.

Moreover, the Italian legislator did not adopt any ad hoc legislation concerning biobanks activities yet. This field is part of the priorities for 2009-2011.

The renewal of the General Authorisation for the Processing of Genetic Data is regularly issued and it is valid for a short period of time as a few modifications are in process. You can follow the course of renewals via the official website of the Italian Data Protection Authority.

Several projects are in progress to create an Italian research biobanks network in order to clarify the procedures and facilitate European cooperation regarding human biological material exchanges for research uses.

"Genetic biobanks" vs "Human tissue banks": the terms "biobank" and "tissue bank" are often used interchangeably to indicate collection of tissues, cells and human DNA associated with a database. However, there is an ongoing debate on whether or not a specific legislation for biobanks using genetics data should be developed.