Why is my data collected?
The Blood Service Biobank collects your personal data in connection with the samples you have donated for purposes of medical research and research and development. Biobanking is a long-term effort that seeks to promote health by means of facilitating studies that prevent diseases and identify disease mechanisms and by supporting the development of treatments and diagnostics. The Biobank processes the personal data of sample donors for the purpose of carrying out tasks provisioned under the Biobank Act (688/2012). The purpose of the Biobank Act is to support research that utilises human biological samples and protect the rights of donors. The legal grounds for processing under the EU General Data Protection Regulation is the performance of a task carried out in the public interest. The task carried out in the public interest pursued is to enable scientific research as referred to in the Biobank Act. The Blood Service Biobank collects samples and data only from persons who have granted consent to their use by the biobank in writing.
What data is collected on me?
• name, personal identity code
• date of granting biobank consent
• permissions specified in the biobank consent (permission to report possible incidental findings, permission to contact concerning possible further sample requests)
• health information you have provided to the Biobank (supplementary information form filled in connection with granting biobank consent)
• quality, number and dates of samples stored in the Biobank
• research projects to which the samples and data have been disclosed and the quality and number of disclosed samples
• results of the research projects received by the Biobank
How is my data obtained?
The Biobank stores personal data that you have provided upon registration, in other words when you signed the consent form for the Blood Service Biobank. If you have also filled in and submitted the Biobank supplementary information form, the health information provided therein has been stored in the registry. In addition, data analysed from your samples taken during Biobank examinations is collected in the registry.
On a case-by-case basis, the material provided by the Blood Service Biobank to research projects may require to be supplemented by data obtained from patient registries, national social welfare and health care registries such as the statutory Care and Cancer Registries maintained by the National Institute for Health and Welfare, the registry on causes of death maintained by Statistics Finland, or from registries maintained by the Social Insurance Institution (e.g. registry on the special reimbursement of medicine expenses) on the state of health of the data subject or past medical treatment or examinations. The Blood Service Biobank does not store this information; instead, the data are made available to the project for the purposes of research for a specified duration, after which they are erased from the research project registry.
The Blood Service Biobank uses the Blood Donor Registry as a technical aid when recording biobank consent information in the Biobank Registry. However, no data recorded in the Blood Donor Registry are stored in the Biobank. If a Biobank customer requests information from the Biobank that is stored in the Blood Donor Registry, authorisation for combining the data is requested from the person in charge of the Blood Donor Registry. Even in this case, the data are always supplied to the Biobank customer in a coded form, and the data are not stored in the Biobank Registry.
For what purposes is my data processed?
Data and samples stored in the Biobank registry may be transferred or disclosed for purposes of biobank research. Researchers submit an application to the Biobank describing the objective of research and the intended use of the samples and data. The applications are evaluated by the medical evaluation board of the Blood Service and the director of the Biobank, and data are only disclosed for applications that demonstrate a right to process the data under the Biobank Act and otherwise meet the conditions for processing required by law and the Blood Service Biobank.
The material may be disclosed for research purposes to researchers representing domestic and international universities, hospitals and research institutions, as well as to health care companies (for example, pharmaceutical companies and diagnostic and analysis laboratories). The data are also disclosed to research groups of the Blood Service for purposes of research involving biobank samples. The research or research and development activities may be carried out in cooperation with the Blood Service or, alternatively, access rights to the material may be granted to independent research groups.
Any data transferred or disclosed to research projects are in a coded form, in other words removed of information that may be used to identify the individual. Data that include personal identity codes may be disclosed only in special cases. In these cases, the sample donor has consented to the disclosure of their personal identity code and the combination of the data with that of another data controller. Even in such cases, directly identifiable information is removed after combining the data and before the samples and data are disclosed for use in research. In each disclosure, the provided material is limited to only that necessary for conducting the research.
Before the transfer or disclosure of the material, the Blood Service signs an agreement with recipient of the disclosure on the research use of the samples and data, the period of permitted use, restrictions on disclosure to third parties, and obligation to return the data.
In cases where subcontractors are used to process personal data, they shall be required to employ sufficient technical and organisational measures to protect personal data and sign a data processing agreement.
Upon request, you can receive information on to whom the Blood Service Biobank has transferred or disclosed your data and samples, and from which registries or studies data has been collected.
Is my data transferred outside the EU?
The samples and data in the Blood Service Biobank may be transferred or disclosed outside the EU and EEA for purposes of research or research and development, in compliance with the appropriate protective measures. The grounds for transfer and protective measures to be used are evaluated on a case-by-case basis, depending on the consent of the sample donor and the recipient of the data. Even in such cases, the Biobank refrains from disclosing personally identifiable information on the sample and data.
In all cases, the Blood Service signs an agreement with recipient on the intended use of the samples and data in research, the period of permitted use, restrictions on disclosure to third parties, and obligation to return the data.
How is my data protected?
Employees of the Blood Service are under obligation to maintain confidentiality.
Access to the filing system is restricted by user credentials and permitted only to those individuals required to do so due to their duties. Access to data in the filing system and the addition, editing and erasure of data is restricted with access rights.
Printed documents that contain personal data are stored by the Blood Service in locked premises with controlled access and in locked containers.
The samples and data are disclosed only to research projects assessed by the Blood Service to be ethically acceptable and trustworthy.
The samples and data are disclosed to research projects in a coded form to ensure that all personally identifiable information on the sample and data remains undisclosed.
Is my data used for profiling or automated decision-making?
For how long is my data stored?
Your data are stored in the Biobank until further notice, and the necessity of storage is assessed periodically.
How can I review my data and rectify any inaccurate information?
You may access and check your personal data stored by us by filling in, printing and signing the request for data form available on the Blood Service website and sending it to us by mail or in person. The Blood Service will send an extract of the personal data concerning you contained in the filing system to you by mail.
You may request for rectification of inaccurate information in writing by using the rectification request form found on the Blood Service’s website. Contact details may also be requested to be updated over the phone.
Can I request the erasure of my data or object to the use of my data?
Yes, if your samples stored in the Biobank have not yet been disclosed to any research projects. In this case, you may request to erase all your data from the Biobank registry. In the event that your samples have already been disclosed to a research project, your data cannot be erased completely. Instead, your original consent must be stored together with your later withdrawal of consent. For example, in order to verify the accuracy of research results, it may sometimes be necessary to store the material used in research. After you have withdrawn your consent to the Biobank, your samples and data will no longer be disclosed to other research projects.
Can I lodge a complaint with the authorities?
If you feel that the processing of your personal data is not lawful, you may lodge a complaint with the competent supervisory authority.
Finnish Red Cross, Blood Service
FI-00310 Helsinki, Finland
tel. +358 29 300 1010