Testing the GDPR in Relation to Biobanking

This chapter addresses how the biobanking process—in the instances in which it falls within the scope of the General Data Protection Regulation (GDPR)—is classified under the GDPR's classification systems. These classification systems do not, themselves, constitute substantive provisions; they do not consist of rights or obligations. They are, however, key in determining the types of actors to whom substantive provisions apply and the way in which substantive provisions apply. The chapter begins with a detailed elaboration of the GDPR's two key classification systems: the actor classification system and the personal data classification system. It then describes how the actor classification system applies to actors involved in the biobanking process, focusing on the applicability of the concepts of ‘data subject’, ‘data controller’, and ‘data processor’. Finally, the chapter considers how the personal data classification system applies to personal data processed in biobanking, looking, in particular, at the applicability of the concepts of ‘genetic data’ and ‘data concerning health’.