The EHDS is about data, not bodily material. The Dutch draft Bodily Material Act is about material, not data. This might lead one to believe there's no overlap. But if you extract data from material, you're doing something with both data and material. That's why I'm discussing my thoughts on the draft act here. Spoiler alert: it's not good.
The forest of contracts in medical research
On this page I attempt to explain to medical scientists what all the different contracts are that they might encounter. Imagine the following case: A scientist from the academic center LUMC conducts research funded by X, in a project together with another academic center UMCG, with data (or also cooperation) from village hospital Ter Gooi. Dutch law is described here.
1) The employment contract
First and foremost, there’s obviously an agreement between the scientist and the LUMC. This will usually be an employment contract. It could also be a self-employed person arrangement, but beware: if the scientist works almost exclusively and structurally for the LUMC, the court might still consider this an employment relationship, even if the parties call it something else. The tax authorities determine the exact difference, but the (very) short summary is: the more independent the scientist, the greater the chance that the self-employed relationship will not be considered employment.
Regarding the tangle of contracts, it is important to note the following: many contracts in this project will be in the name of the legal entity LUMC. In agreements with external parties, this entity can grant rights to its own scientists, but not obligations (Plien and Bianca cannot contract together that Annie has to do something). So if, for example, the funder X wants everything to remain confidential, then the agreement between X and LUMC will have to include that LUMC in turn includes in the agreement with the scientist that the latter must keep something confidential. The obligation that X wants will go through LUMC. The same applies to agreements about, for example, copyrights, which automatically arise with the author (scientist), but which may have to end up elsewhere. Perhaps, for example, X wants open source teaching materials to be written, which LUMC will then have to arrange with the scientist.
2) The relationship with financier X: subsidy or commerce?
If the research is funded by X, then this relationship must be legally constituted in some way. The question that must be asked is whether the funding is a grant or a commercial assignment. Note: the parties cannot decide this themselves.
A subsidy is money from a government (such as ZonMw), provided for certain activities, other than as payment for goods or services supplied to that government. The crux of the matter is therefore who you deliver something to. When funding oncological research, you are accountable to ZonMW, but you are not delivering a product to that government, but to society. What is delivered is solely the proof that the activity has taken place. That is therefore a subsidy. However, if the point is that the private financier obtains X patent rights with which its investment can be recouped, then you deliver the result to the financier itself and it is therefore not a subsidy.
With a real assignment, you enter into an agreement under the Civil Code (so all provisions regarding breach of contract apply). With a subsidy, the government (unilaterally) makes a subsidy decision in accordance with the General Administrative Law Act and the subsidy conditions. However, that decision doesn’t force the recipient to actually carry out the activity: you can simply repay the amount. Because the government often wants certainty that the activity will actually be carried out, a subsidy implementation agreement is then concluded, which is therefore not the same as a contract for services.
3) The consortium agreement
If the UMCG and LUMC have jointly secured funding, the financier doesn’t want the parties to pocket it and refer the results to the other. They also don’t want disputes to lead to no results, to the results being kept confidential, or to legal violations during project implementation. Therefore, financiers often require a consortium agreement.
From a legal point of view, however, this is something that is difficult to define. After all, the contractual collaboration could be the implementation of a subsidy or a commercial assignment. It could be decided that the subsidy implementation agreement also serves as a consortium agreement (and in that case X is also a party), or it could be separate.
The agreement is usually intended to be nothing more than a contractual collaboration for this specific project. However, care must be taken to avoid unintended consequences under corporate law; it’s important to ensure the collaboration doesn’t accidentally qualify as a general partnership or partnership. Note that this can even happen if there’s no written agreement at all, only a de facto collaboration. It can therefore be helpful to explicitly state that this is not the intention.
When only two parties are involved in the collaboration, it’s often called a collaboration agreement. When more parties are involved, an agreement is often drawn up called a consortium agreement. Legally speaking, this makes no difference; both are simply covered by contract law. The difference is that a consortium agreement always contains provisions regarding who can make which decisions; although there is no legal entity (such as a private limited company), bodies are established between which decision-making authority is divided. These are usually the consortium leader, the work package leaders, and the entire group.
Note that contract law is actually quite soft. The content of the agreement (under Dutch law) is richly supplemented by considerations of reasonableness and fairness, unforeseen circumstances, what the parties could reasonably expect from each other, and how the collaboration has evolved over time. We’ve adopted the practice of writing lengthy contracts from the Americans, where none of these requirements apply, but in the Netherlands, it’s not really necessary.
4) Clinical Trial Agreement
When, instead of research with data, or in addition to research with data, research is also conducted with or on human subjects, the laws concerning medical research involving human subjects apply. In that case, too, an agreement must be concluded: the clinical research agreement, or CTA. This could, of course, simply be the consortium agreement, although there are two differences.
Firstly, in addition to the UMCG and LUMC (which are designing the research), Ter Gooi is now also a party to the agreement, because that’s where the research is (also) conducted. Previously, they only provided data, but that will change. The second difference is that the WMO (Social Support Act) now applies, meaning that various tasks and responsibilities under that law must be contractually established. For example, the WMO stipulates that research results must be made public, so it must be determined who will actually do that (not all three, of course). This publication requirement does not currently apply to purely data research, but that will change once the European Health Data Space Regulation comes into effect.
5) The Joint-Controllers Agreement
When LUMC doesn’t simply allow others to participate in the research, but actually designs the research together with UMCG (and a joint research plan has been drawn up), these two parties jointly determine the purposes and means of processing personal data, as defined by the GDPR (Data Protection Act). Note that this only applies if personal data is actually being processed, as this is not the case if the data has already been pseudonymized by Ter Gooi Hospital (or, for example, ZorgTTP, a party other than UMCG and LUMC themselves) in such a way that they can no longer determine which natural persons are involved. Therefore, just because data concerns individuals doesn’t automatically constitute personal data. The question is whether privacy is at stake because it can reasonably be determined who the data concerns; only then does the Privacy Act apply. If you have any doubts about this, simply call your data protection officer.
If the data is not (yet) sufficiently pseudonymized, UMCG and LUMC are required to sign a joint controller agreement (or a joint controller agreement). The most important aspect of this agreement is that the GDPR responsibilities are properly allocated. For example, a DPIA (Data Protection Impact Assessment) must be performed for high-risk processing, and UMCG is not supposed to assume that LUMC has performed this, or vice versa. Incidentally, patients don’t have much to do with this agreement: they can still contact either party to exercise their GDPR rights.
6) Joint-Data-Registry-Agreement
Yet another agreement governs the rights between LUMC and UMCG regarding the data, prior to the completion of the research. This can, of course, also be included in the consortium agreement or the joint controllers’ agreement. It is also sometimes concluded separately. There are no IP or property rights on raw data. If the plan is to jointly produce scientific publications after three years of data collection, it would be undesirable if UMCG publishes halfway through without LUMC having access to the data, or if LUMC denies UMCG access to the data halfway through. The law doesn’t automatically prohibit all of this (due to the lack of IP or property rights on raw data), so this must also be contractually agreed upon. A funder may also have requirements regarding the raw data, for example, that it be made FAIR immediately after publication of the results.
7) License Agreement
Where IP rights (such as copyrights or patents) do exist, agreements must also be made. These too can be included in the consortium agreement, or they can be dealt with separately. There are two types of IP rights: what is contributed to the collaboration is called Background. What arises during the collaboration is called Foreground. Existing IP rights may be necessary for the research. The party contributing these rights wants to protect these IP rights by stipulating that they may be used exclusively for this research. The other party, on the other hand, wants to be sure that the research will not be disrupted by a refusal to share the IP. The contributed Background is described in the agreement for this purpose. Subsequently, new IP is created during the research. The scientists at LUMC and UMCG simply want to be able to publish their articles (for the benefit of their careers) without encountering problems with these IP rights. They also want to be able to conduct follow-up research with the knowledge they have acquired, without the other party restricting this. If X is a commercial financier, he or she may want to keep the IP for himself or, as a philanthropist, ensure that it is made available to everyone. In order to do justice to everyone’s wishes and interests, contractual agreements must be made about this.
8) The Data Transfer Agreement with Ter Gooi
Suppose the research is not involving human subjects; Ter Gooi Hospital has only been asked to contribute data. Ter Gooi has no say in the research’s design. The hospital’s Data Protection Officer will have to determine, based on the GDPR, whether this data transfer is permitted. If all requirements are met (fulfillment of the principles of Article 5, a legal basis as in Article 6, an exception to the prohibition in Article 9, the requirements of Article 24 GDPR, and the security measures in accordance with Article 89 GDPR), Ter Gooi may transfer the data for the research.
LUMC and UMCG are then automatically obligated to comply with the GDPR when using data from Ter Gooi. This law does not, therefore, require a data transfer agreement (DTA), but to ensure the data is used exclusively for the purpose for which it was requested, one is usually done anyway. At most hospitals, the requirement to use a DTA is stipulated in their internal policy.
Since Open Data Regulation 2019/1024, certain organizations are also required to enter into a Data Protection Agreement (DTA): institutions entrusted with a public task, government-owned companies, and publicly funded research organizations. A contractual agreement must stipulate that recipients of pseudonymized data may absolutely not attempt to identify the individuals.
Note: in this case, there is no legal requirement for Ter Gooi and LUMC to enter into a data processing agreement, as LUMC does not act on behalf of Ter Gooi or vice versa. Nor is a joint controller agreement required, as LUMC and Ter Gooi are not jointly conducting the research. One of these three agreements is always entered into, never multiple.
The Ministry of Health, Welfare and Sport will soon determine who will become the HDAB; who will be the source of permits for the beneficial reuse of health data. Who can be this, and who cannot? And what will this HDAB be responsible for?
Under the EHDS, work must be performed in a Secure Processing Environment (SPE). Scientists don't receive data, but access it in a SPE that meets the strict technical and security standards established under the EHDS. What does this entail? And will everyone be required to work in such a SPE from now on? Will it become a supercomputer containing all our health data?