Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

  d. I am not sure — or other answer

1.1 In Australia, genomic research would require ethics approval like any other human research. DTP research would also attract the general requirements for approving human research, including minimizing risk and ensuring consent (Chapter 2.1-2.3 National Statement). In addition, there are specific requirements for Genomic Research in the National Statement in Chapter 3.3. Any proposed DTP genomic research would need to comply with the specific requirements of Chapter 3.3 to be satisfactorily addressed for ethical approval.

1.2 The National Health and Medical Research Council has the issue of Direct to Customer Genetic Testing under consideration and has published three relevant information documents.¹

1.3 The Commonwealth Australia Government, Department of Health has issued guidance for the Provision of Direct-to-Consumer Genetic Tests: Guiding Principles for Providers.²

The Australian Genomics Health Alliance (AGHA) published a news page on Understanding Direct-to-Consumer Genetic Testing, with information on clinical-grade testing.^{Reference Boughtwood3}

The researcher would require ethics approval, with the following comments.

The equivalent IRB/REC approval in Australia is granted by our Human Research Ethics Committees (HREC). The conditions for approval of all human research are set out in the National Statement on Ethical Conduct in Human Research 2007 (updated 2018) (hereafter the “National Statement”).⁴

In addition to the general requirements for approving human research, including minimizing risk and ensuring consent (Chapter 2.1-2.3 National Statement), there are specific requirements for Genomic Research in Chapter 3.3. Any application for ethical approval of the proposed DTP genomic research would need the specific requirements of Chapter 3.3 to be satisfactorily addressed.

Our National Statement is intended to be consistent with the international human rights instruments ratified by Australia and provides our national guidelines for researchers, HRECs and others conducting ethical review of research and emphasizes institutional responsibilities for the quality, safety, and ethical acceptability of their research. The National Statement must be read with the Australian Code for the Responsible Conduct of Research, 2018 (the “Research Code”), which also applies to responsible and ethical research practice, and responsibilities of institutions and researchers in areas, such as data and record management, publication of findings, authorship, conflict of interest, supervision of students and allegations of research misconduct.

Under Chapter 4.8.1 National Statement any research “conducted overseas by researchers from Australian institutions must comply with this National Statement.” The researcher in Australia may apply for HREC approval in Australia for research in another country under the terms of Chapter 4.8, provided the research has merit, demonstrates respect for the laws and customs of the host country, and has all required local ethics approvals. These are in addition to the general requirements for ethics approval, including minimizing risk and ensuring consent in Chapter 2 of the National Statement. There is an over-riding requirement to respect “beliefs, customs and cultural heritage, and local laws” of all participants in other countries.⁵

The Australian HREC would require approval from the research ethics review body in the other country, where there is one.⁶ Where there are no “ethics approval processes” in the overseas country, research participants must be “accorded no less respect than [the] National Statement requires,”⁷ as well as these specific elements for Research generally in Chapter 3.1 and Genomic Research, in particular, as set out in Chapter 3.3.⁸ As far as is necessary to satisfy the requirements of paragraphs 1.10 to 1.13, the design and conduct of the research should reflect continuing consultation with the local participant population and the communities to which they belong.⁹ The Australian researcher conducting DTP genomic research in another country must also comply with the Australian Code for the Responsible Conduct of Research, 2018.¹⁰

• a. Would it be lawful for the researcher to do so without HREC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Essentially, as stated above at 3, the overseas researcher would require approval for the research in Australia and be required to comply with the National Statement and the Australian Code for the Responsible Conduct of Research. The researcher from outside Australia may apply for recognition of the “outside” ethics approval and an Australian HREC can decide whether the approval for research proposal meets the requirements of the National Statement. The overseas researcher may also apply directly to the relevant HREC provided specific requirements of Chapter 4.8 National Statement — People in Other Countries are met, dealing with international/overseas research and international researchers doing research in this country.

There are also specific requirements for dealing with the importation and exportation of human biospecimens in laboratory-based research in National Statement Chapter 3.2: provided there is the required ethical approval of an Australian HREC or an equivalent ethical approval process in the overseas country of the researcher. The overseas researcher would also have to respect the general obligation to and rights of the research participants imposed by Australian law.

As a general observation, Australia does not differentiate between local and overseas researchers. It is the quality of the peer reviewed research, the expertise and skill of the researcher and team, and the ethical acceptability of the project that are the prime considerations. Generally, the perceived benefits and risks that could occur, if a researcher from another country conducted approved genomic research on samples or data obtained from Australia, are no different from research approved and conducted by an Australian researcher. The National Statement does not differentiate between overseas and locally based researchers. Both require HREC approval for research conducted in this country.

All human research requires approval. Specific issues with specific research participants, such as socially-defined groups, including as examples indigenous or minority populations, would be critical components of the research design and ethical approval processes. There are specific requirements for dealing with the importation and exportation of human biospecimens in laboratory-based research in National Statement Chapter 3 and with research on people in other countries in Chapter 4.8 National Statement. People in Other Countries. In addition, Australia has a specific specialist National Centre for Indigenous Genomics (NCIG) centred at the Australian National University (ncig.anu.edu.au/).

Part II — General Questions

Yes to both questions, Australia has these regulatory systems and these apply to individuals as well as institutions, with the following specific comments.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Noting that Australia currently has NHMRC guidelines and information papers on DTP research and the Commonwealth of Australia Government supports and promotes international research collaborations, I do not foresee restrictions in this research direction. I would refer again to the Response to Question 1.

On the other hand, on-line access to direct-to-consumer (DTC) genetic testing needs to be researched to identify challenges for Australia. DTC test results may be confusing to consumers and may be referred to doctors to interpret. Public trust in NATA and NPAAC accredited genetic tests must be protected. In Australia, our Therapeutic Goods Administration oversees regulation of the genetic testing sector. There is still significant pharmacogenomic research to be done investigating individual genetic response to certain drugs. Our Australian Competition and Consumer Commission (ACCC) has been auditing DTC tests and issued advice about misleading claims on one test available through a national chemist chain.¹⁵

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

In Brazil, the ethical review system of research protocols involving the participation of human beings, including genetic and genomic studies, is regulated by the Conselho Nacional de Saúde (CNS), which is a collegial, deliberative, and permanent board of the Sistema Único de Saúde (SUS), a department of the Health Ministry that has the mission of supervising and monitoring public health policies, pursuant to article 1, paragraph 2, of the Law no. 8,142 dated December 28, 1990.¹

This system of ethical analysis started in 1996 by the Resolution of the Conselho Nacional de Saúde (CNS) n. 196,² which created a network of ethical appreciation of research projects composed of two independent institutional committees: the Comitê de Ética em Pesquisa (CEP) with local level assignments, and the Comissão Nacional de Ética em Pesquisa (CONEP) with specific ethical review assignments of related projects (such as human genetics, indigenous populations, biobanks, and international cooperation).³

Therefore, the CEP/CONEP system develops “a cooperative work that aims, in particular, to protect the research participants of Brazil” so that when they proceed to the ethical review of these protocols, their members become co-responsible for ensuring such protection, according to items VII and VII.1 of the Resolution of the Conselho Nacional de Saúde (CNS) n. 466, dated December 12, 2012.⁴

As far as we know, there has been little, if any, discussion of DTP genomic research. However, the CONEP has the task of resolving omissions related to the ethical aspects of research involving the participation of human beings, including genetic and genomic studies, because of the relevance of the protection of Brazilian participants.

For CEP/CONEP system approval, DTP genomic research should be subject to the conditions of Resolution of the Conselho Nacional de Saúde (CNS) n. 466, dated December 12, 2012,⁵ which requires that the researcher responsible for the research be affiliated with a public or private institution legitimately registered⁶ according to items II.8 and II.16. If the researcher is not regularly linked to one institution, the research project could not be registered in Plataforma Brasil,⁷ which is a national and unified electronic database of research records involving human beings in the CEP/CONEP system, according to item VI.⁸

In addition, genetic or genomic research should be subject to the conditions of Resolution of the Conselho Nacional de Saúde (CNS) n. 340, dated July 8, 2004,⁹ which requires, among other requirements, the protection of the data of the research participants (items III.2 and III.11), genetic counseling when applicable (item III.5), the guarantee of access to genetic data, as well as the right to withdraw them from the database at any time (item III.8).

If the research involves the storage or use of human biological material, the research should also be subject to the conditions of Resolution of the Conselho Nacional de Saúde (CNS) n. 441, dated May 12, 2011,¹⁰ which requires, for example, the regulation of the depositary institution and its approval by the CEP and, where applicable, by CONEP (item 3.I). Such regulation should provide for the definition of those responsible for the safekeeping and use of the material, the guarantee of secrecy and confidentiality and the possibility of contacting donors to obtain specific consent for use in a new research project (item 3.III). It is important to clarify that it is mandatory for the storage of human genetic data to be made by an appropriate institution responsible for data protection (item III.14 of Resolution CNS 340).¹¹

For CEP/CONEP system approval, international DTP genomic research shall be subject to the conditions above and also those of the Resolution of the National Health Council (CNS) n. 292, dated July 8, 1999,¹² which requires the identification of the Brazilian researcher and the national institution co-responsible (item II.1), the indication of responsibilities, rights and obligations of the parties involved (item II.2), the description of the risks and benefits of the research (item IV), the approval document of the Research Ethics Committee of the country in which the research will be carried out (item VII.1), and the detail of the financial resources (item VII.3), among other requirements.

The Brazilian researcher and the national institution should also be subject to the laws and regulations on the shipment of biological material abroad and on industrial property and technology transfer (item V): Law 9.279, dated May 14, 1996 that regulates rights and obligations related to industrial property, Decree 2.553, dated April 16, 1998 that regulates it; Law 9.610, dated February 19, 1998 on copyright; and also Resolution of the Agência Nacional de Vigilância Sanitária (ANVISA) n. 20, dated April 10, 2014 on sanitary regulations for the transport of human biological material.

Therefore, according to current Brazilian legislation, REC approval from other countries is mandatory for approval of international DTP genetic or genomic research by CEP/CONEP system.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The Resolution of the Conselho Nacional de Saúde (CNS) n. 292,¹³ dated July 8, 1999, requires both approval by the Research Ethics Committee of the proposing country of the research for them to be approved by the Comitê de Ética em Pesquisa (CEP) and by the Comissão Nacional de Ética em Pesquisa (CONEP) in Brazil, according to items VII.1 and VIII.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __Yes

  • X No

  • __ Not sure or other

As explained above, the Resolution of the Conselho Nacional de Saúde (CNS) n. 292, dated July 8, 1999, requires both approval by the Research Ethics Committee of the proposing country of the research and then be approved by the Comitê de Ética em Pesquisa (CEP) and by the Comissão Nacional de Ética em Pesquisa (CONEP) in Brazil, according to items VII.1 and VIII.¹⁴

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The item II.1 of the resolution of the Conselho Nacional de Saúde (CNS) n. 292, dated July 8, 1999, requires the participation of a Brazilian researcher to conduct research in Brazil even if the project has the coordination in another country.¹⁵ Thus, it is mandatory to have the participation of a Brazilian researcher for approval by the Comitê de Ética em Pesquisa (CEP) and by the Comissão Nacional de Ética em Pesquisa (CONEP) in Brazil.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The Resolution of the Conselho Nacional de Saúde (CNS) n. 292,¹⁶ does not make any demands regarding the international institution in which the external researcher is linked. But the participation of a Brazilian researcher for approval by the Comitê de Ética em Pesquisa (CEP) and by the Comissão Nacional de Ética em Pesquisa (CONEP) is mandatory in Brazil.

The primary purpose of genetic research is the scientific knowledge that could alleviate suffering and improve the health of participants. From the perspective of researchers and professional or governmental entities, genomic research can produce new information that should be published in order to share and transfer technology.

On the other hand, the risks associated with genomic research include social damage (such as discrimination and stigmatization of research participants and their future generations), psychological damage (such as depression, anxiety, anger, or fear) and financial/economic damage (such as no access to the labor market or health insurance). In addition, from the perspective of researchers, professional, or governmental entities, these researches may produce administrative, civil, and criminal liability for the harm caused to participants, as well as economic expenses with genetic counseling and clinical follow-up of these subjects.

Part II — General Questions

In Brazil, the board responsible for regulating all these issues is the Conselho Nacional de Saúde (CNS), which is a collegial, deliberative and permanent board of the Sistema Único de Saúde (SUS), which is part of the Health Ministry. In addition, genetic or genomic research must be approved by the Comissão Nacional de Ética em Pesquisa (CONEP), according to Resolution of the Conselho Nacional de Saúde (CNS) n. 340, dated July 8, 2004.¹⁷ It is important to emphasize that only Brazilian researchers approved by CONEP are allowed to perform these procedures. No information or any kind of samples could be sent outside the country without its final approval.

According to Resolution of the Agência Nacional de Vigilância Sanitária (ANVISA) n. 20, dated April 10, 2014 (8), researchers from other countries are not allowed to send information or any kind of samples outside Brazil since they will not get the approval of the Agência Nacional de Vigilância Sanitária (ANVISA), a government agency linked to the Ministry of Health, part of the Brazilian National Health System (SUS) as the coordinator of the Brazilian Health Regulatory System (SNVS) present throughout the national territory.

Brazil does have laws, policies, and guidelines dealing with genetic or genomic research and genetic or genomic privacy that are applied to international DTP research. As explained above, the board responsible for regulating the ethical review procedures of such protocols is the Conselho Nacional de Saúde (CNS). Furthermore, this research has to be approved by the Comissão Nacional de Ética em Pesquisa (CONEP). Finally, data or samples should only could be sent to other countries after the approval of the Agência Nacional de Vigilância Sanitária (ANVISA).

In relation to genomic research involving human beings, national or international, the National Health Council issued Resolutions 466,¹⁸ 340,¹⁹ and 292,²⁰ which require data protection mechanisms in order to avoid stigmatization and discrimination of individuals, families or groups in such research.

However, these Resolutions are not clear when residents or citizens of our country are enrolled in a DTP study conducted outside Brazil.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

In Brazil, the Guidelines for Ethical Analysis of Human Genetic Research Projects determine in the Informed Consent Form (TCLE) that all participants will be informed of all the results of exams and tests performed, but they have the option of not knowing this information, according to item V.1 of the Resolution of the Conselho Nacional de Saúde (CNS) n. 340, dated in July 8, 2004.²¹

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

The Agência Nacional de Vigilância Sanitária (ANVISA) expressly prohibits the supply of products intended to “perform genetic tests to determine the presence or predict susceptibility to disease or physiological condition” to lay users, who are individuals without technical training or formal scientific basis for use of these products, according to article 15 item III and article 3, item XLI of the Resolution n. 36, dated August 26, 2015.²²

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. d. I am not sure — or other answer

I am not sure if my country's laws, policies, or guidelines will change in the next years in response to international DTP genomic research due to the importance of participant protection in research in Brazil.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

However, a notable exception in the policymaking community is the Privacy Commissioner of Canada and a few consumer associations that have issued two information briefs on the topic.¹

The preconditions for DTP genomic research to receive research ethics board (REB) approval either stem from provincial statutes,² private institutional policies,³ or the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS2⁴), Canada's leading research ethics policy. The applicable ethical rules depend on the funding source of the research, the institution under whose auspices the research is conducted (i.e., whether it is private or public, and federal or provincial), and whether the research engages federal or provincial powers. The TCPS2 specifically applies to institutions eligible to receive or are receiving funding from The Canadian Institutes of Health Research, the Natural Sciences and Engineering Research Council of Canada, and the Social Sciences and Humanities Research Council of Canada. Nevertheless, the TCPS2 is the most widely used Canadian ethics policy,⁵ and has been extensively adopted by various agencies and institutions across Canada, both public and private.⁶ Where DTP genomic research is undertaken by private institutions not receiving funding from the aforesaid agencies, the TCPS2 does not apply, but the researchers remain subject to independent REB approval and relevant federal or provincial laws.^{Reference Zimmerman7} The chief areas demanding regulatory and ethical compliance are: consent, privacy, incidental findings, secondary uses, data linkage, biobanking, genetic research, and research involving First Nations communities. Research projects are required to have procedures pertaining to each of these categories, which will be subject to independent REB review.⁸

Part II — General Questions

The Personal Information Protection and Electronic Documents Act (PIPEDA) regulates the exportation of data and biospecimens in the commercial context.⁸³ The application of PIPEDA to DTP genomic research is rather indirect, as the Act shifts the burden onto the institution transferring the data or biospecimens through the accountability principle.⁸⁴ More specifically, the institution transferring data must ensure that the data will have comparable protection mechanisms in the foreign jurisdiction.⁸⁵ In the case of international DTP genomic research, foreign researchers must ensure that the transfer of personal health information, such as biospecimens, will not compromise the privacy of the data. Importantly, PIPEDA applies to private sector institutions that collect, use, or disclose personal information, such as health information, in the course of commercial activities.⁸⁶ As such, it does not apply to individuals, such as researchers working in their own capacity. Additionally, provincial privacy legislation may also apply to the transfer of biospecimens and data, sometimes, with stricter rules regarding transport.⁸⁷

Aside from privacy legislation, the transportation of biospecimens is regulated through Transport Canada (TGD Regulations),⁸⁸ the Human Pathogens and Toxins Act (HPTA),⁸⁹ and the Canadian Biosafety Standard.⁹⁰ These specifically apply to human specimens containing pathogens or toxins as opposed to data. According to the TGD Regulations, biospecimens known, or reasonably believed to contain a pathogen are subject to special rules and require a permit.⁹¹ This may prove rather challenging for genomic researchers, as it is difficult to assess whether biospeci-mens collected from research participants, especially a wide array of participants in the DTP context, contain an infectious substance as defined by the TGD Regulations.⁹² Nonetheless, the Regulations stress that human biospecimens are exempted from these requirements where there is no reason to believe that they contain an infectious substance.⁹³ This exemption applies to specimens collected as part of a routine screening test (even where testing for an infectious substance), but not for diagnosis of an infectious disease.⁹⁴ Therefore, because DTP genomic researchers will likely not collect biospecimens for diagnosis of an infectious disease, they may likely benefit from the exemptions.⁹⁵ The HPTA applies to individuals possessing, handling, using, storing, importing, or exporting a human pathogen or toxin.⁹⁶ As such, the Act concerns individual researchers as opposed to the institution under which the research is conducted. On the other hand, the TGD Regulations apply to anyone handling (shipping, transporting, and receiving) dangerous goods by road, rail, air, or water,⁹⁷ therefore encompassing both individuals and organizations (natural and legal persons).

Although the TCPS2 specifically addresses genetic privacy,⁹⁸ federal and provincial laws largely legislate this area indirectly through more general privacy laws. Genomic privacy will typically be addressed incidentally through PIPEDA, which applies to private sector institutions that collect, use, or disclose personal information, such as health information, in the course of commercial activities.⁹⁹ When it comes to protecting personal information held by public bodies, the federal Privacy Act ¹⁰⁰ applies.¹⁰¹ Additionally, where provincial privacy laws are deemed substantively similar to PIPEDA, they apply in its place in the province.¹⁰²

Canadian laws and policies relating to genomic privacy may apply internationally under certain circumstances, namely where commercial cross-border transfer of information occurs (from Canada to a foreign destination), or where the research has a real and substantial connection to Canada. In terms of ethics policies, the TCPS2 applies to international DTP genomic research where the institution conducting the research is eligible to receive, or receives funding from noted federal agencies.¹⁰³

Although PIPEDA will generally not apply outside Canada, where data or specimens collected from Canadian participants are transferred to another jurisdiction, PIPEDA will regulate the commercial cross-border data transfer, collection, and use.¹⁰⁴ Specifically, PIPEDA states that individual organizations are responsible for providing a comparable level of protection in the foreign jurisdiction, otherwise known as the aforementioned accountability principle.¹⁰⁵ As such, the institution transferring data must ensure that the data will have comparable protection mechanisms in the foreign jurisdiction.¹⁰⁶ In the case of international DTP genomic research, foreign researchers must therefore ensure that the transfer of personal health information will not compromise the privacy of the data.

Further, the Privacy Commissioner of Canada may have jurisdiction over a researcher's institution outside Canada, thus extending the scope of Canadian privacy law¹⁰⁷ internationally. Where this is the case, PIPEDA or the Privacy Act can be applied outside Canada. The Privacy Commissioner's jurisdiction is determined through the “real and substantial connection test” delineated by jurisprudence.¹⁰⁸ According to the test, DTP research may fall under the Privacy Commissioner's authority where a real and substantial link exists between Canada and the foreign institution's operation.¹⁰⁹ The research would be considered within the scope of Canadian privacy law where sufficient indicia of a real and substantial connection to Canada exist, such as, the target or subject of research and commercial activity are Canadian participants, and “active involvement and participation” with Canadian participants or Canadian stakeholders are present.¹¹⁰

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

According to the TCPS2, researchers have an obligation to disclose any material incidental finding in the course of research.¹¹¹ Typically, researchers are expected to develop a plan for how incidental findings will be disclosed to research participants, especially in genomic and genetic research.¹¹² Generally, the Canadian perspective on the matter is that results should be returned where they meet the following criteria:^{Reference Sénécal, Knoppers, Zawati and Sénécal113} scientific and clinical validity, signifi-cant health implications, actionability, research results confirmed by an accredited clinical diagnostic laboratory, and independent REB approval was obtained.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Canada does not have any specific law or policy applicable to direct-to-consumer genetic testing. However, it is predominantly governed indirectly through federal and provincial privacy, health, and consumer protection laws,¹¹⁴ and most prominently, Canada's Medical Devices Regulations,¹¹⁵ where genetic test kits are deemed a class I medical device.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

Currently, there is not much DTP genomic research in China. Some “Direct-to-Consumer” (DTC) genetic testing companies have conducted DTP genomic research with participants mainly from China, while some DTC genetic testing companies plan to do so. The majority of geneticists, clinicians, and bioethicists in China oppose DTC genetic testing. There are no regulations and regulatory agencies specific to DTP genomic research and DTC genetic testing in China. There has been discussion among researchers, but I am not sure whether policy makers discuss it. It's more likely that there has been little discussion among policy makers.

DTP genomic research is subject to IRB/REC review, complying with the Ethics Review Measures for Biomedical Research Involving Human Subjects (Ethics Review Measures), which was issued by the National Health and Family Planning Commission in 2016. The general conditions for IRB/REC approval are listed in the Ethics Review Measures, and similar to the international standards, which include: scientific research protocols, fair selection of research subjects, rational risk-benefit ratio, standard informed consent form, respecting the rights of research subjects, abiding by the norms of research integrity, etc. Each IRB/REC usually requires further conditions for each specific research projects to be approved.

If a DTP genomic research project is initiated by a researcher in China, only after IRB/REC approval in China can the project be launched. The general conditions for IRB/REC approval, which are similar to the international standards, are listed in the Ethics Review Measures, which include: scientific research protocols, fair selection of research subjects, rational risk-benefit ratio, standard informed consent form, respecting the rights of research subjects, abiding by the norms of research integrity, etc. Each IRB/REC usually requires further conditions for each specific research project to be approved.

Our IRB/RECs also require approval from a research ethics review body in the other country.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __Yes

  • X No

  • __ Not sure or other

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

Assuming that a researcher from outside China wants to conduct DTP genomic research in China, he/she has to collaborate with a Chinese partner, their cooperation needs to comply with the Ordinance on the Administration of Human Genetic Resources (New Ordinance), which came into effect on July 1, 2019, Article 22 (6), and to pass the ethical review of the two cooperating parties' respective countries (regions).

Generally speaking, research projects based at an academic entity are more easily accepted and approved by the HGRA.

Part II — General Questions

Before July 1, 2019, the Human Genetic Resources Administration of China (HGRAC) and Chinese Customs regulated the exporting of bio-specimens or the transferring of data across borders for research. After July 1, 2019, I'm not sure whether any entities will replace the HGRAC to play the role, as the New Ordinance does not specify which entities will regulate the exporting of biospecimens or the transferring of data across borders for research, but in general, the administrative department of science and technology under the State Council will regulate China's human genetic resources.

China does not have biohazard committees.

Yes, these requirements apply to individual citizens as well as research and medical institutions.

Yes, the New Ordinance will replace the Interim Measures for the Administration of Human Genetic Resources (Interim Measures) and the Administrative Licensing Service Guide for the Review and Approval of the Collection, Preservation, Trade, and Export of Human Genetic Resources (Service Guide) to deal with genetic or genomic research or genetic or genomic privacy that would apply to international DTP research. In theory, the New Ordinance applies outside of China when residents or citizens of China enroll in a DTP study conducted abroad, but in practice, it depends on specific conditions. For example, when residents or citizens of China pay for DTC genetic testing provided by 23andMe, and enroll in a DTP study conducted by 23andMe, it's difficult for the New Ordinance to deal with these issues.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• I am not sure — or other answer

China does not have laws, policies, or guidelines regarding the return of individual or aggregate research results. Most Chinese research participants usually expect for both individual and aggregate research results. IRB/RECs in China expect that individual results will be returned unless the participant expressly declines to have the results returned. Researchers in China expect that aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

China does not have laws, policies, or guidelines regarding “direct-to-consumer” genetic testing (e.g., 23andMe). There are companies offering “direct-to-consumer” genetic testing, though many people oppose it.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

DTP genomic research has more risks for research participants. Some scholars posit that if genomic research is related to health issues, it should collaborate with clinicians and genetic counselors to explain the results of genomic research, and provide health guidance for research participants in their diagnoses and treatments.

Appendix

Decree of the State Council of the People's Republic of China No. 717

Issued on May 28, 2019

Came into effect on July 1, 2019

6 chapters, 47 articles in total

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now — to my knowledge this issue has not attracted interest or concern among researchers or politicians. It may be explained by the fact that genomic research in Denmark to a large degree takes place based on tissue samples from clinical or research biobanks, where the law allows for an exemption from the normal informed consent requirement (see answer to next question). The online advertisement and recruitment of research participants is not uncommon. There is a special website developed by a private person, where announcements for research participants can be advertised.¹

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

It is necessary to distinguish between situations where the research project requires direct involvement of research participants, and situations where the project can rely exclusively on tissue samples stored in a biobank. In both situations, the research project needs REC approval according to the Act on Research Ethics Review of Health Research Projects,² and the REC will assess the scientific quality of the project and of the possible advantages and risks. In regard to informed consent, this is only mandatory where the research participant is directly involved. If the project is based exclusively on tissue samples stored in a clinical or a research bio-bank, section 10 of the Act provides for derogation from informed consent requirements, and the REC may decide to make an exception if the project does not pose any health risks and if under the given conditions the project does not in other ways put a strain on the tissue donor. The assessment will also take into consideration whether it would be impossible or disproportionately difficult to obtain consent or proxy consent.

The Act on Research Ethics Review of Health Research only applies to research activities taking place in Denmark. If recruitment takes place in Denmark, but the genetic analyses are made outside Danish jurisdiction (no research activity in Denmark), the Danish RECs do not have competence to assess and authorize the project.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

It will always require an approval from a Danish REC to conduct a research project in Denmark. An approval from an REC in the researcher's own country does not give the researcher authorization to perform research activities in Denmark.

• __ Yes

• X No

• __ Not sure or other

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

It is not a requirement according to the Act on Research Ethics Review of Health Research Projects, but in practice it is often necessary to collaborate with a researcher in Denmark; e.g. to get access to biobank samples.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

It is my impression that the general public and most politicians are skeptical towards transfer of tissue samples for genetic analyses in other countries. E.g. in the Danish National Strategy for Personalised Medicine it is specifically stated that genetic analyses should be performed in the public sector and the vision is to keep all analyses on Danish ground. In contrast, the researchers profit from international collaboration, and a vast number of tissue samples have been subject to NGS analyses at research institutions or companies abroad. To my knowledge, there has not been discussions regarding indigenous populations (although we have an indigenous population in Greenland).

Part II — General Questions

The Danish Data Protection Act supplements the general regulation in the EU General Data Protection Regulation (GDPR). This Act applies to processing of tissue samples, and the Act specifically addresses transfer of tissue samples to other countries for research purposes in section 10, according to which authorization from the Danish Data Protection Authority is needed for transfer of tissue samples to other countries both within the EU and outside the EU. This provision only applies to transfer of tissue samples for scientific purposes. Transfer of data for research and transfer of tissue samples for purposes other than research purposes will follow the GDPR provisions regarding disclosure of data to other countries within or outside the EU.

The National Committee for Health Research Ethics has adopted guidelines³ for genetic research which will apply to international DTP taking place in Denmark (and thus under the jurisdiction of Danish legislation). These guidelines do not apply if Danish residents are enrolled in a DTP study conducted abroad.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

The Ministry of Health has issued an Executive Order on Information and Consent to Participants in Health Research Projects.⁴ Section 15 of the Executive Order provides that the investigator must inform the research participant if important information about the health of the research participant is found. Only in the exceptional situations where the research participant has clearly opted out of receiving such findings is the investigator not permitted to inform the research participant. Such an opt-out is only valid if it is an informed opt-out based on current and relevant insight, cf. the standard of good information practice. In addition, section 16.3 of the Executive Order also makes it mandatory for researchers — if practically feasible — to inform research participants (if they consent) about the general results of the project and of the possible consequences for the individual participant. In regards to genetic research, the National Committee on Health Research Ethics has adopted special guidelines⁵ making it mandatory to return certain secondary findings to participants, who — due to the options of having an exemption from the consent requirement — have not provided an explicit consent for biobank research involving comprehensive genetic analyses.

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue — Direct to consumer genetic testing has not attracted much concern, and it is not specifically addressed in law.

• d. I am not sure — or other answer

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

It is difficult to assess. In general, Danish society is quite positive towards research and trusts both researchers and the public to protect personal data and tissue samples. However, in connection with the recent establishment of a National Genome Centre, there was extensive public debate regarding the use of genetic data for research purposes, and politicians responded to this concern and adopted stricter rules on informed consent and opt-out solutions in regards to genetic data stored in the National Genome Centre. This could indicate that future policies may be stricter than the current regulation. However, given the general positive attitude to research and international collaboration, future policies could just as well be more permissive.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

There have been DTP research projects involving online recruitment of participants with genotype data available. However, these projects were limited to data (i.e., no sample collection), and recruitment was in Estonian, thereby limiting participation to Estonian-speaking individuals. To my knowledge, no international projects have been conducted where the regional REC would have been contacted.

Yes, such a DTP genomic research project could get REC approval. One would have to comply with the Oviedo Convention on Human Rights and Biomedicine and the basic requirements for protection of persons undergoing research.¹ The concerns or conditions needing to be described and fulfilled involve mainly informed consent and data handling.² Conditions that could make it more difficult to get an approval include the potential for incidental findings without a specific plan on how to provide the necessary support and counseling, or involvement of potentially vulnerable research participants when the involvement has not been justified.

The same conditions apply as mentioned in the previous answer. However, the local REC would recommend contacting and applying for approval from regional RECs of countries involved to make sure their national requirements are met. In several European countries, a useful starting point would be the help-desk service offered by BBMRI-ERIC, a European research infrastructure in biobanking.³ As part of this service, law, ethics, and biobank experts of various countries in Europe share expertise, help with identifying the relevant ELSI issues, and navigating through the ethical and legal landscapes of the countries concerned.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

The Estonian Personal Data Protection Act mentions regional ethics committees as an alternative to the Estonian Data Protection Inspectorate that would evaluate whether the handling of personal data com-plies with the requirements.⁴ However, this is in the context of research conducted on personal data without informed consent from research participants. Although the need for a multidisciplinary review of the scientific merit and ethical acceptability of a research project is listed in the Oviedo Convention on Human Rights and Biomedicine, it has not been specified who/where that competent body is.⁵ Therefore, if a research project involves informed consent, there is no specific regulatory need for REC approval in Estonia. However, while REC approval may not be required, it is part of ethical research practice.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __Yes

  • __ No

  • X Not sure or other

The requirements are likely to differ depending on what specific countries are involved. For instance, there are only certain non-EU countries listed as having an adequate level of data protection as determined by the European Commission.⁶

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

A local partnering researcher is not a requirement, but the documentation submitted for the Estonian REC approval is accepted only in Estonian. This means that including a translated research protocol and other materials in Estonian as well as other in languages planned is necessary.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Besides a small fee that is collected for the REC application process from commercial entities, with potential for profit, it should not matter.

International projects have great potential in the areas where sample size is a crucial factor, such as in cases of rare diseases. The informed consent, however, needs to include all the necessary information. For instance, factors such as sample or data transfer abroad or whether research is conducted by a for-profit organization may affect participants' willingness to contribute to a project.^{Reference Trinidad, Fullerton and Bares7}

From the research participants' perspective, participation in a research project that has not been REC reviewed locally may leave them more vulnerable. When the local REC is not familiar with the project, the potential to provide advice regarding participants' rights in this particular project is compromised.

Part II — General Questions

The national supervisory authority for processing of personal data is the Estonian Data Protection Inspectorate that, among other roles, acts as a commissioner and preliminary court; an auditor and a licensor; and a law enforcement agency.⁸

The Estonian Human Genes Research Act regulates the sample transfer of population biobank participants, which includes over 150,000 individuals' samples or 15% of the adult population.⁹ As per HGRA, sample transfer abroad must be approved by the senate of the University of Tartu. Before March 15, 2019, approval from the Government of Estonia was required.

Regarding protection of persons undergoing research, one would have to consider the Oviedo Convention on Human Rights and Biomedicine.¹⁰ Regarding personal data handling of Europeans, the General Data Protection Regulation needs to be considered.¹¹

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. d. I am not sure — or other answer

The cultural expectations are in favor of receiving genetic test results. Surveys carried out repeatedly have shown that approximately 75% of the adult population is interested in genetic testing in general.^{Reference Leitsalu12}

According to the Estonian HGRA, population biobank participants have the right to know, as well as the right not to know what data the population biobank has collected.¹³ However, besides mentioning the right to counseling, it is not specified how participants should receive results or what type of results. Return of results has currently been offered on a project basis.^{Reference Leitsalu, Alavere, Jacquemont, Alver, Palover and Saar14} Additionally, the GDPR Article 20 covers the right to data portability.¹⁵ In the context of genetic research, it would mean that the research participants providing samples for research also have the right to obtain raw genetic data generated.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

The Estonian Health Board, the competent authority in the field of medical devices in Estonia refers to genetic testing as in vitro medical devices.¹⁶ The Estonian legislation regulating medical devices mentions the need for referral and genetic counseling when considering genetic testing.¹⁷ Additionally, the Estonian HGRA mentions genetic testing, but not in the sense as the clinical genetic testing referred to by the Estonian Medical Devices Act. Rather, the HGRA refers to genetic research in the context of the Estonian population biobank and involving the data and samples of biobank participants specifically.¹⁸ The lack of regulations and need for guidelines has been raised.^{Reference Pormeister19} As of now, however, there are no specific regulations or guidelines on direct-to-consumer genetic testing.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

It seems unlikely that the regulations will change in the near future considering the recent European data protection reform and new version of the Estonian Data Protection Regulation that went into force in January 2019.²⁰

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

DTP genomics research seems like a new topic in our country. DTP for other than explicitly genomic research occurs, but usually the commissioning party has a local clinical collaborator for medical research.

Nevertheless, we know that many Finns have sent their samples abroad for commercial direct-to-consumer genetic testing (DTC-GT) and have also provided consent for future research. These overseas companies advertise their services in Finland, but their primary message does not relate to research.

For the purposes of this report, in my opinion, DTP genomic research may be divided into three different categories:

1. Interventional study setup: the participant is asked for a blood (or saliva) sample for genomic analyses to be used in medical research not including use of medicinal products or devices.

2. Clinical trial: the participant is invited for a pre-trial phase to potentially participate in a clinical trial based on his/her genomic information (certain genetic subgroups of a disease; pharmacogenetic factors; where genomic information is used as inclusion or exclusion criteria).

3. Study setup where genetic information is already known (case depending, confirma-tory test with a new blood (or saliva sample) may be needed and then falls under no. 1). The participant has the genetic data in their possession or can allow its use from some other source. This approach may be rather limited at the moment. Interventional studies and clinical trials (1 and 2 above) which have medical research purpose must be evaluated by an ethics committee. This is stipulated by the Medical Research Act.¹

“Medical research” is defined in the Medical Research Act as research involving intervention in the integrity of a person, human embryo or human fetus for the purpose of increasing knowledge of health, the causes, symptoms, diagnosis, treatment and prevention of diseases or the nature of diseases in general. In Finland, we interpret this provision so that, for instance, pure registry-based research does not fall under the Medical Research Act, even if the research aim is medical. Statutory ethics committees evaluate only interventional medical research protocols.

Genomics research, as such, is not currently subject to any specific regulation, but belongs to the general medical research and/or data protection legislation. As a matter of fact, laws do not take direct position on the recruitment procedure, but it must be described to the ethics committee, if it is medical research. Recruitment materials must be adequate and informative, and they are assessed and approved by the ethics committees.

The Medical Research Act §10(a) states that all clinical trials on medicinal products shall be planned, conducted, and reported on observing the principles of good clinical research practice. We have extensive EU-regulation on clinical trials on medicinal products and devices that have directly applicable legislation in the EU Member states.

The Medical Research Act §5 states that medical research may be undertaken only under the responsibility of a medical doctor or dentist with the adequate professional and scientific qualifications. If it is a question of research other than a clinical drug trial, a person other than a medical doctor or dentist may be responsible for the research, provided that the person has the professional and scientific qualifications required for the research concerned.

Laws do not limit genomic research in other countries. If the research participants are recruited in the Finnish territory for “medical research” (see definition in point 2), but genomic analysis and/or the research are to be conducted abroad, then the standard evaluation procedure, as described in point 2, applies.

Studies abroad are not covered by the Medical Research Act if participants are not recruited in Finland. Based on my long experience on Finnish ethics committees, foreign protocols are rarely submitted if Finnish participants are not involved. However, researchers and clinicians engaging in studies abroad may have to submit a research permission from their own employing organization, which may then demand various information and confirmation. This is not statutory, but is rather a hospital or institution policy.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • X Yes, if no intervention (other than saliva kit or existing data)

  • X No, if it is “medical research”

  • __ Not sure or other

If the study is conducted in Finland, then the Finnish laws apply. The study setup defines the need for REC approval. Only “medical research” is subject to ethics approval (see definition in point 2). IRB approval may be part of institutional policy, but is not currently required by law.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • X Yes. Please see my answers in point 2; the study setup defines the need for REC approval. Only “medical research” is subject to ethics approval, so for other research it is lawful.

  • X No. If “medical research” is conducted in Finland, then local REC is needed. Currently we do not apply reciprocity or acknowledge other REC approvals.

  • __ Not sure or other

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • X Yes, if there is health intervention

  • __ No

  • X Not sure or other

The answer to this question depends on the research setup. Under the Medical Research Act §5, medical research must be overseen by a medical doctor or dentist with the adequate professional and scientific qualifications. Medical doctors must be licensed in Finland by the National Supervisory Authority for Welfare and Health. If it is a question of research other than a clinical drug trial, a person other than a medical doctor or dentist may be responsible for the research, provided that the person has the professional and scientific qualifications required for the research concerned. A collaborator is thus needed for medical research. See definition in point 2.

For other than medical research a collaborator is not legally required.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No, as long as the research protocol falls within the definition of scientific research as defined by Recital 159 of the GDPR (EU General Data Protection Regulation) (see appendix).²

  • __ Not sure or other

Part II — General Questions

We do not have specific committees to monitor ordinary sample transport (import or export) for normal research purposes. Instead, transport of biohazardous samples³ or tissues, cells and blood meant for in vivo human use (transplantation or procedures in licensed tissue establishments) are covered by special legislation and procedures.⁴

As for cross-border data transfer, Finland is an EU Member State and must follow EU legislation, such as GDPR (General Data Protection Regulation).⁵ GDPR Chapter V, articles 44 — 50, set the legal grounds for non-EU-data transfers. Data transfers within the EU internal market do not usually require specific safeguards or consultation with the authorities. The same applies also for non-EU-transfers, if the legal grounds of the GDPR are met. The Finnish Data Protection Act (1050/2018) complements the GDPR and establishes and mandates the national data protection authority.

Current laws do not limit genomic research in other countries, but for example, GDPR imposes requirements for data processing and data transfers to protect the rights of research participants. GDPR is applied as long as personal data of EU citizens are processed even outside the EU if the data controller collects the data in the EU. Finnish laws do not apply abroad, and people are at liberty to give consent for DTP research as long as it is not regarded as “medical research” (see point 2 above).

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

Only the Finnish Biobank Act §39⁶ contains legal rules on returning results and is applied if the sample donor asks for health-related information determined from his or her sample. There is confusion as how to interpret this paragraph and if it covers raw genomic data. In addition, the sample donors may express their wish to be informed about clinically actionable research findings in the consent process. The biobank community is currently on its own initiative piloting ways and the feasibility of returning certain well-established genomic information to sample donors. There are still open questions to tackle, such as validation of results and need for counseling, integration of health care, and costs. The new Genome Centre is expected to develop procedures and give guidance in this matter.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Currently, direct-to-consumer genetic testing is legal in Finland.^{Reference Kalokairinou, Howard and Slokenberga7} The authorities are not able to establish whether these companies are part of the private health-care provision or not, and should as such be licensed and authorized based on the Act on Private Health Care Providers (152/1990, not translated in English). Mostly DTC-GT-companies are seen to operate outside of the regulatory healthcare systems, and belong instead to the realms of regulation for consumer goods and services.

DTC-tests have been subject to EU IVD-directive (98/79/EC), to be replaced by a new EU IVD-regulation that becomes applicable on May 26, 2022.⁸ The impact on DTC-activities remains to be seen.

Thus, we do not currently have laws or policies, but the new Genome Centre (see below) is expected to give guidance, inter alia, on the quality and reliability of the services of DTC-companies.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Finland is currently drafting legislation to establish a Genome Centre and to regulate the use of genomic information, national genomics reference data base and genetic tests.⁹ The aim is to enhance the use of genomic data in health care, while also to protect privacy of people living in Finland. There have been concerns about the uncontrollable dissemination of people's genomic data because they do not understand what they consent to and where the data ends up. However, this new legislation is not likely to limit the autonomy of people to participate in DTP research, but rather give guidance. The real content of the draft law is uncertain. It was submitted for public consultation in May 2019. The next version is expected first in the Spring 2019 due to the magnitude of critical statements that require more attention.

Appendix

The Medical Research Act §10(d) sets the following conditions to be assessed by an ethics committee for a clinical trial on medicinal products, but mostly the same is applied to other medical research as well:

1. Appropriateness of the trial and its planning;

2. Appropriateness of the assessment of its benefit and risks and justifiability of any conclusions regarding them;

3. The research plan;

4. Suitability of the researcher and staff;

5. The researcher's information package containing clinical and other information on the medicinal product or products used in the trial that is of significance when testing those medicinal products on people;

6. Quality of the premises and equipment to be used in the trial;

7. Sufficiency and coverage of the written information given to obtain the informed written consent and the procedure for obtaining the consent, and grounds for trials to be carried out on persons not able to give their consent;

8. The grounds on which damages possibly caused by the trial are compensated and insurance policies and other arrangements for covering a compensation payable on account of damages or death;

9. Amount of the fee or remuneration to be paid to researchers and research subjects or the criteria for determining it and procedures possibly related to the matter, as well as the main content of the agreement to be concluded between the commissioning party and the research site; and

10. Detailed procedures relating to choosing the research subjects.

Recital 159 of the GDPR (EU General Data Protection Regulation):

The Genome Centre

The Genome Centre would serve as a national authority for genomics and provide guidance on the genetic testing services. The Genome Act would require that raw data resulting from genomic studies (either from clinical genetics or biobanks) be stored in the Genome Centre. This Act is expected to pass through in the Parliament in the fall 2019 and come into force as of January 1, 2020.

The Genome Act may have some impact on doing international genomic research in Finland. For instance, researchers may be obliged to follow certain quality criteria and submit genomic raw data with supporting metadata after the end of their research to the Genome Centre. It is yet unclear to which kind of research the new Genome Act will be applied. The obligation to store the data in the Genome Centre does not affect the ownership of the data.

The researchers may use the national genomic and other data bases for research. The new Act on the secondary use of social and health data (552/2019, in force as of May 1, 2019, not translated yet in English) will provide a single platform to access Finnish data in the future. One central idea is that the sensitive data of the Finns will not leave the country, but the access to data is offered via a data secure remote desktop.

The Medical Research Act (488/1999) is twenty years old and was drafted to reflect the needs at the time to establish RECs and other procedures and criteria for clinical research with intervention. The Medical Research Act will be revised in 2019. It will be split in two separate acts, of which one focuses on clinical drug trials, and the other for other medical research. Based on the drafts, the basic notion that medical research concern interventional studies seems to remain in the new act as well.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

According to French law, it is lawful to recruit for DTP genomic research in France. The Public Health Code (PHC) implementing the Law relating to Research implicating human persons outlines the conditions for IRB approval which are part of the common procedure (no specific provisions regarding DTP) with a mandatory prior approval of the Comité de Protection des Personnes (CPP).¹ The CPP, which is a regional body, will be in charge of assessing the respect of the conditions posed by law with regards to the methodology of the research and the informed consent documentation. The researcher will also have to conform to a methodology of reference elaborated by the French Data Protection Authority to process the genetic data.² Genetic information collection for research falls under the scope of these methodologies except those whose primary or secondary purpose is the identification or re-identification of persons by their genetic characteristics.

If participants are recruited and are contributing from abroad, French law does not apply. In that case, the French researcher will be part of an international protocol and will be covered under the required approval from the country of origin of the participants.

If a French researcher is recruiting abroad and imports biological material for the needs of their own research, the recruitment phase will not need specific IRB/REC approval. However, an importation authorization will be needed (PHC, article L 1245-5-1) from the ANSM (National Authority for the Safety of Drugs and Health Products) where consent from foreign participants will be needed and will be verified. Additionally, the collection of biological samples will have to be declared to the French Ministry of Research comply with the legal requirements for using biological samples in France (PHC article L 1243.3), explaining the research program and with all necessary information related to validity of the informed consent.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

To date, this participation is not covered by law if there is no French investigator involved in the research. We can assume that this participation would be voluntary and would not require an approval from a French ethics committee as the law is of territorial application. In the latter case, if the samples and/or the data are collected in France, see answer 2.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

This would not be an obligation but a condition to conduct the study. The French researcher would only be able to contribute if he/she recruits and the sample collection is in France.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

To date, these issues are not clearly debated in France. From a legal perspective, the answers on the risks and the ways they should be assessed are based on the application of French law in different situations and notably whether interventions on human participants will be conducted on French territory. From a broader perspective, the inclusion of participants from different countries should be necessary for the scientific objectives of particular research (rare diseases or large genetic protocols) but they should always respect the principles of non-discrimination and non-stigmatization.

Part II — General Questions

France has a stringent legal framework for conducting genetic research to be approved by the CPP when research involves humans, so to say interventional research, research with minimal risks and non-interventional research and the ANSM (only for interventional research). For genetic data, the CNIL (through the methodology of reference) is competent. This framework applies only when the recruitment and interventions are performed in France. To date, only protocols for research on human persons (as defined by the PHC article L1121-1) are covered under French law. As of now, the free participation of individuals in research projects is outside the scope of the law and has not been yet adressed by our institutions.

Yes, genomic research is strictly regulated under French law, first concerning the use of genetic testing in the medical setting (diagnosis, treatment, prevention). The law also applies for research conducted under the Research Implying Human Persons Act included in the HPC. Notably, French law requires written informed consent either for medical or research activities when genetic information is sought (Civil Code article 16-10 and article PHC article L1122-1-1). However, an opt-out system is permitted when biological samples already gathered for other purposes are used for genetic research (PHC Article L1131-1-1). This framework is only applied when the research is performed in the French territories and does not apply to research to be performed abroad. As for genetic data, the law on informatics and freedom (article 63) also requires informed consent in writing that includes the same exception. The French law on informatics and freedom has possible extra-territoriality in its control over data processesing as stated in the General Data Protection Regulation, but it is still unclear if the requirement of article 63 could be part of this control as it is a French exception.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

The law requires the return of individual results unless the participant expressly declines to have results returned (PHC, Article L1122-1).

Global results can also be returned (PHC, Article L1122-1).

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Under the Penal Code it is illegal to personally seek genetic information (when it is done directly by an individual and out of health or the research legal framework): article 226-28-1: In fact, for a person, to request the examination of his genetic characteristics or those of a third party or the identification of a person by his genetic fingerprints outside the conditions provided for by law is punishable by a fine of 3 750 €.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

This issue should first be discussed at the French national level as it is not currently the case. Direct-to-participant genomic research will increase in the next few years, and our institutions will have to make decisions and adapt our legal framework. I think France will act under the umbrella of the EU law as for the genomic data but will be much more restrictive as for the use of human specimens. Thus, the consequence could be a lack of harmonization between use of data and use of biospecimens.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

There is a lively debate among stake-holders, driven in part by the very narrow scope of the law on genetic diagnosis, but also because of the increasing availability (and affordability) of DTC genetic testing offerings online. The FDA prohibition imposed on 23andMe in 2013 has catalyzed this debate. The German parliament (Bundestag) regularly seeks expert scientific and legal/ethical opinion on this issue through the mechanism of technology impact assessments, the last one being from April 4, 2019 on prenatal diagnostics (19/9059) which outlines increasing demands to find an EU approach to direct-to-consumer offerings in the sphere of genetics and genomics.

There has been a significant increase in stakeholder debate about commercial DTP genomic research and related issues in Germany since the German Genetic Diagnostics Act entered into force on 1 February 2010.¹ The Act puts restrictions on the personnel who are entitled to perform genetic tests on individuals and imposes further restrictions on the use of genetic and genomic analyses in the context of insurance provision and in employment. Prior to entering into force, there was widespread public consultancy on the issues covered by the Act. The stringent provisions of the GenDG encompass all genetic and genomic analyses for medical purposes but are expressly not applicable where genetic and genomic analyses are performed for research purposes only.

IRB/REC approval in Germany is only required in a limited range of contexts. These are institutional, professional, and statutory in nature. This results in a wide range of different types of IRB/REC, constituted on the basis of different instruments with widely diverging normative clout. Whilst the most important 52 regional and federal IRB/REC have formed a working group to standardize protocols and processes, there is a great deal of fragmentation and the exact answer to the question depends on a number of variables.

Part II — General Questions

The export of biospecimens from Germany is regulated according to the Accord Européen Relatif au Transport International des Merchandises Dangereuses par Route (ADR). Bio-specimens are categorized according to the risk they pose (Category A – WHO risk group RG 4 and culture derived from RG 3; Category B – RG 2 and RG 3; exempt human biospeci-mens).⁶ The decisive aspect is the level of infectious potential that the specimen exhibits. Category A must be sent by way of specially designated and licensed couriers. Category B and the exempt specimens may be sent by ordinary mail if packaged appropriately. Unless exempt, commercial entities and research institutes that regularly send hazardous specimens are required to nominate a hazardous goods officer.⁷ The officer is responsible for ensuring institutional compliance with the appropriate regulations.

In relation to data protection, each federal state has a designated data protection official (usually attached to the local government structure). They enforce the requirements of data protection law against public institutions as well as non-public institutions which process data automatically, but expressly not in cases where the data are transferred for exclusively personal or family reasons.⁸

These provisions apply to institutions (including commercial entities), but not to private individuals.

The provisions of the EU-GDPR, including those specifically in relation to genetic privacy (as a special category of personal data protection, see e.g. Art. 4(13), 9, and Recital 34 EU-GDPR),⁹ apply to entities based in third countries which obtain and process data of German/EU citizens.

In terms of criminal law, §§ 5, 6, and 7 of the German Criminal Code (StGB) provide that some criminal offences against a German citizen abroad can be prosecuted under German law.¹⁰ There is a great deal of uncertainty whether this might also include offenses committed against an individual's privacy or informational self-determination.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

The law in relation to informational self-determination¹¹ provides that individuals have a prima facie entitlement to know results that constitute their personal data (i.e., individual results or incidental findings). It is generally accepted that this right to know one's own information also includes the right not to know the same information. Current jurisprudence, based on constitutional principles, therefore provides that information ought to be provided unless the individual has asked not to be informed. Most informed consent procedures now contain an appropriate section where individuals can opt in or out of the return of individual results. The guidelines issued by professional bodies, for example in the context of biobanking, provide sample consent procedures in line with the jurisprudence. In terms of the cultural expectation, it is safe to say that this is linked to the jurisprudence: the judgment which gave rise to the right of informational self-determination concerned public disquiet about the amount of information gathered in the 1980s German census. Since then, the public perception has been strongly in favor of individuals having unfettered access to their individual information, as well as strong control rights in that information. This is now increasingly reflected in the provisions of the EU-GDPR (which was decisively driven and shaped by a German Green MEP).

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

As outlined above, where DTC testing concerns a diagnostic aspect which amounts to medical genetic testing, the provisions of the GenDG come into effect. There is then a statutory requirement that all communication with the participant be in person, and carried out by a registered geneticist (i.e., a specially trained physician).^{Reference I12} There are specific statutory requirements in relation to information giving and consent taking,¹³ as well as how the feedback of genetic results is to take place.¹⁴ In addition, paternity testing is only permissible in very limited circumstances.¹⁵

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

It is difficult to envisage a regulatory regime capable of effectively governing a cross-border activity that involves private individuals, exempt specimens that can be sent by ordinary post, and the processing of data in the context of globalized networks. The German federal government regularly provides funding for large-scale research projects that address the issues of stakeholder engagement and public communication of science in this field, and it is much more likely that the current discussion in Germany will focus on ensuring individuals' health literacy and appreciation of how data and samples are used, and to facilitate a use of data and samples which is in line with individuals' legitimate expectations. If a policy change does take place, it is likely that this will be at the EU level rather than the individual member state level.¹⁶

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

In Greece, all research proposals submitted in universities or public research institutes need to obtain approval by the competent RECs. Members of RECs are scientists from the institutional personnel and external independent members with expertise in law and ethics. The PI needs to submit the research protocol and all relevant information (details about funding, institutional support, CVs of the research team, etc.) and to fill out a questionnaire on ethical issues to be addressed. The committee examines all the above documents and sends a decision comprising requirements and relevant recommendations, within 15 days (if delayed, approval is presumed). The PI needs to present a compliance report, which would be subject to further examination by the committee. If that report is satisfactory, the required ethics approval is provided by the REC. The PI has a right to object to one or more requirements; in that case, the REC sends a question to the Hellenic National Bioethics Commission, and revisits the problem, taking into account the answer received.

If no part of the research is to be performed in a Greek university or public research institute, RECs in Greece have no competence whatsoever, even if the researcher is a Greek citizen.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No; Approval from the Host Institution of the researchers' country would be required.

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other. It is unclear whether a researcher would be able to conduct research in Greece without any local approval or authorization of any kind.

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Benefits could occur if that research leads eventually to the identification of genomic profiles related to groups of the Greek population for healthcare purposes. Such population detailed profiles may be of interest for designing public health strategies, taking into account other locally important relevant data (nutrition, life-style). Participation of Greek researchers (geneticists, sociologists, etc.), knowing the basic genetic, medical, demographic, and other parameters of the Greek population would increase that possibility.

Risks are definitely those of intentional or not personal data flow, without conditions of adequate protection, according to the EU legal standards (General Data Protection Regulation [GDPR].)

Part II — General Questions

There are specific regulations for the exporting of biological samples used for clinical (diagnostic) purposes, which is subject to licensing by the Medical Association. No regulation on biohazard control exists for the exporting of samples to be used in research, however the transfer must comply with IATA regulations on safety.

Yet, data protection legislation is fully applicable, concerning the data transferring — see below). Data Protection Boards: Greece, as a member of the EU, was bound by Directive 95/46/EC adopted in 1995 regulating the processing of personal data within the European Union. Based on that Directive, Law 2472/97 was enacted in Greece, providing, among other things, for the establishment of the Hellenic Data Protection Authority, which is competent for the data protection in the country (including transferring of data across borders). Since May 25, 2018, Greece is bound by the GDPR 679/2016 and the DPA is acting in this framework. The requirements of the GDPR apply to individual citizens as well as research and medical institutions.

On September 6, 2018 Greece signed the European Declaration on Cross-border Access to the Genomic Database (European “1+Million Genomes Initiative”).¹

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

The Hellenic National Bioethics Commission has repeatedly underlined the need for specific legal regulation of issues pertaining to genetic testing and genetic data protection. The Parliament and governmental policy-makers (regardless of political orientation) have shown interest in undertaking initiatives, but so far they have not prioritized the topic. As already mentioned, Greece has neither signed nor ratified the Additional Protocol on genetic testing. It is possible that the emergence of a flourishing market of genetic services (public and private) in the country will promote specific regulation in the next years. Given that Greece has signed the Declaration on a European Genomic Database, research may be facilitated. Still, however, it will have to comply with the strict provisions of the GDPR with regard to data processing and protection of the individual.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

It is not possible unless this is part of a project approved by an IRB. IRB approval is possible provided the research project is conducted by an institution that has been authorized to conduct research.

The research project should be approved by both institutions and their respective IRBs. Indian Council for Medical Research guidelines would be applicable and so are the guidelines of the respective institutions.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • X Yes, but it depends on type of research and what is the objective of the research.

  • __ No

  • __ Not sure or other

Benefits: Contribution to scientific knowledge, potential to find solutions, scope for collaboration, capacity building, and learning.

Risks: Biopiracy, unauthorized uses and gains from them, misappropriation, deriving value without benefit sharing and compensation, claiming intellectual property rights based on materials or data collected.

Part II — General Questions

Yes.

No.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Please note the following points:

1. Under the New Drugs and Clinical Trial rules of 2019 ICMR ethical guidelines are compulsory for any biomedical and health research including Direct to Participant Research.

2. ICMR guidelines cover genetics and genomics research and are applicable for any research, whether it is commercial or non-commercial.

3. For collaborative projects, the Health Ministry's Screening Committee (HMSC) clearance is necessary.¹

4. Transfer of biological samples under a material transfer agreement or memorandum of understanding is subject to the ICMR guidelines and guidelines cover all types of biological samples

5. Direct to Consumer Genetic Testing is available in India with at least 20 companies offering them for different purposes. While some offer general services, few offer specialized services for testing for certain diseases such as cancer.

6. The ICMR guidelines were revised in 2017 and they have to be read in conjunction with other relevant laws and regulations such as Drugs and Cosmetics Act, New Drugs and Clinical Trial Rules 2019.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

To date, the legal framework of Human Subjects Research (HSR) in Israel has been set only by regulations issued by the Ministry of Health (MOH) in 1980, lacking comprehensive legislation by the Knesset, the Israeli parliament (a bill sponsored by the MOH has been in preparation for over 20 years). The Genetic Information Law, 5761-2000, contains several clauses dealing with consent to genetic research.¹ According to the Public Health Regulations (Clinical Trials in Human Subjects) of 1980, all research involving human genetic material requires special approval from the National Committee for Research in Humans. The Committee reviews every aspect of the research proposal based on national and international genetic research standards, such as the Helsinki Declaration of 1964 and its subsequent amendments. Thus, the merits of the research, protecting the autonomy and the well-being of participants and the right to terminate participation are assessed.

Pertinent to our query, the method of recruitment is part of the evaluation procedure. The researchers will have to explain how they intend to enroll participants (approaching patients, designated clinics, open recruitment via traditional or social media) and the risks each method entails (mostly confidentiality, but also discrimination, vulnerable groups, the use of enticement). The review includes the informed consent process and documents, including clarity, accessibility (literacy level), as well as material aspects such as research objectives, breadth of use of samples and/or genetic information, data protection, and data sharing. Failure to apply for the Committee's approval can theoretically expose the researcher to disciplinary measures. Such measures, however, have been used thus far very scarcely, mostly in cases of clinical trials where participants were exposed to physical harm (such as unauthorized biopsies) and not in the genetic sphere.

The working paradigm in Israel is that each jurisdiction is responsible to implement its laws, rules and regulation. Therefore, the Israeli IRB will not evaluate such proposals.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

An outside researcher cannot do research in Israel absent the Committee's approval. So, in Israel it would be unlawful.

• __ Yes

• __ No

• X Not sure or other

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Of note, this matter is a subject of repeated discussion, whereas international pharma companies, conducting multi-site/multinational studies urge Israel to relax its current practice and specifically allow reliance on another-country's approval (either directly or indirectly by requesting that documents/protocol be identical in all sites, irrespective of domestic legal/ethical concerns). Part of the impetus behind such prodding is the intention of pharma companies to make use of the combination of medical/clinical data and genetic and medical laboratory results collected for care. Apparently, Israel's record keeping represents a valuable database for pharmaceutical research and development, and hence the need to relax regulation in order to allow more and better research. The common official response, shared by most jurisdictions in the world, relates to state sovereignty and rejection of “outsourcing oversight of human subject research”.

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • X Yes — collaboration or a local CRO, and be approved by domestic IRB

  • __ No

  • __ Not sure or other

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The ability to propel scientific initiatives is dependent on adequate resources — workforce, infrastructure, and funding. The prospect of allowing researchers from other countries to conduct research on domestic patients/participants can be an important way to amplify scientific progress, pool resources, and divert attention to overlooked areas in genomics (such as in cases of diseases that attract low attention in one community but are important in others). The risks are derived from the subject matter — genetic and genomic information. The concerns attached to information risks include privacy, confidentiality, genetic discrimination, and the like. However, in regimes with national health insurance schemes, these risks carry a far lesser weight, and can be adequately addressed.

Part II — General Questions

Israel does not have dedicated committees (biohazard, data protection) to address export of genetic material for research. Several international currier companies operate in Israel with import/export permits, including the transfer of biological samples.

Some aspects of international genomic research have been framed into regulation issues by the MOH in 2014.² These regulations require that only coded/anonymized material can be transferred/shared with overseas research projects while the code remains solely in Israel. To share/transfer samples, researchers must ensure that sufficient biological material remains in Israel, and present a written commitment from both the non-Israeli researcher and laboratory that they will comply with local and international standards and will follow the national IRB guidelines in respect to confidentiality and privacy.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned,

• c. The law is silent on return of results; aggregate results are typically returned [not necessarily], but individual results are not returned unless expressly stated in the research protocol. The national IRB does expect, and so conditions its approval, that researchers demonstrate their ability to report back to participants/patients if actionable results emerge from the study, at the expense of the researcher.

• d. I am not sure — or other answer

• a. Yes. Direct-to-consumer genetic testing is illegal, especially because of the fear from unauthorized paternity tests, that by law can only be performed following a court order. However, the private action of sending one's own sample abroad is not illegal as the regulatory framework applies only to the professional sector — clinicians, genetic counsellors, researchers, and laboratories.

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

The response of the Israeli regulators will depend on demonstrable benefits. Israel is known for its innovative spirit (“Start-Up Nation”), including of medical innovation, and such a stance is bound to impact regulation.^{Reference Siegal3} The ability to collect biological samples has been around for quite a while, with discernible outcomes such as deCode, 23andMe and the UK Bio-bank. Parochial concerns or “protecting the genomic asset” of a community seems at odds with the concerted action needed to achieve major breakthroughs in genetics and genomics. The collective engagement can be achieved once the proper mechanisms of benefit sharing, equitable access to tests and treatments, and adequate safeguards against discrimination/breach of privacy are all in place. Albeit a restrictive policy, many Israelis use overseas companies such as MyHeritage or 23andMe simply by using third parties and the internet. Thus, the tide has been noticed, and regulatory action will follow.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

Genomic research is a subject of discussion among Italian researchers and policy makers and within institutional bodies, although the discussion is not particularly focused on DTP genomic research.

The major institutions that have issued documents and opinions on genetics and genomics are the Italian Committee for Bioethics,¹ the Italian Committee for Biosecurity, Biotechnology and Life Sciences,² and the Joint Group CNB-CNBBSV.³

The permanent conference for the relations between the State, the Regions, and the Autonomous Provinces of Trento and Bolzano adopted an agreement approving the national Plan for Innovation of the Health System Based on “Omic” Sciences. ⁴

The Italian Society of Human Genetics (Società Italiana di Genetica Umana, SIGU) has issued recommendations and guidelines.⁵ In October 2006, SIGU and the Smith Kline Foundation published the Guidelines for Clinical Protocols in Genetic Research. Recommendations for the Drafting and Assessment of Clinical Research Protocols in Genetics.⁶

Although the Guidelines formulate several recommendations, they do not mention DTP genetic or genomic research.

Protocols for genetic or genomic research must be approved by ethics committees.

The basic regulation for ethics committees is Legislative decree no. 211/2003,⁷ as amended by Legislative decree no. 52 of May 14, 2019.⁸

Legislative decree no. 211/2003 transposed Directive 2001/20/EC of 4 April 2001 into the Italian legal order, but it should be kept in mind that the Directive will be replaced by Regulation (EU) 536/2014 (entered into force on 16 June 2014), once it will be declared applicable by the European Medicines Agency.⁹

In general terms, Article 6, paragraph 2 of Legislative decree n. 211/2003 contains a list of elements and conditions to be taken into account by ethics committees to formulate their opinions on proposed research protocols.

The Guidelines for Clinical Protocols in Genetic Research list the specific information that a protocol should contain. According to the Guidelines, any collection of human blood and/or other tissue samples for research involving genetic testing must be under the control and supervision of the ethics committee, which evaluates the protocol and the consent document according to the same general criteria used for any biomedical research protocol. These documents should contain information on the release of individual results and on the collection, storage, and use of collected biological samples and data.

In particular, the protocol should describe: methods of collection, level of identification, storage time, uses for which the samples can be employed, guarantee of safe conservation, possibility for the subject to request the destruction of the sample, possibility that the samples will be shipped to other laboratories; times, methods, security measures for processing and storing the data collected or generated in the research area, the possibility that the data will be provided to other laboratories and, if abroad, the guarantee that these will guarantee the same standards of security in the protection of confidentiality; availability of the interested party to have his/her data/samples used for further purposes; that the subject can have access to their results upon request, even if they are not useful for their health; and whether anyone else can obtain individual results.¹⁰

According to article 7, paragraph 1 of Legislative decree no. 211/2003, multicenter clinical trials conducted either in Italy alone, or in Italy and in third countries, must be issued an opinion by the ethics committee of the Italian institution to which the coordinator or PI for Italy is a member. This opinion must be received within thirty days from the date of receipt of the application submitted by the trial promoter and the trial must not start on any site before the opinion is issued.

According to article 8, paragraph 2, the application referred to above must, in the case of multicenter trials, also be simultaneously submitted to the relevant ethics committees for the other (Italian or foreign) research centers or institutions.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • X Yes. Once Regulation (EU) 536/2014 will be applicable, Article 74 will require that the sponsor of a clinical trial who is not established in the Union shall ensure that a natural or legal person is established in the Union as its legal representative.

  • __ No

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The major perceived risks would regard compliance with informed consent requirements and the protection of personal data, especially if the foreign country is a non-EU Member State which is not compelled to respect European-wide agreed stamdards.

Part II — General Questions

Data protection is regulated under the Italian Personal Data Protection Code (Codice in Materia di Protezione dei Dati Personali)¹¹ and EU Regulation 2016/679 (General Data Protection Regulation, GDPR).¹²

The Code was amended by Legislative decree no. 101/2018 in order to make it consistent with the GDPR.¹³ This decree made use of flexibility afforded by the GDPR to Member States with respect to processing activities based on legal obligations or for purposes of public interest (Article 6(1), letters c) and e)); processing of biometric, genetic and health-related data (Article 9(4) and Article 36(5)); processing activities covered by Chapter IX of the GDPR (including research). As a result, while several provisions of the Code were left in place, as they were found not to be in conflict or overlap with the GDPR, other provisions were amended or repealed, and new sections were added. Among the repealed provisions were Sections 43-45 regulating the transfer of genetic data and samples to third countries (including towards non-EU countries under specific conditions), permissible transfers and prohibited transfers.

The Italian Data Protection Authority¹⁴ issued a number of decisions on Biometrics & Genetic Data,¹⁵ most notably general authorizations for the processing of genetic data, which allowed the treatment and transfer of such data under specific conditions and security measures until May 24, 2018, the date of entry into force of the GDPR.¹⁶ These authorizations applied to a broad range of persons and institutions: health care practitioners; public and private health care bodies; medical genetics laboratories; natural and legal persons, research bodies and/or institutions, associations and other public or private bodies; psychologists, technical consultants and their assistants; pharmacists, etc.

With regard to transfer of personal data to non-EU countries, the Authority also issued several authorizations for cross-border data flows towards third countries.

The Authority has recently adopted a decision indicating which provisions of its general authorizations are consistent with the GDPR.¹⁷ In section 4, concerning the prescriptions for the treatment of genetic data under general authorization no. 8/2016, sub-section 4.11.4 on communication and dissemination of data, the Authority states that genetic data and biological samples collected for scientific research and statistical purposes may be communicated or transferred to research institutions and bodies, associations and other public and private research bodies, exclusively in the context of joint projects. Genetic data and biological samples may be communicated or transferred to third subjects not participating in joint projects limited to information without identification data, for scientific purposes directly related to those for which they were originally collected and clearly determined in writing in the request for data and/or samples. In this case, the requesting party undertakes not to process the data and/or use the samples for purposes other than those indicated in the request and not to communicate them or transfer them further to third parties.

As far as privacy is concerned, the Italian Personal Data Protection Code, the EU Clinical Trials Regulation and the GDPR would apply.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

In the opinion issued by the Italian Committee for Bioethics on Managing “Incidental Findings” in Genomic Investigations with New Technology Platforms,¹⁸ the issue of return of information to donors of biological samples for research purposes is partly addressed. The Committee observes that, in case of research involving the collection of a large number of samples, it is unrealistic to re-contact the donors to update them on the results, which could hardly have a clinical value of individual interest. The NBC recommends, however, that it should always be specified in the informed consent form whether there is this possibility and, if so, the choice of the information that one wishes to receive is left to the interested party. The Committee states that it is morally compulsory to guarantee, if requested, a return of the results of clinical relevance to patients suffering from rare diseases still lacking a certain diagnosis, who have entered into research protocols and donated their samples in the hope of accelerating their knowledge of the causes of their illness.

In the Guidelines it is recommended that in drafting or assessing clinical research protocols in genetics it should be borne in mind that: individual genetic results must be disclosed to the patient who requests them regardless of their possible clinical utility; individual genetic results should not be given to others if they are not of immediate clinical utility; individual results that may be useful for the health of the subject must be provided to his doctor; the investigators participating in the research should receive a report containing the global results.¹⁹

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. Direct-to-consumer genetic testing is legal in compliance with EU law on IVDD but there is no specific organic legislation

Genetic tests are currently regulated as in vitro diagnostic devices under Legislative decree n. 332/2000²⁰ transposing Directive 98/79/EC of October 27, 1998. As of 2022, the new Regulation (EU) 2017/746 of April 5, 2017 on in vitro diagnostic medical devices will apply.

Italy has not enacted any specific/organic legislation on DTC genetic tests. In 2017, the Ministry of Health issued New Guidelines for Advertising of Medical Devices, in Vitro Diagnostic Medical Devices and Medical-Surgical Devices.²¹

The opinion issued by the Joint Group CNB-CNBBSV on Genetic Susceptibility Testing and Personalized Medicine ²² refers to DTC genetic testing. It does not take any position on the issue of legality, although it states that the offer of DTC diagnostic tests frequently disregards both the professional genetic counselling required by international and national regulations, as well as bioethical considerations such as the protection of confidentiality, privacy, the familiar dimension of genetics, the right “not to know” and the protection against discrimination and stigmatization.²³

According to the Joint Group, the decision to place genetic tests within the generic category of “in vitro diagnostic medical devices” should be reviewed and a separate category should be envisaged.²⁴ The opinion also contains recommendations to promote the proper and responsible use of DTC genetic tests.²⁵

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

Japan already has some ongoing cases of DTP genomic research. Otherwise I cannot find any discussion among policy makers.

An IRB will generally consider the following principles:

1. Respect for human dignity

2. Informed consent

3. Protection of personal information

4. Conduct of socially useful research that contributes to human intellectual base, health, and welfare

5. Prioritization of individual's human rights security over scientific or social interests

6. Preparation and compliance of research plans based on this guideline and ensuring research appropriateness through prior examination and approval by the Ethics Review Board from an independent standpoint

7. Ensuring transparency of research through on-site inspection of research implementation status by third parties and publication of research results

8. Promotion of public and social understanding through enlightenment activities on human genome and gene analysis research, and dialogue with the public based on the research content

Case 1: From 2016, in collaboration with the University of Tokyo Institute of Medical Science and Research, DeNA Science sells a genetic testing tool (MYCODE) on the Internet, where participants who have obtained consent to participate in the research will be surveyed on the Internet. They are conducting research linked with the questionnaire results and genetic analysis.¹

Case 2: DTP genetic research targeting on bipolar disorder diagnosed patients and their family is ongoing by RIKEN Center for Brain Science.² This research purposed on defined mechanism of bipolar disorder.

Case 3: In 2018, collaborative research started by six Hospitals of National Hospital Organization about genomic analysis study targeting on chemical sensitivity of 800 participants as DTP.³

IRBs/RECs in Japan will review the conditions in both countries and will adopt of the stricter of the two.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

No, a researcher from the other country should get IRB/REC approval in Japan.

There is no law about conducting DTP genomic research in another country.

1. When a research institute in Japan conducts joint research with an overseas research institute, it is required that the researcher in the partner country will act as joint researcher subject to Japanese rules for treating samples.

2. When an organization conducting research in Japan conducts collaborative research with an overseas research institute, in principle, such research should be conducted in accordance with this guideline while complying with the laws and guidelines set forth in the partner country in which the joint research is conducted.

However, in the case where the standards in the other country are stricter than this guideline, research should be conducted according to the standards in the partner country.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

The researcher should get the IRB/REC approval in Japan, but under some conditions the researcher can submit only their own country's approval.

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

A collaborator can be a foreign country organization.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

It does not matter. Japanese guidelines presume the external researcher is based at a commercial, governmental, or academic entity.⁴

Part II — General Questions

Yes, the University of Tokyo and some of the larger universities have Life Science Research Ethics and Safety committees to review biohazards, the ethics of animal testing, and the export of biospecimens, among other things.

Individual citizens are not subject to such oversight.

There are no statutes applicable to DTP research. Self-guidelines have been established by the Ministry of Economic, Trade and Industry (METI), as well as industry groups.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

In principle, the results of genome research are not generally returned.

However, in February 2013, the “Ethical Guidelines on Human Genome and Genetic Analysis Research” were revised, and provide that, if a provider of genetic information wishes to have their research results returned, the researcher should do so. If the researcher opts not to return the results, the reasons or conditions for this must be indicated.⁶

In the guidelines, the return of genetic information is considered to be a “principle.” However, in many research projects it has become customary to not do so based on the conditions separately written in the guidelines.

However, some genome banks have decided to return results because the results of genetic information analysis may be useful not only for research but also for the health of each participant. For example, informed consent in the Tohoku Medical Megabank Project describes the circulation of genetic information as follows:

In deciding on whether to return results, the following four conditions will be carefully considered:

1. The information has accuracy and certainty as information for evaluating a health condition

2. The information shows important facts for everyone's health

3. There is no risk that the proper implementation of research work will be seriously hindered by distributing the information.

4. If there is a significant impact on life and health, then there is an effective treatment.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

There is no legislation concerning DTP genetic testing. However, there are self-guidelines established by Ministry of Economy, Trade and Industry (METI)⁷ and industry groups,⁸ as well as other guidelines established by the Japanese Association of Medical Sciences.⁹

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

In Japan, there is currently no law that prohibits them. It is believed that the implementation of international DTP genomic research itself will expand. In this case, the need for norms is pressing.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

The IRB may approve the research if adequate safeguards for the following are present:

• Privacy and confidentiality, e.g., sample coding/de-identification, who will have access to private data and test results, will the results be shared by other institutions or researchers, will such results be included in participants' medical records.

• Informed consent, e.g., how to make sure participants understand and comprehend information provided including risks of participation, are participants able to make participation decisions autonomously.

• Participants' benefits and compensation, e.g., identifying harmful genetic mutations for certain diseases, where effective measures can be taken for better health outcomes (i.e., prophylaxis or treatment options).

• Returning results, whether individual or aggregated, and incidental findings, especially actionable ones e.g., the emotional, psychological, and social impact of returning such results on the individual and family, including stigmatization, family conflicts or genetic discrimination in insurance or employment.

• Genetic counseling services, e.g., how and who will interrupt results to the participant and its health impact for the individual and family, possible effective measures to reduce risk, clinical validity and uncertainty of some tests.

• Data and biospecimen ownership.

• Commercialization.

• Provision for data and biospecimens withdrawal, and biospecimens destruction.

Same conditions as above in addition to the approval from the IRB/research ethics review body in the other country or institution.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other; Since there is no governing official legislation or guidelines that regulate such research in Jordan, the issue is left to the local IRB/REC to determine whether such research can be approved as per the requirements described in question 2. If there was direct recruitment from the researcher to the participants without passing through an institution, then there are no publicly available guidelines that can be applied.

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other; There is no law or guideline that can be used to guide the researcher or the participants. So essentially this would be similar to part A.

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

At our institution we always ask for an internal “Site Principal Investigator” for all external research that is conducted within the premises of the institution. If our local IRB acts as the “IRB of Record” where it reviews a study by an external PI that plans to recruit participants from the community, we always mandate the presence of a local collaborator from the country. However, in the absence of official legislation or guidelines that govern this type of research, it is left up to the external researcher to approach one of the local IRBs and act accordingly.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

A survey study of 205 adult cancer patients in a cancer center in Amman reported that 81.0% accepted sending their surplus samples to research laboratories abroad, even without specific consent.^{Reference Al Hussaini and Abu Hmaidan1} Additionally, an unpublished survey study of 400 adult cancer patients in the same center found that 60.6% believed that they should retain some ownership of donated samples, while 86.6% would not mind using their samples in research by “for-profit” third-parties if they were initially informed.

Although the public might find such acts acceptable as supported by the above studies, the situation might be different from a governmental point of view. For example, Article 9 of the Jordanian Stem Cell Statute prohibits the collection, procurement, storage or use of embryonic stem cells for research or therapy in any form unless by a specialized governmental institution or publicly funded academic institution.² Dajani (2014) commented that this is due to the expected higher levels of transparency of governmental organizations in addition to the supervision by the Ministry of Health and its specialized committee.^{Reference Dajani3}

From my own previous experience with transfer of biospecimens (saliva in the case encountered) for the purpose of an IRB-approved research activity, the Ministry of Internal Affairs in Jordan did not approve the transfer of the saliva outside of the country. Therefore, such issues should be taken into consideration when dealing with DTP genomic research, even in the absence of official legalization that addresses this issue in particular.

There are no clear obligations from governmental entities. Nonetheless, our IRB mandates the presence of a local collaborator from the original country, i.e., a site principal investigator. This is to ensure accountability of the biospecimens in the country of origin and integrity of the data. The IRB may request the site principal investigator to approve the way the results will be presented and disseminated to eliminate the risk of social stigmatization, especially in minority populations. This is very important considering the tribal nature of our community and high risk of social and psychological stigmatization and its serious consequences if such results were to be disclosed inappropriately. Again, this is the practice of our local IRB; other IRBs in the country might not mandate having a site principal investigator.

From the public perspective, people in this part of the world are very worried about potential misuse of their biospecimens and data in, for example, foreign political agendas affecting the safety and security of the nation, publicly known as the “Conspiracy Theory.” In the unpublished survey study, “Trust” in the custodian research organization and employees were the main driving forces for participation in biobanking research (84.2% and 85.3%, respectively).

Part II — General Questions

None.

None.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

Note: In the previous published work, 84.9% were interested to know the results of that research, but with a specific opt-in consent.⁴ Similarly, in the unpublished work, 74% respondents wanted to know results when donating biospecimens for biobanking.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer. While this issue is becoming regulated in many countries, the local authorities, with the help of the scientists, should work to ensure the drafting and approval of legislation to regulate and govern “genomic research,” including international DTP research.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

From our perspective, the Mexican discussion about genomic research gravitates around the lack of funding. There is little discussion about the recruitment of participants for this type of study; mostly it revolves around the need for previous informed consent.^{Reference Ruiz de Chávez, Piña Jiménez, Jim, Sánchez and Oliva Sánchez1}

According to the General Health Law, every institution that conducts medical research on human beings should establish a Research Ethics Committee (REC). This includes public, private, and social institutions. The REC is responsible for evaluating and accepting all protocols involving research on human beings. The REC is also responsible for establishing research ethics guidelines and overseeing their implementation. The REC's activities must comply with the laws and guidelines set forth by the National Bioethics Commission. The statutory provisions also establish that RECs should be interdisciplinary organs, including the participation of people that have received training in bioethics, including: physicians with different specialties, nurses, social workers, and experts in psychology, sociology, anthropology, philosophy or law. RECs must include patients representing the affected community. The law also mandates that RECs should aim for gender equality. (See article 41 Bis of the General Health Law)

Article 100 of the General Health Law and its Regulations on Health Research establish the following requirements to conduct research on human beings:

• Respect for the scientific and ethical principles that justify the project.

• The project can be conducted only when the expected knowledge cannot be obtained by other means.

• Reasonably ensure that the project does not create unnecessary risks for the participant. The Regulations classify research on human beings according to the risks it might entail. Genomic studies using samples of blood or saliva are classified as minimal risk studies.

• Written informed consent letter signed by the participant or their legal guardian. According to the Regulations, the project's research leader should draft the document and ask for the approval of the institution's REC. The participant must be informed on the research objectives and justification, as well as its possible positive or negative outcomes for their health. The document must be signed by two witnesses. Two copies of the informed consent document must be signed: one for the participant and one fo the institution. The participants can withdraw their consent at all times.

• Research on human beings can only be conducted within medical institutions, acting under the surveillance of health authorities. Such institutions must have the capacity to secure the participants' integrity.

• Population genomics studies must be part of a research project.

• The health professional responsible for the project is bound to stop activities if they could cause serious injury, disability or death.

• The responsible institution must secure medical care for the participants in case they suffer any collateral injuries related to the research activities performed on them. This does not exclude other types of liability.

• The responsible parties (institutions and individuals) must protect the participant's privacy, identifying the subject only when the research activities require it and the participant has granted permission to do so.

RECs must assess that protocols comply with the aforementioned requirements and shall be registered before the National Bioethics Commission. It is important to clarify that Mexican law does not create barriers on a DTP approach. In fact, Regulations contemplate both individual and group approaches.²

Mexican law does not contemplate the hypothesis of a researcher based in Mexico wanting to conduct research in another country. Thus, the foreign country's requirements would apply. If the project involves any activities within Mexico, then the project would need a Mexican institution to sponsor it, through the approval of its REC and the fulfillment of all the requirements listed in the answer to question 2.

Historically, the Federal Government has allocated funds to Mexican scientists to conduct studies through grants administered by the Ministry of Foreign Affairs and the National Council of Science and Technology. However, these calls for proposals focus on establishing criteria for the allocation of funds to Mexican scientists affiliated with foreign institutions, but do not contemplate the approval of a research protocol in Mexico. Thus, the rules that apply are those that govern the foreign institution.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The foreign researcher would need to partner with a Mexican institution to conduct research in Mexico. Mexican law does not require the approval of an REC in the researcher's country. However, the REC housed by the Mexican institution would likely ask for such approval form the foreign IRB/REC.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Since Mexican law does not contemplate this hypothesis, the lawful way to handle this situation is to partner with a Mexican institution.

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

The external researcher would most likely be required to have a collaborator in Mexico. The researcher's institution might apply for authorization for the research protocol before Mexican Health Authorities; however, such a permit might be denied without the collaboration of a Mexican institution.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

According to Mexican legislation, whether the researcher is based at a commercial, governmental, or academic entity should not be a relevant factor as long as the foreign institution collaborates with a Mexican institution that houses a validly installed REC. Research on human beings can be carried out by public, private and social institutions.

If a researcher from another country conducted IRB/REC-approved genomic research on samples or data obtained from Mexico, there is a risk that the public could misinterpret the work as “experimenting” with the Mexican population, especially if the project involves members of a socially-defined group. Partnering with a well-renowned Mexican public institution could limit such risk. However, it is recommended to handle the research process with transparency and in compliance with the Mexican legal framework, especially with the provisions on informed consent for research purposes and for the protection of personal data.

Part II — General Questions

Mexican laws and regulations expressly allow for exporting human tissues that may be a source of genetic material outside the national territory with the purpose of conducting population genomic studies. According to the General Health Law (articles 317 Bis y 317 Bis 1) such activity is subject to the following requirements:

• I. The material is used solely for the purposes approved by a Mexican institution devoted to scientific research and pursuant to article 100 of the Law (requirements for research on human beings) as well as to the Regulations on research and other applicable provisions, and

• II. A permit from the Federal Ministry of Health, through the national regulatory authority (Federal Commission for the Protection against Sanitary Risks), is obtained.

These articles of the General Health Law also indicate that the Federal Ministry of Health, in coordination with the National Institute of Genomic Medicine, in its capacity as advisory body to the Federal Government and national reference center in the field, shall keep a record of the permits granted for the transfer of the aforementioned tissues.

Such provisions are applicable to individual citizens as well as research and medical institutions. It is important to reiterate that exportation of samples requires the intervention of a Mexican scientific institution.³

Concerning data protection, the following laws exist in Mexico: Federal Law on Protection of Personal Data, Federal Law of Transparency and Access to Public Government Information, and Federal Law on the Protection of Personal Data held by Private Parties. These laws, along with their associated regulations, provide for the protection of health information and personal data, defining them as confidential data. The aforementioned laws establish that genetic information is sensitive personal data and mandate its protection.

In addition to laws on the matter, the National Institute for Transparency, Access to Information and Data Protection (before Federal Institute for Transparency, Access to Information and Data Protection) has issued a series of recommendations for the management of public and private information and data protection. For example, the Recommendations on Personal Data Safety were issued to implement administrative, technical, and physical safety measures aimed to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or treatment. One of the main challenges, not only in Mexico but worldwide, is the establishment of technological measures for database protection, both for storage in physical locations and in virtual spaces, like clouds. The protection of participant information in research studies is not just guaranteed by anonymity or by the biological sample data dissociation anymore; it has become a more complex process.

Mexico has taken part in international efforts to harmonize data protection laws such as the Global Alliance for Genomics and Health. The National Institute of Genomic Medicine is part of such an effort. However, there is still a long way to go in order to harmonize different standards from countries allowing information exchange without affecting the privacy rights of participants on research studies.

Mexican legal standards have no means of applying outside of Mexican territory when Mexican residents or citizens enroll in a DTP study conducted entirely abroad. If a foreign researcher or institution partners with a Mexican institution to conduct the study partially in Mexico, the aforementioned data protections laws are applicable.⁴

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

The expectation of receiving results arises from the informed consent provisions. Mexican laws do not intend to govern acts performed in other countries.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Mexican law provisions are not specific on “direct-to-consumer” genetic testing. Regardless of the recruiting process, provisions on informed consent and personal data protection apply.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

I do not think that the Mexican legal framework will change in the short term because science does not seem to be a priority of the current administration. The only scenario in which I foresee an interest to regulate DTP genomic research specifically would be if such type of research would generate a noteworthy crisis that would call for a direct response from the government.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

In the Netherlands, there has been discussion among researchers, notably about the “obstacles” they feel they encounter as a result of the implementation of the General Data Protection Regulation.¹ One of the problems researchers encounter concerns the extent to which, if at all, further use can be made of data from human beings in health research. The so-called (Dutch) Council of the Federation of Medical Scientific Societies, an initiative by health researchers, has developed, and in 2013/2014 revised a code of conduct for medical research.² The Dutch Privacy Authority³ (“Auto-riteit Persoonsgegeven”) has, however, not endorsed the code given that permission from the research subject for use of data is, according to the code, not always required, something the Privacy Authority considers as an encroachment of privacy standards.⁴

So far, policy makers have hardly addressed the legal and ethical aspects of genomic research. It should be added that the application of knowledge on genomics in the area of public health is still relatively scarce in the Netherlands.^{Reference van den Berg and van Kranen5} Neither have many legal issues been resolved. This holds true, for example, about the issue of property/control over donated bodily materials in the course of a study.^{Reference Jansen and Baart6} In April 2017, the government started a public consultation on a draft bill on control over bodily materials,⁷ but since the end of the consultation (June 2017) no further action has been taken. In the absence of normative clarity about a number of issues relevant to genomic research, the government stimulates, through the Dutch Innovatiegerichte Onderzoeksprogramma Genomics (IOP Genomics) programme,⁸ fundamental genomics research within public-private partnerships. The government also encourages — mostly indirectly — genomic research, for example, by making funds available to do research in the area of personalized medicine.⁹ These funds are tacitly only available to researchers that adhere to quality standards and not to those who address prospective research participants without involving a health care provider.

In general, it should be mentioned that the Netherlands is bound by EU law. In this respect, reference should be made to Directive 98/79/EC of the European Parliament and of the Council of October 27, 1998 on in vitro diagnostic medical devices,¹⁰ being replaced by Regulation (EU) 2017/746 of the European Parliament and of the Council of April 5, 2017 on in vitro diagnostic medical devices.¹¹ The latter directive/regulation contains safety and security standards for companion diagnostics, laboratory tests and home brews that should be applied in the Netherlands (and all other Member States of the European Union). This directive/regulation is indirectly relevant to DTP genomic research.

It follows that an IRB/REC review is generally not required.

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

Researchers based in the Netherlands considering genomic research with human beings/research participants in the Netherlands need to obtain a permit to perform this kind of research. This follows from the Medical Research Involving Human Subjects Act.¹² If the study falls under the realm of this Act, a prior review needs to be carried out by a State acknowledged medical research ethics committee (MREC) or, on appeal, by the Central Committee on Research Involving Human Subjects (CCMO).¹³ Positive advice from an MREC (IRB/REC), on the basis of a research design, is required before medical research involving human beings is allowed to start. The MREC thoroughly analyzes whether a proposed study meets the scientific and quality standards laid down in Article 3 of the WMO. Another requirement laid down in the WMO is that the researcher has insurance for research participants, that is to say insurance that will financially compensate research participants in case of harm to their health or life due to the study.¹⁴ Given these requirements and the fact that almost all MRECs are attached to hospitals or other health care providers it is very unlikely that a researcher who wants to conduct DTP genomic research with participants in the Netherlands will get a license.

It should be added that not all studies fall under the scope of this Act. In practice, most hospitals and health care providers will only allow a researcher to conduct a study with human beings after a positive advice from a MREC — even though this is not a legal requirement.

I am not aware of DTP genomic studies taking place in the Netherlands that obtained a permit on the basis of the WMO.

A Dutch researcher planning to conduct DTP genomic research in another country is required to abide by Dutch law, failure of which may result in legal and disciplinary action. This means that he or she needs a permit (see question 2).

It follows that an IRB/REC review is generally not required.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

Dutch law does not foresee the possibilities of prohibiting/regulating DTP genomic research conducted in other countries by using internet as a means to address and involve prospective research participants. Dutch authorities may inform persons based in the Netherlands about the risks of participating in DTP genomic research. This would be different in the case of a researcher based outside the Netherlands who seeks to “regularly” address prospective research participants, for example, by having an office/postal address in the Netherlands and carrying out research in the Netherlands. These researchers are bound by Dutch law and therefore need a permit and IRB/REC review.

• __ Not sure or other

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

No. Despite the fact that quite some laws in Europe are harmonized, a Dutch permit — based on positive advice by an IRB/REC — is required to start research with human beings in the Netherlands. European (EU) laws on research in this respect differ from European (EU) laws on medicinal products for human use.¹⁵

• __ Not sure or other

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

Dutch law does not require the involvement of a Netherlands-based collaborator. The main requirement is that the research design has been approved by an MREC and has consequently received a permit. This would only be different if prospective research participants are only addressed via the internet.

• __ Not sure or other

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

This does not matter, neither for the GDPR nor its privacy principles.

• __ Not sure or other

A study conducted in another country above all seems to entail risks for research participants in the Netherlands now that national/European/international standards are less self-evidently being adhered to. This not only raises privacy considerations (and the risk that personal data are being sold to third parties without the approval of the research participant), but also concerns such as informed consent, the right to withdraw consent, the rights of minors / persons not able to consent, and possibilities to enforce legal standards.

Part II — General Questions

Such institutional bodies partially exist. The main means to protect the interests of research participants are the permit requirements under the WMO, the requirement for researchers to have insurance that can be applied in case of harm caused to the health or life of a research participant due to the research, and the privacy requirements laid down in the GDPR and the Act implementing the GDPR¹⁶ — which also apply to the transfer of data across borders. In addition, researchers have their own professional standards with respect to quality, integrity, and privacy.

There are no laws, policies or guidelines specifically dealing with genetic/genomic research or genetic/genomic privacy. When it comes to the assessment of a research protocol concerning genetic/genomic research in view of a permit, the risks/privacy implications are considered. In the Netherlands, unlike e.g., Germany, the right to informational privacy has not been recognized under law. This is not to suggest that the risks/privacy implications of a research proposal do not receive special attention. This already follows from the GDPR, the European Convention on Human Rights and Biomedicine ¹⁷ and its Protocols, notably the Additional Protocol to the Convention on Human Rights and Biomedicine concerning Genetic Testing for Health Purposes.¹⁸

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

We do not have such laws as yet, even though scientific journals and media regularly report on research participants in developing countries who contribute to studies but who — as well as others from their country — will probably not get access to the positive outcomes of a study. The Additional Protocol to the Convention on Human Rights and Biomedicine, concerning Biomedical Research ¹⁹ partially addresses this issue by stipulating that:

(Article 28 — Availability of results) para. 2: “The conclusions of the research shall be made available to participants in reasonable time, on request” and (Article 29 — Research in States not parties to this Protocol): “Sponsors or researchers within the jurisdiction of a Party to this Protocol that plan to undertake or direct a research project in a State not party to this Protocol shall ensure that, without prejudice to the provisions applicable in that State, the research project complies with the principles on which the provisions of this Protocol are based. Where necessary, the Party shall take appropriate measures to that end.”

The Netherlands is, however, not a party to the Convention and its Protocols. The Medical Research Involving Human Subjects Act ²⁰ explicitly prohibits financially compensating research participants to such an extent that this would influence their decision to participate in the study or not (Article 3 under f).

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Direct-to-consumer genetic testing is illegal, unless the organization is offering DTC genetic testing with a permit. A request for a permit should be submitted to the Minister of Health on the basis of the Population Screening Act.²¹ However, this act does not apply to all forms of population screening. The absence of a permit does not imply that it is forbidden to advertise for genetic testing (e.g., for DTC genetic testing abroad or online).

Over the course of the last ten years the government commissioned three reports:²²

• Council for Public Health & Care (Raad voor de Volksgezondheid & Zorg): Screening en de rol van de overheid (2008) (no longer available online)

• Health Council (Gezondheidsraad): Screening: tussen hoop en hype (2008), available at <https://www.gezondheidsraad.nl/documenten/adviezen/2008/04/01/screening-tussen-hoop-en-hype>

• Health Council (Gezondheidsraad): Doorlichten doorgelicht (2015), available at <https://www.rijksoverheid.nl/documenten/rapporten/2015/03/05/doorlichten-doorgelicht-gepast-gebruikvan-health-checks>

The basis of these reports and the discussion in society have resulted in the announcement by the government that it wants to change the WBO. The government has the intention to broaden the scope of the WBO, so that all health checks fall within the realm of this act. According to the draft amendments, the WBO will in the future distinguish between (1) health checks without medical risks — no permit required, (2) health checks with some medical risks — with professional standards applying, and (3) health checks that may uncover serious diseases or abnormalities for which no prevention or treatment exists — need a permit. The government held a public consultation on these proposals from June 26, 2018 — August 8, 2018.²³ Since then the government did not undertake any further action, the current WBO and other applicable laws still apply in the same way.

The discussion among researchers, doctors, patients, and various advisory bodies on direct-to-consumer genetic testing mostly centers on:

• What are the benefits and risks for individuals and society at large when individuals can freely decide to undergo a genetic test without the involvement/approval/reference of a health care provider?

• Should we protect individuals (prohibit participation, unless…) or allow individuals to enjoy their right of individual autonomy (allow individuals to participate, unless…)?

• Who should guarantee that the individual participant is adequately informed prior to undergoing a genetic test?

• How can we guarantee the validity of genomic tests?

• How can we protect the privacy of individuals?

• Do we need to pay special attention to the rights and interests of children/persons unable to consent?

• How can we guarantee that national standards are respected given the European/international context in which DTC genomic testing takes place?

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

I foresee/hope that these issues will be addressed on a European level (and, if possible, an international level).

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

There is no clear statement on DTP genomic research in Nigeria; nonetheless, it seems such research could be approved if the researcher can demonstrate adequate protection of research subjects, for instance, by protecting privacy and confidentiality of health information;¹ and complying with the requirements regarding consent.²

The conditions stipulated above (see response to previous question) must be satisfied, and approval from a research ethics committee in the other country will be required.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Benefits that could result from conducting IRB/REC-approved genomic research by a researcher from another country on samples or data obtained from Nigeria include (a) enrichment of or new knowledge regarding etiology, diagnosis, and treatment of diseases/adverse health conditions; (b) building capacity on the part of local scientists that would be recruited as collaborators; and (c) discovery of improved techniques of responding to or treatment of illnesses.

Risks consist of (a) abuse of research subjects, especially the poor and uneducated, most of whom are inadequately informed about the processes involved in their participation or the result,^{Reference Nnamuchi3} and also considering the novelty of genomic research in Nigeria; and (b) inadequate attention to the rights and liberties of the research participants,⁴ such as breach of confidentiality obligation regarding samples procured from a particular population group or community, which, in turn, could expose them to harm — discrimination/stigmatization.

Part II — General Questions

Yes, Nigeria has an entity which regulates the exporting of biospecimens or the transferring of data across borders for research, namely, the Health Research Ethics Committee. This body is authorized to grant provisional approval pending the submission of a Material Transfer Agreement (MTA) to the National Health Research Ethics Committee (NHREC) and receipt of acknowledgment from the NHREC.⁵ The requirement applies to all parties involved in the research including local and international principal investigators, heads of local institutions, research sponsors, and other relevant parties, all of whom must sign the MTA.⁶

There is no law, policy or guideline specifically designed to apply to international DTP. Nonetheless, extant legal and policy frameworks — that is, National Code of Health Research Ethics;⁷ Policy Statement on Storage of Human Samples in Biobanks and Biorepositories in Nigeria;⁸ and National Health Act ⁹ — could be adopted to apply to international DTP research in the realm of genetic or genomic research or genetic or genomic privacy. There is no clear stipulation as to the applicability of these regimes outside of Nigeria when residents or citizens of the country enroll in a DTP study conducted abroad, but it would seem that they could be interpreted to apply.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned¹⁰

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

Since 2015, the Peruvian government has adopted legislation and other norms to provide incentives to foster scientific research and innovation in the country. However, none of these efforts has been tailored to capture the nuances of genomic studies, creating loopholes, and legal uncertainty with respect to the scope and application of the current regulatory framework. Importantly, in Peru there are no specific norms (legislation, guidelines, etc.) applicable to direct-to-consumer genetic testing or genetic research.¹

The Peruvian regulatory framework governing scientific research has been developed following the traditional clinical (interventional, pharmaceutical) research/trial paradigm which solely focuses on pharmacological products, devices, and similar products. As such, DTP does not fit into the existing legal categories, thereby creating significant uncertainty with respect to the legal framework and requirements applicable to DTP.²

Under the norms governing the promotion of scientific research and innovation (based on the above cited regulations) there are strict requirements pertaining to ethical licensing and oversight of research projects and adherence to ethical safeguards. However, as stated above, those norms are directed specifically to clinical trials, seemingly leaving DTP outside of their scope.³

The cited policies mandate prior approval by an Institutional Ethics Research Committee (“Comite Institucional de Etica en Investigacion” or CIEI) as an essential requirement for investigational studies. Furthermore, the decree regulating clinical trials⁴ establishes the accreditation, mission, organizational structure and functions of the CIEI (articles 58 to 66). It further stipulates the ethical principles and safeguards that are necessary conditions to obtain all governmental licensing and accreditations, including CIEI approval, which are based on the following principles:

• Respect for human dignity and protection of rights and interests of research participants (art. 9)

• Favorable benefit/risk ratio for the participant or for society as a whole (art. 10)

• Informed consent (art. 11, art 33-34)

• Limiting financial compensation for participants (art. 35)

Finally, it is important to mention that the government, by a Supreme Decree on Bioethics, has established binding bioethical guidelines governing scientific research, and hence, they are applicable as mandatory requirements for obtaining CIEI approval. The guidelines follow a human rights model and surround:

• Respect for human dignity

• Primacy of the human being and defense of physical integrity

• Autonomy and personal responsibility

• Principle of integrity and therapeutic principle

• Principle of sociability and subsidiarity

• Principle of beneficence and non-maleficence

• Equality, justice, and equity

• Protection of the environment, biosphere and diversity.⁵

The Peruvian regulatory regime does not contemplate such circumstances, unless part of the research activities will be conducted under Peruvian jurisdiction. If such is the case, the regulatory gaps (and loopholes) and normative requirements described above (including legal uncertainty pertaining to the regulation of DTP) equally apply. If any component of the research project is going to be conducted in Peru (regardless of whether other parts such as recruitment occur in another country), the ICEI (IRB/REC) will require proof of approval by an IRB/REC or equivalent from the foreign country.⁶

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

As illustrated in the preceding questions, there is significant uncertainty regarding the legal framework applicable to DTP in Peru. Having said that, it is clear that the spirit of the current Peruvian regulatory system is to require IRB/REC (or similar) approval as an essential prerequisite for conducting all types of scientific research in the country. Despite the loopholes, IRB/REC approval is deemed mandatory, particularly considering other legal requirements for investigators and their institutions which are mandated to obtain licensing and registering in government bodies as a pre-condition to carry out research in the country (e.g. approval by the National Institute of Health (INS), CONCYTEC, etc.). Finally, the Peruvian regulatory system applies to all research carried out in the country regardless of the researcher's nationality or residence.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

In this scenario, all the issues and answers given above remain.

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Considering legal uncertainty pertaining to the regulation of DTP in Peru as stated in the previous questions, and extrapolating the requirements applicable to other types of research (e.g., clinical trials), the external researcher is not required to have a collaborator in the country, but other conditions are imposed.⁷

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Keeping in mind uncertainties regarding the regulation of DTP in Peru as described above, the overall regulatory framework governing scientific research in the country does not distinguish whether the research is carried out or sponsored by an individual (foreign or national), a private/commercial company, an academic institution (Peruvian or foreign), or a government entity.⁸

Once more, as stated in the previous questions, there is significant legal uncertainty pertaining to the regulation of DTP and genetic research in Peru. Overall, the legal framework governing scientific research and the General Health Law (umbrella legislation covering, amongst other issues, health services and research in the country) contains several provisions to ensure equitable benefit sharing which reflect the concerns and interests of a wide range of stakeholders (e.g., researchers, professional organizations, patient groups, government, and the public at large). Benefit sharing is conceptualized here as, for instance: supporting local capacity training, access to medical/health care, access to new diagnostic tools, services and products, support health services; support for infrastructure, training, and services for scientific research; preferential access to new or advanced therapies, etc.). Similar provisions are in place for the protection of vulnerable populations, including indigenous communities over concerns of potential discrimination and stigmatization, revealing prevailing societal concerns.

Given existing national and international policies protecting bio-diversity in the country (flora and fauna) and safeguarding against biopiracy, we can speculate that similar concerns over unique heritage and bioprospecting would also be quite prevalent.⁹

Part II — General Questions

There are no specific committees or legislation. The general rules governing scientific research, medical products and other export control regulations would apply.¹⁰

There are no specific policies (laws, guidelines, directives, etc.) regulating human genetics or genomics research in Peru. The policies described above (which refer to other types of research such as clinical trials) do contain several provisions for the protection of the privacy of individuals (data protections, particularly for medical information). Respect for privacy is one of the fundamental principles adopted in the country's Bioethical Guidelines cited above.

The only exception is a provision in the directive governing clinical trials with biological samples which, in the context of addressing the issue of benefit sharing, states, as an example of concrete benefits to the community, measures directed at “increasing and strengthening developing countries capacity to obtain and manage human genetic data.”¹¹

Finally, there is no extraterritorial application of Peruvian law in this context.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

With the caveats regarding the limited scope of the Peruvian regulatory framework and uncertainties regarding how DTP is governed in the country as stated above, there are requirements for return of individual and aggregate results as well as for community benefit sharing.¹²

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

The obligation to obtain an opinion of the bioethics commission in Poland is derived either from the law or from the regulations of the institution where research is to be conducted (e.g., from the resolution of the senate or a dean of a medical university). Such opinion is necessary in the case of conducting a clinical trial¹ and conducting a medical experiment.² If, on the other hand, the basis for issuing opinions by the bioethics committee results from an internal act of the university or the research institute, which is more common, bioethical commissions give opinions on all research projects conducted on people, human biological samples, or personal data. This means, therefore, that if the DTP genomic test was not a part of a clinical trial or a scientific research, it is not required to obtain the opinion of the bioethics commission.

In the event that the tests are not part of a clinical trial, the opinion will only be required if it results from the internal legal regulations of the institution in which the researcher is conducting research. The rules for obtaining such an opinion are not regulated by acts of law commonly binding so that the conditions for obtaining them will depend on the regulations of individual bioethics commissions.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

There are no specific regulations in Poland regarding the conduct of genetic tests. In practice, many tests are carried out, many of which have never been proven clinically. There are also no entities that could control the conduct of such tests in practice. This means that foreign entities may offer DTP genetic tests.

For many years, geneticists and bioethicists have been postulating that legislation needs to restrict the conduct of genetic tests. One breakthrough point in this respect was the publication of the Polish Supreme Audit Office (NIK)³ report on genetic testing on May 10, 2018. It found that there is a lack of specific legal regulation in Poland and that there is no proper registration of entities conducting genetic tests. The report also shows that the Minister of Health did not carry out proper control over the laboratories. The report concluded that laboratories carrying out tests did not follow an adequate procedure to protect the personal data of donors, participants, or patients. One of the threats resulting from the report was also conducting the DTP genetic test outside of Poland or sending results outside Poland. It was considered that in such situations, there are no proper mechanisms to control data and samples.

After the publication of the report, the Minister of Health appointed a group whose function is to prepare a law regulating the conduct of genetic tests, including DTP. A draft bill was created, but until the time of preparation this analysis was not published or forwarded to public consultations.

Summing up, it should be pointed out that conducting genetic tests in Poland may involve significant risks. First of all, there is a lack of legal regulations in Polish law protecting the rights of students of genetic research and guaranteeing the reliability of conducted research. Pointing to benefits, genetic tests are popular and enjoy favorable public opinion and it is difficult to point to clear restrictions on their performance.

Part II — General Questions

The rules for the transfer of personal data in Poland are regulated by General Data Protection Regulations 2016/679.⁴

According to article 37 Act of 1 July 2005 on the collection, storage, and transplantation of cells, tissues, and organs,⁵ removal of bone marrow, hematopoietic blood cells, and umbilical cord blood from Poland is possible only after obtaining the consent of the director of the Organizing and Coordination Center for Transplantation Poltransplant and the export of other regenerating cells and tissues is possible after obtaining the consent of the director of the National Center for Tissue and Cell Banking. Those requirements apply equally to all.

There are many general regulations in Polish law regarding patient rights, personal data protection, etc. However, there are no specific regulations regarding DTP.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

The IRB would review the researcher's application, guided by the Qatar Ministry of Public Health (QMOPH) Genomic Policy. As stated in the policy, the IRB would ensure that the seven criteria of IRB approval are fulfilled as follows:

Criterion 1 requires that risks to subjects be minimized by using procedures which are consistent with sound research design and which do not unnecessarily expose subjects to risk.

Criterion 2 requires that the risks to subjects must be balanced against the sum of two benefits: the anticipated benefit to individual subjects and the anticipated benefit to society.

Criterion 3 requires the selection of subjects to be equitable.

Criterion 4 Informed consent should be obtained in every circumstance in which a patient/participant's data or bodily samples are used in genomics practices. Documented procedures by which they plan to carry out consent processes. This procedure should have the person obtaining consent take steps to verify that:

• The person providing consent has been given sufficient information.

• The person providing consent understands the information.

• The person providing consent does not feel coerced or unduly influenced.

• The person providing consent has sufficient time to make a decision.

• The individual providing consent understands the consequences of a decision.

• The individual providing consent can communicate a choice.

• The investigator stops the consent process if the person providing consent indicates that he or she does not want to consent.

Criterion 5 requires, when appropriate, that the research plan must include adequate provisions for monitoring collected data to ensure subject safety.

Criterion 6 requires, when appropriate, that there be adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.

Criterion 7 requires that, when some or all subjects are likely to be vulnerable to coercion or undue influence, additional safeguards are included in the study to protect the rights and welfare of these subjects.

In addition to the review and approval criteria, the IRB would ensure that there are mechanisms for mitigation of risks associated with genomic research. The policy explains how the researchers and IRB can mitigate the risks (legal, social, privacy, economic, psychological, etc.) associated with genomic research. The policy requires researchers to establish a plan on how to communicate genomic results with participants.

The IRB would address the issue of data sharing with a third party. If there is a plan for sharing, the explicit consent of participants should be obtained. Information that is identifiably linked to participants should never be shared.

Same conditions as in question 2. Signed informed consent would be required.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

Public perspective: Scientific data and knowledge are common goods and should be shared within an appropriate framework. To this end, QMOPH promotes greater access to data in a responsible, equitable, ethical and efficient manner. In the practice of data sharing, there is a need to balance between investigators who could contribute to new discoveries and research subjects who have a reasonable expectation of privacy and confidentiality. QMOPH recognizes the importance of making data available to investigators engaged in public health care research. Additionally, QMOPH affirms the principle that researchers involved in data sharing are credible investigators, and institutions sharing data should obtain proof of academic or other peer reviewed standing of investigators applying to receive data. When engaging in data sharing, QMOPH requires institutions to follow regulation, policy, and guidance published by QMOPH, including, but not limited to the “Guidance for the Use of Stored Data and Biological Specimens in Human Research” and the Genomic Research Policy.

Data sharing and research participants: The QMOPH is committed to sharing its research data and/or bio samples and knowledge with both the national and international scientific communities in conformity with the informed consent provided by its research participants. In genomic research, participants should have an opportunity to consider risks and benefits of the research, including whether incidental findings will be shared post-test, and accept or deny participation in the research. Participants should be informed should the data be shared with a third party. The possibility of breaching the privacy of data should be shared with research participants.

Data sharing and socially defined groups: considering the small Qatari population in Qatar, the following related risks are required to be discussed with participants by the researcher/research institution.

Privacy Risks

When genomic and phenotypic data are broadly shared in a database or repository, privacy risks may arise. Coded data can be released to the public. Data may be susceptible to computer or physical security breach.

Legal Risks

Genomic data may result in legal harms due to disputed claims of paternity. In some countries, genomic data may demonstrate familial or social relationships that raise citizenship questions or complicate access to goods or inheritance.

Social Risks

Genomic research may cause stigmatization or discrimination against an individual, family, or group of people with a particular genetic trait. Genomic data can raise issues that a person's biological father is not the person considered to be their father. Genomic data can uncover unexpected issues of family heritage.

Part II — General Questions

The Qatar Biobank has an Access Committee; they apply both to individual citizens as well as research and medical institutions.

Policy is in process.

Not sure yet.

• a. The law (policy) requires the return of individual results unless the participant expressly declines to have results returned, assuming the results are accurate, valid, and actionable.

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer (A policy that deals with DTC is in process)

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

The Human Biomedical Research Act (HBRA), enacted by Parliament on August 18, 2015, established a legislative framework for human biomedical research.¹ The explanatory statement describes the goals of the HBRA as: (a) regulating the conduct of human biomedical research, regulating tissue banks and tissue banking activities; (b) prohibiting certain types of human biomedical research; and (c) prohibiting the commercial trading of human tissue. Most of the legislative provisions are concerned with goals (a) and (b).²

The human biomedical research activities that are prohibited under the HBRA are those that involve:³

1. Development of cytoplasmic hybrid embryos or human-animal combination embryos created in vitro beyond 14 days or the appearance of the primitive streak, whichever is earlier;

2. Implantation of any human-animal combination embryo into the uterus of an animal or a human;

3. Introduction of human stem cells (including induced pluripotent stem cells (iPSC)) or human neural cells into the brain of living great apes whether prenatal or postnatal; and

4. Breeding of animals that have had any kind of human pluripotent stem cells (including iPSCs) introduced into them.

Part II — General Questions

The Biological Agents and Toxins Act was enacted in 2006 to regulate the possession, use, import, transfer, and transportation of biological agents (i.e., specified list of microorganisms) and toxins that are known to be hazardous to human health.¹⁶ The legislation provides safe practices and security requirements in the handling of such agents and toxins. Facilities that possess or work with specified biological agents and toxins are required to have their facilities listed as a protected place under the Protected Areas and Protected Places Act.¹⁷ Institutionally, handling of biological agents and toxins are to be managed by a Biosafety Committee, which has the responsibility to:

• Conduct risk assessments in relation to the activity proposed to be carried out;

• Devise such measures for the management of the risks that may arise from the proposed activity; and

• Formulate such other policies, programs and codes of practice as may be necessary for:

  • the proposed activity to be carried out safely at the facility; and

  • the training of staff who will be involved in the carrying out of the proposed activity

• Review every 2 years or earlier, as may be appropriate, all measures, policies, programmes or codes of practice devised or formulated by it and shall immediately inform the operator of the facility of any change to such measures, policies, programmes and codes of practice as the biosafety committee thinks necessary.

Apart from these provisions and arrangements, the MOH has issued regulations relating to the transportation of these biological agents and toxins.

[See Appendix for further detail.]

Singapore has no law that is specific to genetics, genomic research, or genetic privacy, but the collection and use of genetic information may be subject to regulation, depending on the context to which such information relates. In the context of medical practice, genetic testing and the handling of genetic information are governed by a set of guidelines issued by the Bio-ethics Advisory Committee (BAC) in 2005.¹⁸ These guidelines have regulatory effect on medical practitioners in Singapore. More recently, the Ministry of Health has issued a Code of Practice for the provision of clinical and laboratory genetic services.¹⁹ Requirements in the Code of Practice are currently set out as good practices only, but they are expected to have regulatory effect from 2020 onwards. In the context of biomedical research, the use of genetic technologies and information may be governed under the HBRA (as discussed above) or otherwise under legal requirements that apply to clinical trials. Statutory requirements under the HBRA are supplemented by guidelines issued by the BAC in 2015, which also incorporate those issued in 2005.²⁰ The legal and ethical requirements broadly reflect international standards, such as the restrictions that are set for genetic testing of children. Physicians and parents should decide together “where compelling interests of other family members or public health interests exist” for carrier tests on children (Rec 5). For certain types of tests, genetic counseling should be offered before and after clinical genetic testing to all individuals with sufficient information and support for the individual and his or her family members (Rec 19 & 20). More generally, genetic information that identifies an individual on its own or in combination with other information may be regulated as “personal data” under the PDPA, as noted above. The PDPA sets out requirements governing the collection, use, disclosure and care of personal data, and it recognizes both the rights of individuals to protect their personal data and the needs of organizations to collect, use, or disclose such data for legitimate and reasonable purposes. For sensitive data (such as medical information), the PDPA sets out the need for greater care in the processing of data. The national laws of Singapore on these issues are unlikely to apply outside of Singapore when residents or citizens enroll in a DTP study conducted abroad.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. Other answer (Under the HBRA and the ethical guidelines of the BAC, researchers need to indicate whether or to what extent results will be returned to research participants.)

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. Other answer (Direct-to-consumer genetic testing is not explicitly prohibited, but Recommendation 22 of the BAC's report on Genetic Testing and Genetic Research (on page 49) states: “Genetic testing should generally be conducted through a qualified healthcare professional. Tests that provide predictive health information should not be offered directly to the public. The advertising of direct genetic tests to the public should be strongly discouraged. The relevant authority should develop an oversight framework for the supply of direct genetic tests, services and information to the public.” The MOH is expected to develop such an oversight framework in the foreseeable future.)

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Question 2

Question 5

For local healthcare and research institutions, it is relatively common practice to specify in the consent-taking document that samples or data obtained may be shared, whether within or outside of that specific institution, for use in future medical research and development, medical education, training, publication, diagnosis and possibly the treatment of medical conditions on a commercial basis or otherwise. Assurance will also be provided that any release of samples or data will be in accordance with the relevant laws and regulations.

The consent document will usually indicate that the samples or data may also be exported or transmitted (as the case may be) to researchers outside of Singapore. A typical explanation is that the researchers who use the samples or data may be part of a large group working in collaboration with institutions or commercial companies. Permission would therefore be obtained in advance for samples to be exported or removed from Singapore (or for data to be transmitted) to a place outside Singapore for research. The assurance provided to research participants is that any sample or data to be exported or transmitted overseas may only be released in accordance with legal and regulatory requirements and subject to IRB approval. Specific consent will be obtained to this effect.

Contribution of samples and data for research is expected to be on an altruistic basis, although fair compensation is permissible for time and effort. Whether for research in Singapore or outside of Singapore, the BAC has indicated that there is an ethical responsibility for everyone to contribute to responsible research, based on the principle of reciprocity or solidarity, more broadly.⁴¹

Question 6

Unless biological samples are specified biological agents or toxins, or are biological materials that have been affected by such agents or toxins, the transfer of such samples are not subject to control or regulation. However, where such biological samples are provided for medical or research purposes by a person, appropriate consent must have been provided by the sample donor. If the sample is provided by a medical or research institution as a tissue bank, then the requirements under the HBRA (discussed above) must be satisfied. As noted, these requirements relate mainly to consent, but detailed regulatory requirements are expected to be issued by the MOH in the foreseeable future.

Transfer of personal data across borders for research is regulated under the Personal Data Protection Act (PDPA). Personal data refers to data, whether true or not, about an individual who can be identified from that data; or from that data and other information to which the organization has or is likely to have access. Generally, a person is free to provide her or his personal data to an overseas entity for medical or research purposes, provided that this is done on a voluntary and informed basis. However, more onerous requirements apply to the transfer of personal data by an organization, which will include a medical or research institution.

Section 26 of the PDPA limits the ability of an organization to transfer personal data outside Singapore. In particular, section 26(1) provides that an organization must not transfer any personal data to a country or territory outside Singapore except in accordance with requirements prescribed under the PDPA to ensure that organizations provide a standard of protection to personal data so transferred that is comparable to the protection under the PDPA. This requirement not to transfer personal data unless in accordance with the prescribed requirements is referred to in the PDPA Guidelines as the Transfer Limitation Obligation.⁴²

In essence, an organization may transfer personal data overseas if it has taken appropriate steps to ensure that it will comply with the Data Protection Provisions in respect of the transferred personal data while such personal data remains in its possession or under its control; and if the personal data is transferred to a recipient in a country or territory outside Singapore, that the recipient is bound by legally enforceable obligations to provide to the personal data transferred a standard of protection that is comparable to that under the PDPA. In this regard, legally enforceable obligations include obligations imposed on the recipient under:

• any law;

• any contract that requires the recipient to provide to the personal data transferred to the recipient a standard of protection that is at least comparable to the protection under the PDPA; and specifies the countries and territories to which the personal data may be transferred under the contract;

• any binding corporate rules that require every recipient of the transferred personal data to provide to the personal data transferred to the recipient a standard of protection that is at least comparable to the protection under the PDPA; and specify the recipients of the transferred personal data to which the binding corporate rules apply; the countries and territories to which the personal data may be transferred under the binding corporate rules; and the rights and obligations provided by the binding corporate rules;

• any other legally binding instrument.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

The public, researchers, policymakers, ethics regulatory bodies, health-care professionals, healthcare and pharmaceutical companies, and health insurance companies are all interested in genomic research.^{Reference Staunton, Moodley and Pepper1} However, it is mostly researchers who have expressed interest in DTP genomic research. Other stakeholders who are interested in direct-to-consumer (DTC) genetic testing are local and foreign DTC service providers, public consumers of DTC laboratory-based genetic testing and clinicians.^{Reference Dandara2}

There are 46 research ethics committees (RECs) registered in South Africa. Although each of them establishes its own ethical and procedural requirements, they are expected to comply with the guidelines issued by the National Department of Health³ and the Department of Health's policy framework for ethical approval (2012).⁴ For genomic research, the guidelines require researchers to ensure that the collection and storage of data and human biological materials balance the need for adequate participant safeguards with optimal advancement of research.⁵ Depending on the affiliation of the researcher, they are also required to comply with the Health Professions Council of SA⁶ or South African Medical Research Council Guidelines (2018)⁷ as appropriate.

RECs in South Africa have the mandate to approve research that is conducted in the country. The Human Science Research Council's guidelines explicitly state that its REC “cannot approve research conducted on human participants beyond our national jurisdiction. If the project involves countries other than South Africa, the applicant will need to seek concurrent ethics approval from RECs in the other host countries.”⁸ Although there is no specification about double ethics review in the local legislation or guidelines, the MRC Guidelines for ethics research, provide that “no research shall be performed in a host country without local research collaboration in the design and conduct of that research.”⁹

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

  See the explanation in 3 above regarding the need to seek concurrent ethics approval from RECs in the other host countries.

  • b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

    • __ Yes

    • X No

    • __ Not sure or other

  See Department of Health Guidelines,¹⁰ which require researchers to ensure that the collection and storage of data and human biological materials balance the need for adequate participant safeguards with optimal advancement of research. Such safeguards are ensured through ethics review in the South Africa.

  • c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

    • X Yes

    • __ No

    • __ Not sure or other

  The Department of health guidelines specifies that for international multi-center research, at least one (co-) PI must be based in South Africa.¹¹

  • d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

    • __ Yes

    • X No

    • __ Not sure or other

There are few specifications regarding this issue in the guidelines. For example, the Human Sciences Research Council guidance document requires the research to have a scholarly intent. But in general, the regulation applies equally to all research conducted with human participants in South Africa regardless of its commercial, governmental, or academic purpose.

The various stakeholders both overlap and differ in terms of their perceived benefits and risks of international genomic research on South African samples and data. These include the benefits and risks of genomic research in general but extend to issues relating to export of samples and data.

Part II — General Questions

A permit is required for the import/export of biospecimens and the authority responsible for issuing such permits is the Director General of the National Department of Health.¹² Other relevant regulations are the Material Transfer Agreement of Human Biological Materials,¹³ which establishes the contractual form of agreement required to transfer material between institutions (cf Question 7 below); and the Protection of Personal Information Act 4 of 2013,¹⁴ which regulates the transfers of personal information outside South Africa and applies to any responsible party in the Republic.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Concerns have been raised regarding the inadequacy of laws, policies, and guidelines in dealing with DTP genomic research, especially where it crosses international borders. A few recommendations have been made on what ought to change, such as transparency in handling of genetic data collected from people in South Africa and the establishment of clear policies.²⁶

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

Substantively, the research must meet the requirements of the Bioethics and Biosafety Act of Korea, which includes measures to protect research subjects in a manner similar to the Common Rule. While the latest iteration of the US Common Rule stopped short of introducing a new provision that would deem a biospecimen to be personally identifiable information, Korea's Bioethics and Biosafety Act has a separate set of rules governing research involving biospecimens,¹ in addition to provisions applicable to human subject research.

Under the Bioethics and Biosafety Act, a researcher must obtain approval from an IRB/REC before commencing any research on biospecimens,² unless one of the exemption criteria is met.³ The principal investigator is usually required to submit the following documents for review by IRB/REC: a research proposal, a letter of commitment to abide by research ethics, a declaration of absence of conflict of interest, a resume, the informed consent template, and a certificate of completion of research ethics education.

In addition, the researcher must acquire informed consent from the donor before obtaining a biospecimen,⁴ unless one of the exemption criteria is met.⁵ Informed consent documents must include the following information: the purpose of the research, protective measures for personal information, procedures for preservation and disposal of the bio-specimen, third-party sharing of the biospecimen and/or genetic information extracted from the biospecimen, withdrawal of informed consent, availability period of research results, and access to the information from the research. The law provides an informed consent template.⁶

It is debatable whether the Korean Bioethics and Biosafety Act will apply in this scenario. One argument is that the statute is applicable because the researcher resides in Korea and is subject to Korean jurisdiction. The counterargument is that the statute was legislated with the purpose of protecting research subjects in Korea and, thus, becomes inapplicable if research subjects are not Korean citizens or residents.

In practice, the Korea National Institute for Bioethics Policy (“KNIBP”)⁷ is of the position that a Korean researcher conducting overseas research will trigger the IRB/REC approval under the Korean Bio-ethics and Biosafety Act. Under that view, the same conditions that must be satisfied for IRB/REC approval for purely domestic DTP genomic research under Question 2 must be met in this case too.

The Bioethics and Biosafety Act of Korea does not explicitly require approval from a research ethics review body in the other country under this scenario.

However, KNIBP recommends that research involving overseas human subjects with an overseas collaborator clear review by IRB/REC of that foreign country, in addition to an IRB/REC review in Korea. KNIBP leaves room for the possibility that the domestic (Korean) IRB/REC may defer to the overseas IRB/REC review, rather than going through a full-scale review in Korea again.

Under such a view, a researcher wanting to conduct DTP genomic research in another country would also be required to seek approval from an IRB/REC in that other country.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The Bioethics and Biosafety Act is silent as to whether a foreign researcher will be required to seek IRB/REC approval in this scenario, and it is debatable whether the law is applicable along the similar lines of argument as offered in Answer 3. Nevertheless, it will be very difficult for a foreign researcher to present a legal defense if no IRB/REC approval was obtained in either country, because the debate is about whether IRB/REC review is required in Korea, not about whether IRB/REC review is required at all.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

As in the previous question, this is debatable. KNIBP is of the view that approval by an IRB/REC in Korea is required, as long as research subjects are citizens or residents of Korea.

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

The Bioethics and Biosafety Act of Korea does not require a domestic collaborator for a foreign researcher to be able to pass review by an IRB/REC in Korea. In light of the usually conservative approach that IRBs/RECs in Korea tend to take, the possibility of IRB/REC requiring a Korean collaborator cannot be ruled out.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

The Bioethics and Biosafety Act of Korea does not discriminate against any particular type of researcher. However, the IRB/REC in Korea reviewing the research proposal may exercise extra rigor if the applicant is a commercial entity rather than an academic or government entity.

The perceived benefits would be along the lines of possibly better analysis by a more able, foreign research institution, attention to rare diseases that may be neglected by the Korean academia, interracial comparison, and contribution to science.

As to the risks, data privacy would be the biggest issue, since the Korean government will no longer be able to have governance over foreign researchers and hold the foreign researcher to the Korean data privacy regulation. Another risk that is sometimes mentioned is losing “genomic sovereignty,” if foreign entities succeed in gaining more accurate insight into the genomic constitution of the Korean people than Korea's own academia or industry.

Part II — General Questions

While importing of biospecimens or disposal of human tissue is tightly regulated, exporting of biospecimens per se is not regulated. Therefore, individual citizens will not face any issue in sending their samples abroad. In fact, many individual Korean citizens have been able to purchase services of US-based DTC genetic testing companies, such as 23andMe, by sending their sample to the US without any restriction.

As to data transfer across borders, the Personal Information Protection Act of Korea sets forth meticulous duties on a “data processor” who gathers personal information and utilizes it. However, the statute will not apply if the recipient of data resides outside of Korea and passively receives information from a willing Korean citizen. Thus, individual citizens can freely transfer their data without the overseas recipient having to comply with the Personal Information Protection Act.

Korea does not have laws, policies, or guidelines dealing with genetic/genomic research or genetic/genomic privacy, other than the requirement that the donor be informed about third-party sharing of genetic information in the consent document, as explained in Answer 2.

Whether this piece of informed consent requirement will apply when residents or citizens of Korea enroll in a DTP study conducted abroad will probably depend on the nature of the recruitment that took place in Korea. Korea's national laws are, in principle, territorial; they will apply if relevant action takes place in Korea or if the actor is in Korea. Therefore, if residents or citizens of Korea willingly and independently enroll in a DTP study conducted abroad, Korean law should not apply. As mentioned in Answer 6, Korean citizens' use of US-based DTC genetic testing companies has not triggered any regulatory response, since 23andMe never marketed its business in Korea.

However, if the investigators of the DTP research conduct what can be characterized as “active recruitment” of research subjects in Korea, rather than remaining a “passive recipient” of biospecimens, the Korean regulator will more likely than not bring the Korean law to bear on the DTP research, including informed consent and IRB/REC review requirements as explained in Answer 4.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

The Bioethics and Biosafety Act requires that the informed consent document describe the availability period of research results and the details on the access to the information,⁸ as explained in Answer 2. This provides the ground for individual participants' access to the results, while return of results is not mandatory.

The expectation is probably that the individual results will be returned, since past genomic projects returned individual results, which I believe was one of the incentives to participating in genomic research to begin with. For example, the Ulsan 10,000 Genome Project, which launched in 2015, returns individual reports that include genetic variations, ethnicity analysis, haplotype analysis, the “biological age” based on telomere length, and genotypes related to diseases or physical traits.⁹

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

While direct-to-consumer genetic testing is legal, its scope is closely regulated. Currently, the regulation allows only 12 genotyping tests that can be characterized as “wellness-related” — i.e., not disease-related. The list is attached at the end of this questionnaire. Disease-related genetic testing — e.g., BRCA genes — or pharmacogenetic testing must be ordered by a clinician.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

While it is very difficult to predict one way or another, the Korean government definitely is aware of the privacy issues that genomic research can create and will want to assert some type of governance over international DTP research that reaches Korean citizens. However, I do not think the Korean government will go so far as restricting it outright.

Genotypes Permitted for Direct-to-Consumer Genetic Testing Service in Korea

1. body mass index based on FTO, MC4R & BDNF genes

2. triglyceride level based on GCKR, DOCK7, ANGPTL3, BAZ1B, TBL2, MLXIPL, LOC105375745 & TRIB1 genes

3. cholesterol level based on CELSR2, SORT1, HMGCR, ABO, ABCA1, MYL2, LIPG & CETP

4. blood glucose level based on CDKN2A/B, G6PC2, GCK, GCKR, GLIS3, MTNR1B, DGKBTMEM195 & SLC30A8 genes

5. hypertension based on NPR3, ATP2B1, NT5C2, CSK, HECTD4, GUCY1A3, CYP17A1 & FGF5 genes

6. hyperpigmentation based on OCA2 & MC1R genes

7. baldness based on chr20p11(rs1160312, rs2180439), IL2RA & HLA-DQB1 genes

8. hair thickness based on EDAR gene

9. skin aging based on AGER gene

10. skin tone based on MMP1 gene

11. vitamin c level based on SLC23A1(SVCT1) gene

12. caffeine metabolism based on AHR & CYP1A1-CYP1A2 genes

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

The REC will review the same conditions as in any genomic research:

• a) The interest and quality of the research.

• b) If the participants have been informed about: objectives, duration and relevance of the research; right to access the results, right to return of results and right to withdraw consent; possible relevance of the results for family members; identity of the principal researcher and the data controller; possibility and how to contact the data protection officer.

• c) The consent has to be written.

• d) Special requirements if there are minors or vulnerable populations involved.

• e) There is no economic benefit for the participant.

• f) Guarantee of confidentiality and data protection according to European and Spanish law.

• g) Guarantee of return of results relevant for health unless the participant expressly declines to have results returned.

• h) Availability of genetic counseling in case it could be appropriate.

These conditions apply for cases in which the participant gives his/her data. If samples were to be required, guarantees would have to be added regarding their collection and traceability so physicians, hospitals, or bio-banks would be needed as intermediaries (unless there is no risk and the quality of the samples is guaranteed).

If data are to be processed and analyzed in Spain, the Spanish IRB/REC will be competent to evaluate the study. The same guarantees will apply as in the previous case. No other evaluation would be required.

If samples are required, article 31 of the Royal Decree 1716/2011, November 18th, which establishes the basic requirements for authorization and operation of biobanks for the purpose of biomedical research and the treatment of biological samples of human origin and regulates the operation and organization of the National Registry of Biobanks for biomedical research, shall be applicable: “Biological samples of human origin from other countries may only be used for biomedical research purposes when, in addition to the requirements laid down in the regulations relating to the entry and exit of samples in Spanish territory, the guarantees laid down in this royal decree and other applicable regulations have been observed as a minimum, in addition to their collection, storage or conservation and transfer, which will be assessed by the Research Ethics Committee evaluating the research project and, where appropriate, by the biobank's external committees.”¹ In addition, the regulations governing the import of samples should be respected (in case of countries outside the customs territory of the Community).

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • X Yes

  • __ No

  • __ Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The perception is rather negative if there is no collaboration with a Spanish researcher, in particular:

• Perception of the use of Spanish resources especially in the case of biological samples.

• Perception that remoteness from the researcher may make it difficult for the participant to exercise rights.

Part II — General Questions

Concerning samples, the Spanish import/export authority is the Public Health, Quality and Innovation General Director in the Ministry of Health.

The regulation applies to individual citizens as well as research and medical institutions: Royal Decree 65/2006, January 30th, which establishes the requirements for the import and export of biological samples for diagnosis or research in humans;² Royal Decree-Law 9/2014, July 4th, which establishes the quality and safety standards for the donation, collection, evaluation, processing, preservation, storage and distribution of human tissues and cells and which approves the coordination and operation standards for human use.³

There are rules concerning international data transfers that could involve the Data Protection Authority in some circumstances, but are applicable when the data are transferred by data controllers or processors.⁴ As a matter of fact, the “transfer of data” is an operation related to controllers or processors but not to the data subject.

According to article 31 of the Royal Decree 1716/2011, November 18th, establishing the basic requirements for the authorization and operation of biobanks for the purposes of biomedical research and the treatment of biological samples of human origin, for biomedical Research: “Biological samples of human origin from other countries may only be used for biomedical research purposes when, in addition to the requirements laid down in the regulations relating to the entry and exit of samples in Spanish territory, the guarantees provided for in this royal decree and other applicable regulations have been observed as a minimum, in addition to their collection, storage or conservation and transfer, which will be assessed by the Research Ethics Committee evaluating the research project and, where appropriate, by the Biobank's external committees.”⁵

Our national law on genetic tests applies only in Spain.⁶ If the donation of a sample for research purposes is done in Spain, this law should be applied. There are no specific rules establishing when it is considered that the donation is done in Spain. It could be said that the applicable law is the one of the donor's residence.

In addition, the regulations governing the export of samples should be respected (in case of countries outside the customs territory of the Community).

It is expressly established that data protection regulation is also applicable in those aspects not covered by the Biomedical Research Law. In the case that Spanish residents or citizens enroll in a DTP study conducted abroad, it seems this regulation is not applicable, as scientific research does not fall into the cases described in article 3 of the GDPR.⁷

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

Law 14/2007:

49.1. The subject shall be informed of the genetic data of a personal nature obtained from the genetic analysis according to the terms in which he expressed his will, without prejudice to the right of access recognized in the legislation on the protection of personal data, which may entail the revocation of the prior manifestation of the free will granted.

59. 1. Without prejudice to the provisions of legislation on the protection of personal data, and in particular Article 45 of this Law, before issuing consent for the use of a biological sample for biomedical research purposes that will not be subject to a process of anonymization, the source subject shall receive the following information in writing: (…) g) The right to know the genetic data obtained from the analysis of donated samples. (…) i) Warning about the possibility of obtaining information relating to his/her health derived from the genetic analyses carried out on the biological sample, as well as about the right to take a position in relation to the communication.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Not specifically, but they should comply with the requirements established by law for the practice of genetic analysis. A health-related genetic analysis can only be performed if there is a clinical indication or approved research purpose. The analysis must be carried out within the framework of a genetic counseling process. There must be quality guarantees regarding professionals, centres and procedures.⁸

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

I'm not sure about any change in the next few years. There has been no debate on this issue. Data protection legislation has recently been adopted, including a new regime on the processing of data for research purposes, and this issue was not discussed in the process. Nor is it being discussed in academic literature. Furthermore, I believe that it is very difficult to regulate this matter with a national approach.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

There has been discussion among legal researchers, but little as yet among policy makers.

Unlike DTP testing, DTP research has not been discussed much in Sweden. Scholarly discussion on legal issues related to the field has started to emerge,^{Reference Howard, Wein-roth, Rodrigues, Slokenberga and Howard1} but there is still little discussion of such matters among policymakers.² It bears noting, however, that biobanking per se and biobank research have attracted strong interest in Sweden among researchers, policy-makers, and practitioners of law.³

Genome research meets the criteria stated in the general act on the conduct of research in Sweden: the Lag (2003:460) om etikprövning av forskning som avser människor [Swedish Code on Ethical Review Concerning Research Involving Human Beings (SCER)]. This legislation applies to research that includes the processing of personal data according to Article 9.1 of the EU Data Protection Ordinance (Sec. 3). The Code must also be applied to research that implies physical intervention on a study participant, to research conducted using a method intended to influence the study participant either physically or mentally, to research which implies a blatant risk of physical or mental injury to the study participant, and to research conducted on biological material that has been taken from a living person and which can be traced to that person (Sec. 4).

As of January 1, 2019, applications for permission to conduct research involving humans are examined by the Swedish Ethical Review Authority.⁴ The ethical review is conducted by one of six regional sections of the Ethics Examination Authority. Each of these sections consists of one chairman (a former judge) and fifteen other members, who possess scientific competence or who represent public interests. There is also a supervisory Ethics Review Appeals Board (Sec 31).⁵ A rejection by a committee can be appealed to this Board (Sec 36).

The fee is approximately €500 for an application that concerns one main research group and €1600 for other research constellations.

Research may only be approved if the risks it entails for the subject's health, safety, and personal integrity do not outweigh its scientific value (Sec. 9). Approval is also withheld if the expected outcome can be achieved by other means that involve less risk to the health, safety, and personal integrity of the subject (Sec. 10). Research that is conducted on biological material taken from a living person and which can be traced back to that person demands formal consent from said person. Consent must be freely given, formally specified, and precisely tailored to the research in question. Approval by the Ethical Review Authority must be granted before any research can be started.

The national legislation on ethical review has jurisdiction only within Sweden (SCER Sec. 5). Generally speaking, Swedish law does not follow the researcher, but rather the sample/data and the establishment of the research. Research that takes place outside Sweden must be approved according to the rules pertaining in the country in question.

For research within the EU, the Regulation (EU) No 536/2014 of the European Parliament and of the Council of April 16, 2014 on clinical trials on medicinal products for human use and repealing Directive 2001/20/EC may be applicable to a particular project. In general, EU law requirements apply where relevant, as in connection with the clinical trials legal framework and tissue and cells legal framework as well as in connection with the in vitro diagnostic medical devices framework.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No⁶

  • __ Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No⁷

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No⁸

  • __ Not sure or other

If the matter pertains to research approved in another country but conducted in Sweden by a researcher from another country, then lawfulness is undermined and the public trust vested in research betrayed.

If the matter pertains to research approved by the Swedish authorities and conducted in Sweden by a researcher from another country, then there is no problem — i.e., the non-Swedish background of the researcher poses no additional risk.

One possible risk factor when it comes to cross-border genomic research has to do with the handling of personal data. The General Data Protection Regulation (GDPR) protects personal information within the EU, and several other agreements protect personal data outside the EU; however, there is always a risk that the personal details of research subjects will be wrongfully revealed. Issues of privacy protection are perceived as increasingly problematic in relation to the release of genomic data.^{Reference Heeney, Hawkins, de Vries, Boddington and Kaye9} Swedish rules on public access to information make it easy to obtain official documents from public agencies and certain private bodies.¹⁰ Provisions of this kind may increase the risk for wrongful use of data.

In cases where research results are returned to a study participant, a general risk factor arises in connection with the impact that such results may have on the person in question — especially in view of the relative uncertainty and/or evaluative difficulty associated with this type of research.¹¹

A mistaken interpretation of research results may have serious repercussions for the individual in question.¹² Moreover, increased geographical distance between researcher and subject can make communicating results to the latter harder.

In general, the Swedish population seems to be well-disposed to participating in research; however, any wrongdoing risks betraying the trust which the public has placed in research.

Part II — General Questions

Sweden has all of the stated governmental entities. However, not all of them are involved with exports.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Sweden has generally been liberal in regulating research. Moreover, the country's overall approach to the governance of new technology appears to be affected by a “we want to be first” attitude. The question is how research is to be regulated and whether current laws in the area have deficiencies. In regard to research relating to children, for example, there are some unresolved issues. It does not seem that Sweden has mapped out all of the problems that arise in connection with DTP research governance. Sweden can expect its provisions in this area to be reviewed, but new legislation per se is more uncertain. In general, the GDPR pre-empts regulatory initiatives on Sweden's part to a considerable extent.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

To the best of our knowledge, DTP genomic research is not (yet) a topic of interest for researchers or other stakeholders in Switzerland. This type of research raises complex legal questions under tSwiss law that makes them difficult to conduct. This may discourage researchers to engage in such projects.

Article 45 (2) of the Federal Act on Research involving Human Beings of September 30, 2011 (HRA) provides that an authorization is granted by the responsible ethics committee if the ethical, legal, and scientific requirements of the HRA are met.¹ As DTP genomic research is not likely to be considered a clinical trial, it would fall under the Ordinance on Human Research with the Exception of Clinical Trials of September 20, 2013 (HRO).²

Besides the general requirements of research ethics and regulation, DTP genomic research raises specific questions linked to the HRA and the Federal Act on Human Genetic Testing of October 8, 2004 (HGTA).³ A first difficulty is the limitation of genomic research to the biomedical field under the current HRA and HGTA. Research that would not aim at establishing or developing general-izable knowledge concerning human health is not likely to obtain an authorization from the competent research ethics committee. This would exclude research for so-called recreational purposes. The Federal Parliament has adopted a revision of the HGTA on June 15, 2018 that expands its scope to genetic testing beyond the domain of medicine.⁴ Yet concerning research, it does not seem to modify the current situation. To the contrary, the new HGTA includes a revision of the HRA that reinforces the links between the two Acts and does not facilitate research beyond the biomedical field. This revision is not yet in force and without specific cases, it remains unclear how it will impact the current situation.

A second difficulty is linked to informed consent and genetic counseling. In view of both the HRA and HGTA, a genetic test, especially as a part of research, can only be performed if the participant has given his or her written consent. This would require that the participant has received the necessary information concerning the nature and scope of the specific genetic testing to be performed. For instance, it is becoming common practice in oncology to look for specific biomarkers influencing the outcome of treatment. The participant has to be informed about the test and his or her consent is limited to that test. The researcher would not be allowed to conduct different genetic testing than the one for which he or she has obtained the participant's consent. Even more, according to article 14 HGTA, “Presymptomatic and prenatal genetic tests and tests for the purpose of family planning must be preceded and followed by non-directive genetic counselling provided by a qualified person. The counselling session must be documented.”⁵ This imposes an additional burden for the researcher if the test falls under such a category. If there are some uncertainties whether this provision applies also in case of research, the revision of the HGTA and HRA clarifies that element: genetic counselling will be required also in case of research.

The responsible research ethics committee could only accept a DTP genomic research project with participants located in Switzerland if the conditions listed above are met. Under the current law, this seems rather challenging.

In addition, according to the Declaration of Helsinki ⁶ and the Declaration of Taipei of the World Medical Association,⁷ it seems rather obvious that research involving human biological samples are subject to an ethical review by the competent research ethics committee at the national/local level. The question seems therefore misleading as it may assume that in some countries both declarations would not apply as professional and ethical standards. Even if there is no specific regulation on this issue in a given country, it would seem reasonable to argue that those standards would be recognized as binding for a professional, especially the healthcare providers. A researcher that would assume otherwise would have first to demonstrate the opposite, especially in North-South projects where some researchers from the North sometimes tend to ignore the laws in developing countries.

When the sponsor of the project is based in Switzerland, it must be considered whether the research project includes the sampling of biological material and/or the collection of personal data related to health, and is therefore subject to the provisions of Chapter 2 of the HRO,⁸ even if the sampling and/or collection of the material and/or data is conducted outside of Switzerland.

The research project is then submitted to the responsible Swiss ethics committee for approval before any sampling or collection takes place.⁹ The conditions set out in question 2 apply.

Whether the research also requires approval of a foreign ethics committee is first a question of foreign law. But, even if not explicitly required by the HRA, Swiss research ethics committees would make it a requirement as the researcher must provide the decision of all research ethics committees involved in case of multi-center studies. As mentioned above, this is already the current practice to request such positive opinion in case of research based on questionnaire where the targeted participants are not in Switzerland. In such case, it is also common to ask for the decision from the data protection authorities when requested by the local legislation.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Research projects are subject to the HRA when they take place abroad but research participants are recruited in Switzerland to participate in the research.

In this case, an authorization from the responsible Swiss ethics committee is therefore required. Otherwise, the research would not be lawful. Conditions set out in question 2 also apply in this case.

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

No. As expressed in question 4A, the research project requires the approval of the responsible ethics committee in Switzerland. Otherwise, the research is not lawful. An authorization issued abroad does not replace the one required in Switzerland.

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or Other

It depends. Sponsors are requested to have a local representative that will bear the liability in case of damages related to participation in a project. For the investigators, a research agreement describing the sharing of tasks and responsibilities is required. In case of exchanges of data or biological material, a Data or Material Transfer Agreement (DTA or MTA) are also required. The competent research ethics committee will assess the validity of those documents according to the HRA¹⁰ and the Data Protection Act.¹¹

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Whether the researcher is based in a commercial, governmental, or academic entity, does not pose a problem and the conditions listed above for authorization are identical. Yet, the research ethics committees will pay attention that the will of the participants as expressed in the Informed Consent Form is respected concerning such issue as in some cases participants are given the choice not to participate in a research funded by the industry.

With regard to the risks, the sponsor located abroad might not be subject to Article 19 HRA¹² relating to liability for any damage suffered in relation with the research project. However, the victim may sue the sponsor in Switzerland for compensation for the damage by means of Article 97 of the Swiss Code of Obligations (CO)¹³ if there is a contractual relationship and, failing that, on the basis of Article 41 CO.¹⁴ There is also an issue concerning the level of data protection granted by law in the country of destination of the samples. The Swiss Federal Act on Data Protection (FADP) of 19 June 1992,¹⁵ as the European General Regulation on Data Protection (GDPR),¹⁶ requires that this level should be at least equivalent to the Swiss.¹⁷ For US based studies, such guarantee is not granted and would require extra measure from the researcher to meet the Swiss requirements. Such guarantees will be requested by the competent Swiss research ethics committee.

The sponsor might also be sued in Switzerland if, for example, it carries out a research project without the authorization of the responsible ethics commission.¹⁸

Concerning the benefits, pursuant in particular to Article 5 (1) of the Nagoya Protocol on Access to Genetic Resources and the fair and equitable sharing of benefits arising from their utilization (Nagoya Protocol),¹⁹ benefits arising from the use of genetic resources as well as subsequent applications and commercialization shall be shared in a fair and equitable way between Switzerland and the country of the sponsor.

Finally, the persons concerned by a research project are entitled to be informed of results relating to their health. The information is to be communicated in an appropriate manner. The persons concerned may choose to forgo such information.²⁰

Part II — General Questions

According to the Article 42 HRA, biospecimens and genetic data could be transferred abroad only with the informed consent of the concerned person. Non-genetic data could be transferred abroad if the destination country has legislation that guarantees adequate protection.²¹

The aim of the Article 6 FADP is that no personal data can be communicated abroad if this communication constitutes a serious infringement of personality, in particular because of the absence of an adequate level of protection. The Federal Data Protection and Information Commissioner (the Commissioner) establish a list of countries with legislation to ensure an adequate level of protection.²²

If the level of the legislation in the destination country is not considered adequate, personal data may be communicated abroad only if sufficient guarantees, including contractual guarantees, ensure an adequate level of protection.

The requirements of the HRA apply to both individual citizens as well as research and medical institutions. Data processing carried out by cantonal public bodies, such as universities (with the exception of the Federal Institutes of Technology) and cantonal hospitals, fall under the competence of the cantonal data protection laws, but on the matter of data protection the cantonal laws on data protection provide the same requirements as the federal law.

Concerning pathogenic organisms and genetically modified organisms (GMO), their dissemination for research purposes is subject to authorization by the Federal Office for the Environment (FOEN) according to Article 27 of the Epidemics Act (EpidA) of September 28, 2012.²³ Furthermore, it should be noted that the Ordinance on the Transboundary Movements of Genetically Modified Organisms (CartO) regulates the transboundary movements of genetically modified organisms.²⁴ Anyone intending to export genetically modified organisms must comply with this duty of care²⁵ and, if they are intended for handling in the environment, must first obtain the consent of the competent national authority of the country in question.²⁶ The applicant must submit a copy of the application and of the decision of the importing country to the FOEN.²⁷

Research projects are submitted to the HRA when they take place abroad but the participants are recruited in Switzerland. When the sponsor/investigator or project initiative is based in Switzerland, it should be considered that the research project includes the collection of biological material and/or personal health data, and thus the Swiss legislation (e.g., HRA) is applicable, even if the collection of samples and/or data takes place outside Switzerland.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

Article 8 HRA states that “The persons concerned are entitled to be informed of results relating to their health. The information is to be communicated in an appropriate manner. The persons concerned may choose to forgo such information.”²⁸ This right has a primary goal of helping the concerned person to take a decision on preventive measures and on treatment. If, as part of a research project, a clear result reveals the presence of a disease, the person participating in the project must be kept informed, unless he/she has given up his/her right of being informed. However, it matters in all cases that this result is reliable. As a general rule, the more the disease (existing or likely to develop) is serious and the results are reliable, the more important it is to inform the person.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

In Switzerland, the direct-to-consumer genetic tests are currently not authorized in the medical field, nor for establishing a DNA profile. The current HGTA states that a genetic test may only be performed for a medical purpose with respect of the right to self-determination of the patient²⁹ and they may only be prescribed by medical doctors who are authorized to practice their profession independently or under supervision.³⁰ Genetic laboratories cannot accept direct demands from patients.

However, the HGTA was recently revised and will come into force in 2021. The regime for genetic analysis for medical purposes and the establishment of a DNA profile remain the same as today, the same regime will be applicable for non-medical genetic analysis to identify sensitive characteristics of personality (i.e., physiological characteristics that can influence on the lifestyle, personal characteristics such as character, behavior, intelligence, preferences or abilities, or those relating to ethnic origin etc.). Other genetic analyses for non-medical purposes could be delivered directly to the consumer (e.g., the ready-to-use genetic tests). The reason for such limitations is that the three categories of tests protected by law could have severe consequences for the concerned person and his family and, therefore, the quality of the analysis must be ensured and controlled by the authorities.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

To our best knowledge, DTP genomic research is not a topic of interest for researchers or other stakeholders in Switzerland now, therefore we cannot anticipate further developments. Depending on the pressure that may come from the international scientific community, this may change. Yet, we do not see a legal and ethical necessity to facilitate such type of research in Switzerland or elsewhere.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

DTP genomic research refers to research involving obtaining, investigating, analyzing, or using human specimens or an individual person's physiological, genetic, or medical information, which should be subject to Taiwan's Human Subjects Research Act (HSRA). According to Regulations for Organization and Operation of Human Research Ethics Review Board, which are set forth pursuant to Para. 3, Article 7 of HSRA, the review of research project shall at least include the following: (1) qualifications of the principal investigator, (2) eligibility criteria for the research subjects and the way of recruitment, (3) content of the project and way and place of execution, (4) items of agreement of be informed, the subjects to be informed, the way and procedure of indicating agreement as provided in Article 14 of HSRA, and (5) protections for the research subjects, including the channel of enquiry and complaint, etc.¹

In addition to the conditions mentioned above, if the DTP genomic research involves provision of nondelinked research materials overseas, a certification of guarantee to follow our domestic regulations and research material scope of permitted uses signed by the overseas research entity is required by IRB/REC according to Article 19 of HRSA.² However, an approval from a research ethics review body in the other country is not necessary for review by our IRB/REC.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

Per Article 9 of HRSA, where research personnel are unaffiliated with a research entity or not engaged in cooperative research with a research entity in Taiwan, e.g., the external researchers, they shall nevertheless be required to obtain IRB approval from one research entity or approval from a non-research entity affiliated independent IRB in Taiwan, prior to engaging in a protocol.³ It would not matter whether the external researcher is based at a commercial, governmental, or academic entity if the IRB/REC determines that the research project satisfies the conditions in accordance with the regulations and HRSA.

The perceived benefits might be as follows:

1. Accelerating the development of science and technology through the collaboration with local researchers;

2. Increasing the diversity of research projects and areas;

3. Sharing of hardware and software resources, etc.

The perceived risks might be as follows:

1. The difficulty in confirming whether the informed consent is appropriate;

2. The uncertainty of the follow-up use of specimens and materials;

3. The diversity of ethical regulations or guidelines and the practices thereof, etc.

Part II — General Questions

Yes, the exporting of biospecimens for research must be approved in advance by the Taiwan Food and Drug Administration per the Biospecimen Input and Output Guidelines,⁴ and the transferring of data across borders for research must follow the Personal Information Protection Act.⁵ Furthermore, if the exporting of biospecimens or the transferring of data across borders for research is relevant to the biospecimens or data collected and stored in a biobank, the approval from National Institute of Health is required in accordance with the guidelines for reviewing the international transfer of biospecimens or data from a biobank. However, those guidelines are mainly for biobanks, organizations, and research institutes but not for individual citizens.

Since international DTP research will certainly involve research relating to human subjects in Taiwan, HRSA will apply to international DTP research when residents or citizens of Taiwan enroll in a DTP study conducted abroad. Also, the Personal Information Protection Act of Taiwan applies to international DTP research as it is related to collection and use of highly sensitive personal information of residents or citizens of Taiwan.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

The issues relating to “incidental findings” have been discussed in Taiwan since the World Medical Association adopted and revised the WMA Declaration of Taipei on Ethical Considerations Regarding Health Databases and Biobanks. However, laws, regulations, or practices in Taiwan currently do not directly address these issues. Although the HSRA requires the principal investigator to provide the research protocol, including attribution of research results and uses thereof, said research results and uses are more related to the return of aggregate research results than individual results.

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

For now, there are no specific laws, policies, or guidelines regarding “direct-to-consumer” genetic testing in Taiwan, but whether to introduce legislation or not has been a long-discussed issue in Taiwan. It is worth mentioning that the biospecimens or health information of the consumer shall be collected in accordance with Article 6 of Personal Information Protection Act, which stipulates the limitations of collection, processing, or use of sensitive personal information.⁶

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

The issues relating to DTP genomic research have been discussed among both researchers and policy makers, but it is hard to anticipate what direction the law, policies, or guidelines will go.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

Although there is no explicit provision on DTP genomic research in Uganda, it seems such research could be approved if the researcher can demonstrate adequate respect for the rights and welfare of research participants, and comply with the regulatory regime on health research in the country.¹

The conditions stipulated above (see response to previous question) must be satisfied, and approval from a research ethics committee in the other country will be required.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • X Yes²

  • __ No

  • __ Not sure or other

• Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

There are several benefits that could inure from conducting IRB/REC-approved genomic research by a researcher from another country on samples or data obtained from Uganda including (a) enrichment of or new knowledge regarding etiology, diagnosis, and treatment of diseases/adverse health conditions; (b) building capacity on the part of local scientists that would be recruited as collaborators; and (c) discovery of improved techniques of responding to or treatment of illnesses.

Similarly, a number of risks could result from such research, such as abuse of research participants, and inadequate attention to the rights and welfare of the research participants,³ particularly in the realm of confidentiality obligation regarding samples procured from a particular population group or community, which, in turn, could expose them to harm — discrimination/stigmatization.

Part II — General Questions

Yes, Uganda has an entity which regulates the exporting of biospecimens or the transferring of data across borders for research, namely, the Uganda National Council for Science and Technology (UNCST).⁴ Importation and exportation of biospecimens for research purposes shall require clearance from UNCST, which is authorized to maintain a depository of all Material Transfer Agreements (MTAs).⁵ The requirement applies to all parties involved in the research although the MTA is required to be signed by only the authorized representative of the party seeking the transfer.⁶

Uganda does not have a law, policy, or guideline specifically designed to apply to international DTP. However, the extant policy regime — that is, National Guidelines for Research Involving Humans as Research Participants — could be modified to apply to international DTP research in the realm of genetic or genomic research or genetic or genomic privacy. There is no clear stipulation as to the applicability of this framework outside Uganda when residents or citizens of the country enroll in a DTP study conducted abroad, but it would seem that they could be interpreted to apply.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned⁷

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

As far as we are aware, when UK researchers based in universities and publicly-funded institutions wish to recruit participants in other countries for medical research, this is usually done as partners to a funding collaboration. Recruitment is usually carried out through clinical leads, biobanks, cohort studies, or hospitals to reach patients in other countries and increase the power and scope of a study. There are studies that advertise online in patient forums, but it is not clear how many of those studies are able to recruit patients outside of their jurisdiction in this way. This would be subject to research ethics approval and would depend upon the type and nature of the study. However, there are a number of projects, particularly in rare diseases that are being approached by patients in other countries who have discovered the project online. For example, patients from Japan have enrolled in the online UK-based, University of Oxford RUDY project (https://research.ndorms.ox.ac.uk/rudy/). Further research would need to be done to understand the numbers of projects in the UK recruiting online or being approached by patients and to establish the countries where participants are based.

While the UK is active in genomics research with a number of projects in this field, these projects do not tend to recruit online and do not recruit people from other countries into their studies. For example, the 100,000 Genomes Project¹ is a significant project in world terms and recruits patients through the clinic. UK Biobank² recruited patients via the National Health Service clinical services with a section 251 exemption and sent invitations by post. However, these projects increasingly use digital technologies alongside more traditional methods for interactions with participants.

The difference is with commercial DTC companies, as they recruit online and are not always based in the country where they are recruiting. A number of these operate in the UK and research is the “back end” of their business model. Legal requirements may in fact be more restrictive for DTC testing companies that also engage in secondary research, rather than specific research projects that recruit participants, but do not charge for their services. Consent requirements may be more stringent as applied to DTC companies engaging in health research than for other types of research conducted by public research institutions.

There has also been much discussion of issues raised by genomics research. The work of the now disbanded Human Genetics Commission (HGC) has been influential in this area. This was an independent advisory body to the government. It released a number of reports on various matters related to genetics, including: DTC genetic testing; genetic discrimination; genetics in insurance; and genetic databases. In relation to DTC they released two reports and a Framework of Principles, which could be drawn upon in improving industry governance, but as yet have not been.³ The HGC was replaced by the Emerging Science and Bioethics Advisory Committee (ESBAC),⁴ but this has also been disbanded. The Human Tissue Authority, which enforces the Human Tissue Act 2004 has also released various guidance documents, including a Code of Practice on Consent. There are a number of versions of this document, the most recent was released in 2017.⁵

When considering conditions for granting research approval, RECs seek to balance the advancement of science against the protection of participants' welfare and rights. As such, an REC should perform an ethical and scientific review of the research in question.⁶ Conditions attached to any REC approval granted, might include:⁷

• patient and clinical benefits of the research;

• the scientific and transformational objectives of the research;

• the implementation strategy;

• the ethical and governance frameworks required (both including the policy for data access, to ensure that all necessary safeguards are in place).

Conditions considered by an ethics committee are listed in the Medicines for Human Use (Clinical Trials) Regulations (2004); and the remit of RECs is laid out in the “Governance arrangements for research ethics committees” document. The initial process involves contacting the clinical governance or research development office who advises whether the project is research and whether HRA approval and/or ethical approval is required. For non-research, if patient data is to be used without consent, a recommendation from the Confidentiality Advisory Group (CAG) and advice from the Caldicott Guardian will be required.⁸ Where necessary, applications need to go to a flagged REC which is designated for review of particular types of application, and flagging of RECs is based on legal or regulatory authority for review of particular types of application.

To conduct genomic research in another country, a UK researcher would have to fulfill the regulatory requirements for ethics approval in that country. This would be the same if an external researcher conducted research in the jurisdiction of the UK. For example, RECs outside the UK are not recognized for the purposes of the Human Tissue Act 2004.⁹ There is currently no system that recognizes the equivalency of REC decisions across Europe and so researchers have to apply in each jurisdiction for approval.

Where UK NHS patients or their data will be used, in addition to patient or non-patient studies outside of the UK, HRA approval is required for the UK NHS portion. University research ethics approval and local ethics approval or organizational approval will be required if a REC does not exist in the location where research will be conducted or data collected from.

• a. Would it be lawful for the researcher to do so without IRB/REC approval in either the researcher's country or your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

While there has been much international collaborative research conducted in the UK, due to the ongoing Brexit negotiations, there is now some level of uncertainty regarding the conditions for when it will be permitted for researchers from outside the UK to conduct genomic research within the UK.^{Reference Phillips, Hervey, Slokenberga, Tzortzatou and Reichel10}

• b. Would it be lawful for the researcher to do so if the research were approved by an IRB/REC in the researcher's own country, but was not submitted for approval in your country? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

• c. Would the external researcher be required to have a collaborator in your country? [Yes/No]

  • __ Yes

  • __ No

  • X Not sure or other

There would not necessarily be a requirement for a collaborator, though this would make things much easier logistically.

• d. Would it matter whether the external researcher is based at a commercial, governmental, or academic entity? [Yes/No]

  • __ Yes

  • X No

  • __ Not sure or other

The managing organization (which subsequently becomes the sponsor) can be commercial, governmental, or academic, and so can the external researcher. If the project is determined to be research, then the relevant approvals apply. If a project is a research tissue bank, research database, or takes place outside the NHS setting, then HRA approval is not required, but REC approval is. It does not matter for the purposes of submitting an application to a research ethics committee where researchers are based, and all researchers will undergo the same process of review if they are using the NHS to recruit patients or are using NHS data, facilities, or staff. However, for the purposes of data protection, it does matter. According to the Health Research Authority and the Information Commissioners Office Guidance, research for health and social care should rely on other grounds for processing data, such as the public interest,¹¹ whereas organizations that are not public entities, especially DTC companies, are unlikely to be able to rely on these same grounds, given that they are typically conducting research on consumer data, which is originally collected for the purposes of a commercial genetic testing service.

In the UK, any research on samples from NHS patients or other research will have to have relevant approvals as outlined above. The risks and benefits would be considered by HRA and the appropriate REC accordingly. There are specific governance mechanisms that researchers have to adhere to, including providing assurances for the handling of data. Risks might include that ethical standards and regulations may differ between countries, ethical review may not be required in the country of the researcher, research participants may not receive feedback of results, particularly of incidental findings if applicable, and different levels of choice are given to participants regarding the collection, use, and sharing of their samples.

Part II — General Questions

Yes. The relevant data protection regulator is the ICO (Information Commissioner's Office). Current legislation on data protection is the Data Protection Act 2018 together with the General Data Protection Regulation. There is some level of uncertainty regarding how the UK will be treated by other European member states post-Brexit, but the Data Protection Act has incorporated the GDPR into the UK's domestic law, as well as making derogations from it.

The Human Tissue Authority enforces the Human Tissue Act 2004 and regulates “organizations that remove, store, and use human tissue for research, medical treatment, postmortem examination, education and training, and display in public.”¹²

The Health Research Authority (HRA) was established in accordance with the Care Act 2014, “as an executive non-departmental public body (NDPB) sponsored by the Department of Health on 1 January 2015.”¹³ The HRA's primary purpose “is to protect and promote the interests of patients and the public in health and social care research.” In order to achieve this, it seeks to:

• make sure research is ethically reviewed and approved

• promote transparency in research

• oversee a range of committees and services

• provide independent recommendations on the processing of identifiable patient information where it is not always practical to obtain consent, for research and non-research projects.¹⁴

Both the ICO and the Health Research Authority have released guidance indicating that consent should not be the basis for processing in the context of health and social care research.¹⁵ However, in the context of DTC testing companies conducting health research, all companies will still need appropriate consent for the initial test and are likely to need additional consent for secondary research in accordance with both data protection legislation and the Human Tissue Act.

The Human Fertilisation and Embryology Act 1990, which is enforced by the Human Fertilisation and Embryology Authority, also is relevant here. It “approves and licences research projects which use human tissue. The Act prohibits a number of acts including the creation of an embryo, except when holding a licence issued by the Authority. Generally speaking, without authorisation, there cannot be any genetic alterations of eggs and sperm and no person shall use modified germ cells to provide fertility services.”¹⁶

The UK has enacted the Data Protection Act 2018, which incorporates the GDPR into the UK's domestic law and also sits alongside the GDPR, while the UK remains part of the EU. Under both the Data Protection Act and the GDPR, genomic data is categorized as sensitive information, and the standard of consent required for processing this data is quite high. For organizations conducting health and social care research within the UK, in accordance with the HRA and ICO guidance, consent may not be the main legal basis for processing, but where a DTC company is conducting health research on consumers' data they should be complying with data protection requirements and should be obtaining appropriate consent for all processing of genetic data.

• a. The law requires the return of individual results unless the participant expressly declines to have results returned

• b. The law is silent on return of results; the expectation is that individual results will be returned unless the participant expressly declines to have the results returned

• c. The law is silent on return of results; aggregate results are typically returned, but individual results are not returned unless expressly stated in the research protocol

• d. I am not sure — or other answer

• a. Yes. Direct-to-consumer genetic testing is illegal

• b. Yes. Direct-to-consumer genetic testing is legal

• c. No. Direct-to-consumer genetic testing is not an issue

• d. I am not sure — or other answer

At present, DTC genetic testing is technically legal. That being said, all organizations conducting genetic tests are supposed to be complying with the provisions of the Human Tissue Act, as enforced by the Human Tissue Authority. The Human Tissue Act (HTA) governs the use of human tissue and organs in the UK. The Act sets requirements for consent and makes it a criminal offence under section 45 to analyze DNA without appropriate consent. It would appear that the Act has direct application to the DTC industry.¹⁷ The Human Tissue Authority's “Analysis of DNA under the HT Act FAQs” states that:

All companies providing DNA testing kits or DNA testing services must comply with the provisions of the Human Tissue Act 2004 relating to consent and the holding of bodily material with the intent to analyze DNA.^{Reference Phillips18}

However, 23andMe has been allowed to market through Superdrug in the UK because it obtained a Conformité Européene (CE) mark for its test kit, which means essentially that the kit has been approved as safe for the purposes of collecting saliva.^{Reference Ray and Gibbs19} This also means that the kit can be marketed throughout the EU, as CE certification is recognized reciprocally, so that if a company receives a CE mark in one Member State the mark will be recognized by others.²⁰

An inquiry was launched in March 2019 into the commercial genomics industry by the Science and Technology Committee (Commons). We are still awaiting the recommendations from this consultation.²¹

In October 2018 the Association of British Insurers released a Code of Practice On Genetic Testing And Insurance.²² This is a voluntary code and does not apply to all insurers, but it is a positive step in relation to providing some level of protection for people in this context.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

How the laws on this change are likely to be connected with the form that Brexit ultimately takes and how other countries, both within the EU and those outside the EU, treat the UK for data protection and other purposes.

Part I — DTP-Specific Questions

• a. There has been little, if any, discussion of the issue as of now

• b. There has been discussion among researchers, but little discussion among policy makers

• c. There has been discussion among both researchers and policy makers

• d. I am not sure — or other answer

DTP research is increasingly seen as a valuable tool for researchers seeking to study rare genetic disorders or populations that are historically under-represented in genetic datasets. DTP research studies are already underway in the United States. For example, the Metastatic Breast Cancer Project at the Broad Institute (MIT/Harvard) recruits participants directly with the help of breast cancer advocacy organizations and has successfully done so in all 50 states.¹ DTP research efforts are also underway in the private sector. The National Geographic Genographic Project has recruited nearly 1 million individuals in over 140 countries in an attempt to gain insights into human migration patterns.² 23andMe has utilized the DTP model to recruit participants for their Global Genetics³ and African Genetics projects⁴ in an effort to increase the diversity of samples in genetic and genomic datasets (although enrollment in these projects is currently limited to individuals who reside in the U.S.). 23andMe is expanding these efforts internationally with its Populations Collaborations Program, which provides monetary support and test kits to “researchers working with understudied populations from locations as wide-ranging as the Democratic Republic of Congo, Angola, and Honduras.”⁵

There has been limited formal discussion among policy makers regarding DTP genomic research. Instead, policymakers have generally limited their involvement to providing guidance on subjects directly relevant to DTP research more broadly (e.g., recruiting participants via the internet or obtaining consent online; both of which are discussed below).

Since this question assumes that the DTP genomic research is subject to IRB review, the research most likely falls under the Federal Policy for the Protection of Human Subjects (i.e., the Common Rule).⁶ However, it may also fall under the analogous FDA Policy for the Protection of Human Subjects⁷ and/or state laws that impose a requirement of IRB review. This section will focus on conditions for approval under the Common Rule, while FDA and state law regulations are discussed in greater detail in the context of Question 7.

Part II — General Questions

Given the paucity of regulations surrounding DTP research carried out by entities that do not fall within the Common Rule, FDA regulations, or HIPAA, export and import regulations may be one of the more complicated issues for individuals and entities wishing to engage in DTP research. In the United States, the export of biospecimens (e.g., DNA, saliva, blood) is regulated primarily by the Department of Commerce (DOC). The import of biospecimens may be regulated by several federal agencies and organizations, including: US Customs and Border Protection (CBP), Food and Drug Administration (FDA), and the Centers for Disease Control and Prevention (CDC). Finally, both import and export would likely require compliance with Department of Transportation (DOT), United States Postal Service (USPS; or similar carrier), and International Air Transport Association (IATA) regulations. The applicability of import/export regulations depends largely on the type of biospecimen at issue (as opposed to the entity importing/exporting the biospecimen), so they would generally apply equally to citizen scientists, research and medical institutions, and commercial entities.

Part III — Looking to the Future

• a. I do not think they will change at all

• b. I think they will restrict international DTP research

• c. I think they will allow international DTP research

• d. I am not sure — or other answer

Given the relatively hands-off approach that federal agencies and legislators have taken toward issues like DTC-GT and research conducted by individuals and entities outside the scope of the Common Rule, the United States does not appear likely to place significant restrictions on international DTP research in the next five to ten years. In addition, the Common Rule was recently revised (and the revisions do not directly address DTP research), so it does not appear likely that revisions that would affect international DTP research are imminent. Instead, policy changes in the next 5-10 years will likely come in the form of guidance from federal agencies or the implementation of IRB policies as opposed to formal rulemaking or legislation.

It remains to be seen what effect state and federal data privacy legislation will have on DTP research efforts. There are currently numerous federal bills relating to data privacy currently pending in the Congress that, if enacted, would likely have an impact on DTP research efforts and the collection, use, and sharing of genetic information more broadly.¹⁵⁹ These bills vary in their scope and whether they explicitly address research or genetic information, but, like the GDPR, commonly grant access and correction rights to individuals and impose restrictions on the use and sharing of personal information without informed consent.¹⁶⁰ While Congress debates federal legislation, sweeping data privacy laws are being enacted and implemented at the state level; the California Consumer Privacy Act of 2018 (CCPA),^{Reference Rothstein and Tovino161} effective January 1, 2020, and New York is currently considering similar, even more stringent legislation in the New York Privacy Act.¹⁶² Other states seem poised to follow.

Given the unique promise of DTP research to increase the diversity of genomic datasets and to further the study of rare diseases, there would likely be public (and possibly political) support in the U.S. to clarify the present law surrounding DTP research. The American public would likely be receptive to efforts to clarify the law surrounding DTP genomic research. A 2018 NPR/Truven Health poll found that 77% of the Americans surveyed would be willing to share their genetic test results for health-care research and indeed, millions of Americans have already undergone direct-to-consumer genetic testing and agreed to participate in the associated research activities.¹⁶³ Resolving the uncertainty created by a patchwork of state and federal laws could help facilitate the largescale precision medicine initiatives already underway in the country (e.g., NIH's All of Us Research Program). In addition, various stakeholders (e.g., academic researchers, pharmaceutical companies, direct-to-consumer genetic testing companies) stand to benefit from additional clarity and may have the political influence to shape the debate.