Introduction

For biobanks good governance is key to ensure the protection of the ethically relevant interests of research participants, and at the same time to promote the efficient use of their resources by the scientific community. Good governance structures and processes also increase a biobank’s legitimacy and social license to operate, that is, their likelihood that broader publics see their work as socially acceptable and desirable, and aligned with existing norms and societal expectations [1, 2]. In the literature, good biobank governance is commonly described as the sum of three necessary—albeit not sufficient—components: transparency, accountability, and oversight [3, 4]. Such features are also necessary conditions for trustworthiness [5, 6]. Transparency is the “availability of information about an actor allowing other actors to monitor the working or performance of this actor” [7]. In public management studies, transparency is almost ubiquitously regarded as a positive feature in and of itself. Moreover it is also believed to facilitate accountability [7, 8]. Accountability refers to mechanisms through which an organization makes itself answerable for its operations, that is, capable of giving account to stakeholders for the actions it has undertaken [8, 9]. For a biobank, being accountable implies—at a minimum—providing relevant information about how samples and data are stored, used and shared; answering stakeholders when they ask for explanations about its conduct; and be under the condition of being affected by stakeholders’ judgment of its operations [10]. Transparency facilitates accountability when it discloses significant information, and when the public character of such information can influence—directly or indirectly—the actors’ conduct, for instance by instigating good reputation-seeking behaviors [7]. Finally, oversight refers to the procedures and structures that an organization puts in place to monitor its own operations in the interest of affected parties [11, 12]. Oversight is particularly relevant in biobanking these days, since biobanks handle increasing amounts of research participants’ personal data and biological materials [13].

Expanding research paradigms like precision medicine and digital health rely on unprecedently large collections of biological samples, genetic and clinical data, as well as data collected through mobile or wearable devices, often by research participants themselves and outside of the research or clinical context [14]. Sharing such data for research purposes is going to be a driver for science and innovation, but of course it comes with risks linked to privacy, security and control of data uses [15]. Moreover, as artificial intelligence emerges as a transformative technology in the quest for extracting medical value from big data, new and still partially unknown regulatory challenges loom large on the horizon [16, 17]. Biobanks are thus bound to be a key node not only of a rapidly increasing health data ecosystem, but also of an ever-more complex governance network [18]. As demonstrated by the failure of initiatives like the NHS England care.data program, securing social license to operate in the domain of large-scale data-driven research is not going to be trivial [19].

In response to the increasing and diversifying data volumes in biomedical research, the governance of research biobanks has been attracting considerable academic interest for the last 15 years, especially in areas such as informed consent, privacy, and data management [20]. In particular, biobanks have been studied as a prominent example of post-regulatory governance involving a complex, decentralized network of actors and mechanisms [21] to ensure their alignment with participants’ rights as well as with societal values and expectations [22].

The present study contributes to this debate through a comprehensive, empirically-informed analysis of governance mechanisms adopted by biobanks, and discussing how such mechanisms contribute to transparency, accountability, and oversight. Our analysis shows that most biobanks attempt to be transparent about their governance mechanisms. In particular, we documented considerable efforts on the part of biobanks to earn legitimacy (or social licence). However, more fine-grained information should be provided to inform stakeholders about how governance mechanisms support accountability, as well as about oversight mechanisms adopted to mitigate the risks associated with biobanks’ operations.

Methods

We identified biobanks through an exploratory and inductive approach [23]. In autumn 2018, we consulted the Biobank Resource Centre in Canada and the Biobanking and BioMolecular resources Research Infrastructure (BBMRI) - European Research Infrastructure Consortium [24, 25]. We focused on Canada and Europe for methodological reasons, since both regions offer comprehensive databases that can be searched to identify biobanks. We collected information about governance mechanisms from the website of each included biobank. If only limited information was provided online, we contacted the biobank and searched for additional information in the scientific literature. These contacts resulted in email exchanges with eight biobanks, and informal telephone interviews with personnel of four additional biobanks. We then categorized governance mechanisms inductively [26]. We grouped the mechanisms according to common features. FG and AB conducted the categorization and discussed the emerging domains in an iterative process.

Ethics

All data obtained are in the public domain and we do not anticipate any physical, psychological, social or legal risks.

Results

We reviewed biobanks from Austria n = 1; Canada n = 19; Belgium n = 1; Germany n = 5; Estonia n = 2; Finland n = 8; Italy n = 3; Latvia n = 1; the Netherlands n = 17; Norway n = 2; Poland n = 2; and the United Kingdom n = 8. See Appendix for a detailed table. After reviewing 69 biobanks, thematic saturation was reached meaning that no new mechanisms emerged from subsequently reviewed biobanks [27]. We categorized the accountability mechanisms into six domains as shown in Table 1.

Table 1 Accountability mechanisms of biobanks located in Canada and Europe.
Full size table

Communication

Biobanks employ a variety of strategies to communicate about their structure and activities. Websites and public information stands at associated hospitals are the primary communication channels to inform the scientific community, research participants, and the general public. Biobanks provide general information about their history, research focus, and governance structures mainly through websites. Frequently asked questions and profiles of team members are also sometimes present on websites, along with videos to explain different aspects of the governance or research process. Information about current research projects is used to show how and by whom the data are used. In addition to such information, biobanks at times provide links to external material such as support groups for patients with specific diseases, as in the case of the Alberta Prostate Cancer Registry & Biorepository (Canada) for example [28]. Some biobanks—like the 100,000 Genomes Project, UK [29], for instance—also provide real-life participant stories to explain what motivated participants to donate to the biobank and how they experienced the donation process. Moreover, some biobanks publish their research protocols, including relevant information about the development of their repositories and datasets. Such protocols generally also describe data security measures [30].

Some biobanks organize open days and workshops to interact with the general public and to showcase their development and their scientific achievements. For example, together with the German Biobank Alliance, the Interdisciplinary Bank of Biomaterials and Data Würzburg (Germany) organizes a citizen workshop on issues such as return of results, donor ethics, or sample/data ownership [31]. Similarly, in Austria, the Biobank Graz, maintains a wide portfolio of public relation activities such as open nights, guided tours, and internship programs for pupils [32].

Compliance

Biobanks operate under a variety of national as well international legal provisions, ranging from laws ensuring the protection of research subjects, to norms about the use of embryos, germ cells and genetic material [33]. Ethics review of research protocols align the operations of biobanks to such legal rules, but it does not exhaust compliance with complex legislation in areas such as, for instance, data protection. At the European level, a prominent example of such legislation is the General Data Protection Regulation (GDPR) [34]. We found that biobanks attempt to show proof of compliance with this type of legislation as well as with national and international ethics codes. To this aim, websites indicate relevant legal and ethical sources and in some cases provide details about measures taken to meet regulatory of ethical standards—as does, for instance, Biobank UK by describing its GDPR compliance measures [35].

Expert advice

We found that most biobanks avail themselves of advisory committees that provide recommendations on how to steer biobank operations from technical, ethical, and organizational perspectives. Such advisory committees can also provide input on issues such as overall scientific strategy or external data access requests. Typically, such committees consist of experts and professionals and they rarely include research participants. Advisory committees can consist of both national and international experts associated with the biobank—for example the UK Biobank has an International Scientific Advisory Board [36]. Such committees can also be charged with overseeing data management [37]. In some cases, the advisory committee is combined with the ethics committee. In other cases, in addition to advisory committees, an independent ethics committee comprised of research and ethics professionals, and sometimes lay members, assesses research protocols and advises on ethical issues. For example, at Radboud UMC Biobank, a patient representative is a member of the medical-ethical review board [38]. The same is true for the ethics advisory committee of the 100,000 Genomes Project, UK [39]. Some ethics committees also provide ethics advice regarding research strategies and organizational management. Lastly, we found that many biobanks also establish management committees to decide on the strategic and organizational aspects of the biobank. Such committees are usually comprised of research professionals; participant representatives are rarely part of them.

External review

Biobanks receive ethical approval from a research ethics committee prior to their launch. Some biobanks—like UK Biobank—make approval letters available on their website [40]. After their establishment, biobanks are audited by external organizations as to their quality management practices, reproducibility of their findings, and for adopting best practice standards [41]. External ethical review is also needed for research projects intending to use a biobank’s resources. This is provided by independent research ethics review committees that are not linked to the biobank.

Internal procedures

All biobanks included in our study collect samples and data following an informed consent process. Broad consent in particular is generally adopted. Broad consent can be defined ‘as consent for an unspecified range of future research subject to a few content and/or process restrictions’ [42]. Biobanks follow a variety of internally developed policies for data storage and data security. The description of such policies is generally coupled with information about the IT infrastructure employed for data management. Furthermore, we could retrieve data access policies describing under which conditions researchers both in the public and private sector can access stored data [43]—as in the case of the Ontario Health Study, Canada [44]. Open and free access to samples is not common practice. Privacy preserving measures describe how donor privacy is protected including how data are anonymized or pseudonymized.

Flow charts are commonly used tools to explain the organization and the activities of the biobank, or to illustrate relevant processes such as how to inform participants about what to expect from participating in biobank activities, or how to request access to data and samples. Organizational charts are used to show different working groups and management structures within the biobank. For example, the Biobank Graz, Austria, publishes several flow charts on its website to describe its internal organizational structure and how its different committees interact with one another [45].

Biobanks implement quality control check points at various levels of their laboratory workflow, as seen in the protocol of the 100,000 Genomes Project for example [46]. Further, biobanks maintain an active quality system to adhere to international quality standards such as the International Organization for Standardization (ISO) 9000 standards for quality management and the new ISO 20387 standard for biobanking. Adherence to such quality standards and quality evaluation by different external organizations is often expected by funding organizations, researchers and partners from industry [47]. For example, the Auria Biobank, Turku, Finland, maintains a quality system that considers OECD, ISO as well as BBMRI-ERIC guidelines. Auria Biobank was certified by participating in a Proficiency Testing Program organized by the Integrated Biobank of Luxembourg [48].

Finally, standard operating procedures outline step-by-step different work processes across the biobank. These include decision processes within the different committees as well as research processes. For example, Radboud UMC Biobank, the Netherlands, issued a wide range of standard operating procedures regarding sample collection and processing [49].

Partnership

Our findings suggest that smaller biobanks often enter into collaboration agreements, or affiliate themselves with other biobanks or research institutions. The aims of such partnerships are multiple. By federating with other organizations, small biobanks can follow more efficient workflows; they can adopt more robust best practices; they can lower costs; and acquire access to bigger repositories of biological material or to larger databases—which is crucial in the case of rare disease for instance [50].

Some biobanks become members of professional organizations or large networks of biobanks that can increase the value of collected biospecimen. For example, the Canadian Tissue Repository Network, ensures rigorous quality control on all shared samples and acts as a capacity-building platform for the Canadian biobanking community [51]. Analogously, in Europe, BBMRI supports it members in the areas of quality management, data storage and compliance with data protection laws and other relevant regulatory frameworks [52].

Limitations

As this study focuses on European and Canadian biobanks, the findings might not be generalizable beyond these geographical areas. Furthermore, the identified governance mechanisms stemmed largely from population-based and genetic biobanks. It is thus possible that other types of biobanks might adopt additional or different governance solutions. However, comparing the findings against existing literature, we believe that our results provide a truthful representation of adopted governance mechanisms biomedical research biobanks [37, 53]. Still verifying the representativeness of our findings exceeds the scope of this study. During the research process we identified problems with regard to visibility of governance information online. For n = 29 of the initially included biobanks, we were not able to find sufficient information about governance structures and governance mechanisms, or the information left questions open. Hence, these did not contribute to the catalog above.

Discussion

The present study provides insight into the preparedness of biobanks in terms of governance mechanisms and structures for future data intense research.

According to our analysis, all the reviewed biobanks make at least some attempt at being transparent about their governance structures and mechanisms. However, there is substantial variability in just how much information biobanks provide, both in terms of the number and kind of reported governance mechanisms, and in the amount of detail provided. Governance categories such as expert advice, compliance, external review and partnership share one noteworthy characteristic: they all contribute to biobanks’ legitimacy. In other words, such mechanisms show what biobanks do to meet formal or informal standards in domains such as scientific validity, regulatory consistency, ethical robustness, and professional best practices. By being transparent—albeit to different degrees—regarding such dimensions of legitimacy, biobanks show their willingness to satisfy the expectations of their stakeholders and of society more in general. This form of transparency is important to preserve the “tacit social contract” biobanks have with society [54], thus allowing the biobank to earn social licence. This finding is consistent with other studies. A 2005 comparative study taking into account four large-scale population biobanks, shows considerable efforts in establishing legitimacy by means of advisory boards and independent ethical review [3]. Similarly Salter and Jones, in a paper on the UK Biobank, speak of a “politics of legitimation accompanying the emergence of population-based genetic databases” [55]. Our study shows that this effort extends beyond large-scale biobanks.

Despite such focus on legitimation-building mechanisms, only scant information is provided about actual accountability mechanisms adopted by the biobanks. A key determinant of public accountability is that account is rendered in an open, accessible and proactive way, that is, in a way that facilitates stakeholders and the general public in understanding how an actor operates [10]. In this respect, communication activities could offer opportunities to increase accountability in at least two senses: on the one hand, good communication can pre-empt the informational needs of stakeholders, possibly also reducing the need of proper, formal accountability mechanisms themselves; on the other hand, physical presence at information boots (in hospitals, public engagement events or scientific conferences) could enable a biobank to make itself available for questions by interested people. These mechanisms, however, would still fall short of capturing the full meaning of accountability as an organization’s disposition to be answerable to its stakeholders and the public more in general (see above, “Introduction”). Internal procedures provide—among other things—information about the governance architecture of biobanks. This kind of information contributes to accountability directly in that it allows stakeholders to identify who, or which office or committee is responsible for a given activity, for instance, privacy protection or data sharing. However, none of the reviewed biobanks offers clear indications as to how the organization renders account of its operations to interested stakeholders and the public in general. This of course does not mean that accountability mechanisms do not exist, but rather that they are not sufficiently visible. Similarly, we have not found direct evidence of the translation of legal and compliance regulation into accountability procedures. Rather we found referencing of legislation or regulation. This may reflect a lag between the legal requirements and the scholarly debate on one side, and the implementation of appropriate measures on the other—with the methodological caveat that this may be due to insufficient communication about such mechanisms.

In 2016, the Global Alliance for Genomics and Health has issued its accountability policy defyining best practices for stakeholders. This policy is intended to promote responsible data sharing and emphasizes oversight mechanisms to ensure effective monitoring and responding to non-complinace [56]. As far as oversight is concerned, we noticed that many biobanks release their own protocols in the public domain including quality control mechanisms, data security measures and data sharing procedures. In the near future however, with the anticipated exponential growth of data stored and circulated for research purposes, oversight will arguably have to become a more complex type of activity. With these developments in mind, two of us (AB and EV) have developed a systemic oversight framework that offers high-order principles of adaptive governance to ensure appropriate oversight vis-à-vis the growing scale and the novel challenges of big data health research [12, 14, 57]. This framework is composed of six principles: adaptation, flexibility, inclusiveness, responsiveness, reflexivity, and monitoring (AFIRRM). Adaptivity and flexibility refer, respectively, to the capacity to oversee new data sources (such as data generated by mobile apps) and new uses of more conventional ones (such as the use of machine learning to mine genetic data). Monitoring refers to the capacity to detect new potential threats and harms in emerging forms of data collection, use and distribution. Responsiveness mechanisms aim at repairing or remedying to the extent possible to occurring harms, such as privacy breaches or data misuses. Inclusiveness suggests the opportunity to involve stakeholders and wider publics in oversight activities with the aim of maximizing social learning from a broad array of sources. Finally, reflexivity refers to critical surveillance of the implications of a biobank’s activities from an ethical, legal and societal point of view. The long-term objective of AFIRRM is to offer a blueprint for the development of a variety of oversight mechanisms fostering the emergence of an adaptive approach to the governance of big data health research.

Biobanks are one of the central actors in the rapidly evolving field of large-scale, data-driven health research. We have shown that biobank governance relies on a variety of structures and mechanisms adopted across the board in a quite consistent way. We also stressed, however, that there is room for improving biobank governance especially in making accountability mechanisms more visible and adopting a systemic approach to oversight activities. Such adjustments are needed to future-proof biobank governance, to streamline the scientific exploitation of increasing amounts of data and biological resources, and to nurture public trust in science for the years to come.